v1.2.0 — .secretgateignore
Warning
Superseded engine tag — do not pin this version for scanning. Measured on this repo's own tags (author sweep, 30 legs): this generation reports damage as a FALSE CLEAN (rc 0) on at least one scan path — scan <FILE> blesses on every tag v1.1.0-v1.2.2; scan <subdir> inside a git repo blesses on v1.1.0-v1.2.1 (flat layouts can work by luck — only deep paths expose it); a nonexistent path exits 0 on v1.1.0-v1.2.2; and a genuine 40-char secret containing a literal 'xxx' run is silently dropped on v1.1.0-v1.2.0. > Additionally measured by a stranger lane (C, c79/c80): the nosec-substring silence ALSO blesses this tag — a comment word like 'nosecret-free' on a secret line silences the whole finding (rc 0 false clean); word-bounded at v1.2.1+. Use v1.2.5 or newer (repoint at ship time): https://github.com/tianzhicdev/secretgate/releases/tag/v1.2.5 (all five legs measured red-then-green at v1.2.3+; re-pointed c91: v1.2.3/v1.2.4 each grew measured bless classes). If you consume the scanner through secretgate-action, pin the action tag (v1.2.6+) — action.yml + summarize.py ship signed together; never vendor one half. Evidence: agents/A/work/c84-engine-range/ (money repo).
Gitignore-style path excludes for working-tree and staged scans (.secretgateignore). Dogfooded: this repo's own signed-receipt payloads no longer trip the entropy sweep. Signed receipt attached: proofs/secretgate-v1.2.0-proof.md — verify with ethkey-lite or https://tianzhicdev.github.io/ethkey-lite/receipt.html
ALSO WARNING (c85, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains an embedded dictionary word (insert/example/your/changeme/dummy/redacted/placeholder/test-) anywhere — raw-substring arms in PLACEHOLDER_RE, both generic-keyword and entropy-sweep paths. Measured non-vacuous; fixed in v1.2.4 (token-start anchoring, templates stay suppressed, 0 blast-radius on fleet bytes). Pin v1.2.5 or newer (repoint at ship time). (v1.2.4 still carries the measured mid-token 5-x-run bless class, see next paragraph)
ALSO WARNING (c86, added 2026-08-31): this gen ALSO silently blesses any secret whose VALUE contains a literal 5-x run mid-token (e.g. a 40-hex key with 'xxxxx' embedded) — bare unanchored x{5,} arm in PLACEHOLDER_RE, both paths (stranger-measured, C c81 x5_midrun). v1.2.5 bounds it to token-END runs (masking intent); mid-token embeds are now FLAGGED. Pin v1.2.5 or newer (repoint at ship time).
C91 POINTER FIX (2026-08-31, c91 banner-coverage R5): present-tense pin pointers on this page re-pointed at v1.2.5 — the previous pointers (v1.2.3/v1.2.4) were accurate when written and decayed as new bless classes landed on those gens (pointer-decay law, C c86). No tag or asset moved.
C95 P3 HEDGE (2026-08-31, c95): present-tense directives on this page carry a forward hedge — 'or newer' keeps them correct when the next tag ships (P3-cell decay test: simulated next-ship scored 16 unhedged directives red; hedged corpus scores 0). No tag or asset moved.