chore: repo standards v1 (gitleaks CI, SECURITY.md fingerprint, LICENSE/README)

.github/workflows/ci.yml

@@ -23,3 +23,16 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npm test
+
+  gitleaks:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

SECURITY.md

@@ -14,6 +14,13 @@ Email **security@jordannewell.com** with:
 
 **Do not open a public GitHub issue** for security reports.
 
+If you have a PGP key, encrypt your report. GPG fingerprint of the project's
+reporting key:
+
+```
+67567DC5E7C5353F85F2AF0DAC05D3F3E0EFA32A
+```
+
 ## Response timeline
 
 - **Acknowledgment:** within 72 hours