Security: add credential exposure safeguards and purge runbook (#60)

[teesofttech]

Summary

• add repository-level unit guardrails to detect committed high-risk live secret patterns
• add a credential rotation + git history purge runbook for incident response
• link incident runbook from dependency security documentation

Why

Issue #60 requires secret exposure remediation discipline: rotate/revoke compromised credentials and purge leaked values from git history. This PR strengthens prevention and response guidance in-repo.

Validation

• dotnet test PayBridge.SDK.Test/PayBridge.SDK.Test.csproj --filter "Category=Unit"
• result: 153 passed, 0 failed

Scope notes

• This PR does not rotate provider credentials directly (requires dashboard access and secure secret stores).
• This PR does not rewrite git history automatically; it provides a reviewed runbook for coordinated execution.

Closes #60

Summary by CodeRabbit

• Documentation
  • Added an incident-response runbook for rotating exposed credentials and removing secrets from version history.
  • Documented post-remediation verification steps, communication guidance, and repository cleanup procedures.
  • Expanded dependency security guidance with instructions for handling credential exposure.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2343f527-69ef-4d91-b9d0-289e3866444e

📥 Commits

Reviewing files that changed from the base of the PR and between c6e364d and 5ecb660.

📒 Files selected for processing (2)

• docs/credential-rotation-and-history-purge.md
• docs/dependency-security.md

---

📝 Walkthrough

Walkthrough

Adds a credential rotation and history purge runbook covering containment, git-filter-repo cleanup, verification, and communication. Updates dependency security guidance with a link and instruction to follow the runbook for credential exposure incidents.

Changes

Credential exposure response

Layer / File(s)	Summary
Rotation and history purge guidance docs/credential-rotation-and-history-purge.md, docs/dependency-security.md	Documents credential containment, credential rotation, Git history rewriting, post-purge verification, and communication steps, then links this procedure from dependency security guidance.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested labels: area: security

Suggested reviewers: copilot

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/issue-60-rotate-and-purge-secrets

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR strengthens PayBridge’s security posture by documenting incident response for credential exposure and connecting that guidance to the existing dependency-security documentation, aligning with Issue #60’s prevention + response requirements.

Changes:

• Add a credential rotation + git history purge runbook for incident response.
• Link the new runbook from the dependency security documentation to make response steps discoverable.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
docs/dependency-security.md	Links readers to the credential exposure incident-response runbook from existing security documentation.
docs/credential-rotation-and-history-purge.md	Introduces a step-by-step runbook for rotating exposed credentials and rewriting git history, plus verification and communication steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.