{
  "name": "strict-secrets",
  "version": 1,
  "risk": "medium",
  "use": "Refuse commits that look like secrets or stage credential directories. Review the pattern before applying.",
  "rules": {
    "neverCommitPatterns": "(api[_-]?key|secret|password|BEGIN (RSA |OPENSSH )?PRIVATE KEY)",
    "protectedDirs": ".env .aws"
  }
}