fix(#429): prevent API keys from being committed via map-codebase
Defense-in-depth approach:
Layer 1 - Prevention:
- Add <forbidden_files> section to gsd-codebase-mapper agent
- Explicitly prohibit reading .env, credentials, keys, secrets
- Agent can note file existence but never quote contents
Layer 2 - Detection:
- Add scan_for_secrets step before commit in map-codebase workflow
- Regex patterns catch: sk-*, ghp_*, AKIA*, xox*-*, JWTs, private keys
- Halts with alert if secrets detected, requires user confirmation
Layer 3 - Documentation:
- Add Security section to README
- Document Claude Code deny rules for sensitive files
- Recommend defense-in-depth approach
Closes #429
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
f53011c9e2