A Gitea PAT was pasted into a CD-watching curl command in a 2026-04-22
planning doc (c9310b10, last_eight 3105a670).
Verified dead before dispositioning it, rather than assuming: authenticating
GET /api/v1/user with that exact value returns 401. It was almost certainly
invalidated by the early-August rotation of the `mathias` PATs -- the same
rotation whose fan-out caused infra#260, where CI's stale copies kept
failing. So it was killed for unrelated reasons, by luck rather than by the
leak being noticed.
No rotation outstanding. `task security:gitleaks:history` now exits 0 here.
Used .gitleaksignore (per-finding fingerprint) rather than a path allowlist
in .gitleaks.toml: a path allowlist would also blind the working-tree scan
that gates commits. Verified both directions -- history 1 -> 0, working tree
still clean.
