Switch to betterleaks (again)

[Soph]

https://entire.io/gh/entireio/cli/trails/234

• switching from goleaks to betterleaks
• added specific tests to cases we hadn't covered or failed before that they work with betterleaks

---

Note

Medium Risk
Updates the always-on secret redaction engine and dependency graph, which could change what gets redacted (or missed) in stored transcripts. Adds new URL credential redaction and regression tests to reduce the chance of false negatives and tooling side effects.

Overview
Switches transcript secret scanning from gitleaks to betterleaks (new dependency + updated go.mod/go.sum) and updates security docs accordingly.

Extends always-on redaction by also matching and redacting credentialed URLs (e.g., scheme://user:password@host) and adds coverage for private key blocks and these URLs in redact tests.

Adds a regression test (betterleaks_env_test.go) to ensure importing/using the redactor does not leak git-isolation environment variables into subsequent git subprocesses, and updates allowed licenses to include 0BSD.

^{Reviewed by Cursor Bugbot for commit 1843314. Configure here.}

[Copilot]

Pull request overview

This PR switches the redaction engine’s pattern-based secret scanning from gitleaks to betterleaks, and extends redaction coverage (and tests) for credentialed URIs and private key blocks to ensure the new detector catches previously missed cases.

Changes:

• Replace gitleaks detector usage with betterleaks in redact.String.
• Add always-on redaction for credentialed URIs (scheme://user:password@host...) plus new unit tests covering common DSN/URL variants.
• Add a regression test ensuring betterleaks initialization doesn’t leak git-related environment variables into subsequent subprocesses; update docs and license allowlist accordingly.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
redact/redact.go	Switches detector import to betterleaks and adds credentialed-URI regex redaction.
redact/redact_test.go	Adds coverage for credentialed URIs and OpenSSH private key block redaction (including JSONL).
redact/betterleaks_env_test.go	Adds regression test to ensure betterleaks usage doesn’t poison git environment variables.
go.mod	Adds github.com/betterleaks/betterleaks and removes direct gitleaks/v8 dependency.
go.sum	Updates dependency checksums after the detector/library switch.
docs/security-and-privacy.md	Updates documentation to reference Betterleaks and credentialed-URI redaction.
.allowed-licenses	Adds 0BSD to accommodate the new dependency’s license.