v3.7.0

Added

• leak respond <owner>/<repo> runs the first hour of an incident in order, in one incident folder: evidence snapshot, full-history scan, rotation plan, copy hunt and incident report.
  • Every step is written to timeline.md with its UTC time, and its full output to logs/.
  • Rotating, the takedown and telling people stay with you. It says what to do for each one, and --done rotate (or takedown, notify) records the time you finished.
  • Run it again with --dir to continue where it stopped. --redo hunt repeats the hunt a week later, as the runbook asks, and --status shows where the incident stands.
  • It only reads, like the steps it runs. The folder gets a .gitignore because the evidence holds the leaked code.
• Fast pull request scans.
  • leak scan --commits BASE..HEAD scans only the commits in a range.
  • The GitHub Action's new scope: changes input scans only the commits a pull request or push adds, in seconds on a large repository.
  • If that range is not in the checkout (a branch's first push, or a shallow clone), the Action scans the full history and says so, so nothing is skipped silently.
  • scope: history stays the default.