feat: complete verified action plan hardening

.github/secret_scanning.yml

@@ -1,5 +1,6 @@
 paths-ignore:
   - "internal/detector/**/*_test.go"
+  - "internal/detector/generic/testdata/appsettings.synthetic.json"
   - "internal/verifier/**/*_test.go"
   - "internal/engine/**/*_test.go"
   - "internal/source/**/*_test.go"

.github/workflows/ci.yml

@@ -110,12 +110,23 @@ jobs:
           go-version: '1.25.12'
           cache: true
           cache-dependency-path: tools/site-build/go.sum
-      - name: Regenerate site/js from tools/site-build
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+      - name: Test site generator and browser detector contracts
+        working-directory: tools/site-build
+        run: go test -count=1 ./...
+      - name: Regenerate site output from tools/site-build
         working-directory: tools/site-build
         run: go run . -strict
-      - name: Fail if the committed site/js has drifted from the generator
+      - name: Fail if the committed site has drifted from the generator
         run: |
-          if ! git diff --exit-code -- site/js; then
-            echo "::error::site/js is stale. Run 'cd tools/site-build && go run . -strict' from the repo root and commit the regenerated files under site/js/."
+          if ! git diff --exit-code -- site; then
+            echo "::error::site output is stale. Run 'cd tools/site-build && go run . -strict' from the repo root and commit the regenerated files under site/."
+            exit 1
+          fi
+          if test -n "$(git status --porcelain --untracked-files=all -- site)"; then
+            echo "::error::site generator created untracked output. Regenerate and commit every generated file under site/."
+            git status --short --untracked-files=all -- site
             exit 1
           fi

.github/workflows/provider-contract-audit.yml

@@ -0,0 +1,43 @@
+name: Provider Contract Audit Freshness
+
+on:
+  schedule:
+    - cron: '17 6 * * 1'
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - 'internal/meta/capabilities.go'
+      - 'internal/meta/capabilities_test.go'
+      - 'internal/meta/provider_contract_links_test.go'
+      - 'docs/standards/05-PROVIDER-CONTRACT-AUDITS.md'
+      - '.github/workflows/provider-contract-audit.yml'
+  pull_request:
+    paths:
+      - 'internal/meta/capabilities.go'
+      - 'internal/meta/capabilities_test.go'
+      - 'internal/meta/provider_contract_links_test.go'
+      - 'docs/standards/05-PROVIDER-CONTRACT-AUDITS.md'
+      - '.github/workflows/provider-contract-audit.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  freshness:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version: '1.25.12'
+          cache: true
+      - name: Enforce reviewed provider-contract freshness
+        run: go test ./internal/meta -run '^TestVerificationCapabilities_ReviewedContractsAreFresh$' -count=1
+      - name: Verify official provider references and anchors
+        env:
+          LEAKWATCH_CHECK_PROVIDER_LINKS: '1'
+        run: go test ./internal/meta -run '^TestVerificationCapabilities_ReviewedReferenceLinksResolve$' -count=1 -timeout=8m

.github/workflows/release.yml

@@ -29,6 +29,19 @@ jobs:
       - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00
         with:
           go-version: '1.25.12'
+      - name: Validate release tag, metadata, and generated site
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          go run ./internal/meta/releasecheck --tag "$RELEASE_TAG"
+          go test ./internal/meta ./cmd
+          (
+            cd tools/site-build
+            go run . -strict
+          )
+          git diff --exit-code -- site
+          test -z "$(git status --porcelain --untracked-files=all -- site)"
       # docker/setup-qemu-action@v3.2.0
       - name: Set up QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf

.github/workflows/site-deploy.yml

@@ -6,6 +6,7 @@ on:
     paths:
       - "site/**"
       - "docs/user-manuals/**"
+      - "internal/meta/release.go"
       - "tools/site-build/**"
       - ".github/workflows/site-deploy.yml"
   workflow_dispatch:

.github/workflows/vscode-ci.yml

@@ -53,3 +53,14 @@ jobs:
 
       - name: Test
         run: npm test
+
+      - name: Package VSIX
+        run: npm run package:vsix
+
+      - name: Upload VSIX
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: leakwatch-vsix
+          path: vscode/leakwatch-*.vsix
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/vscode-release.yml

@@ -0,0 +1,122 @@
+name: Publish VS Code Extension
+
+on:
+  workflow_dispatch:
+    inputs:
+      publish:
+        description: Publish the packaged VSIX to Visual Studio Marketplace
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: vscode-marketplace-publish
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: vscode
+
+jobs:
+  package:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: vscode/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint, test, and package
+        run: npm run lint && npm test && npm run package:vsix
+
+      - name: Upload reviewable VSIX
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: leakwatch-vsix
+          path: vscode/leakwatch-*.vsix
+          if-no-files-found: error
+          retention-days: 14
+
+  publish:
+    if: ${{ inputs.publish && github.ref == 'refs/heads/main' }}
+    needs: package
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment: vscode-marketplace
+    permissions:
+      actions: read
+      contents: read
+      deployments: read
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        with:
+          persist-credentials: false
+
+      - name: Fail closed unless Marketplace environment policy is protected
+        env:
+          GH_API_TOKEN: ${{ github.token }}
+          GH_ENVIRONMENT_AUDIT_TOKEN: ${{ secrets.VSCODE_ENV_AUDIT_TOKEN }}
+        run: |
+          policy_file="${RUNNER_TEMP:?}/vscode-marketplace-environment.json"
+          curl --fail-with-body --silent --show-error \
+            --header "Accept: application/vnd.github+json" \
+            --header @<(printf 'Authorization: Bearer %s\n' "${GH_API_TOKEN:?}") \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            "${GITHUB_API_URL:?}/repos/${GITHUB_REPOSITORY:?}/environments/vscode-marketplace" \
+            --output "$policy_file"
+          jq --exit-status '
+            ([.protection_rules[]?
+              | select(.type == "required_reviewers" and .prevent_self_review == true)
+              | .reviewers[]?] | length) >= 1
+            and .deployment_branch_policy.protected_branches == true
+          ' "$policy_file" >/dev/null
+
+          secret_metadata_file="${RUNNER_TEMP:?}/vscode-marketplace-vsce-pat.json"
+          curl --fail-with-body --silent --show-error \
+            --header "Accept: application/vnd.github+json" \
+            --header @<(printf 'Authorization: Bearer %s\n' "${GH_ENVIRONMENT_AUDIT_TOKEN:?}") \
+            --header "X-GitHub-Api-Version: 2022-11-28" \
+            "${GITHUB_API_URL:?}/repos/${GITHUB_REPOSITORY:?}/environments/vscode-marketplace/secrets/VSCE_PAT" \
+            --output "$secret_metadata_file"
+          jq --exit-status '.name == "VSCE_PAT"' "$secret_metadata_file" >/dev/null
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: vscode/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Download reviewed VSIX
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: leakwatch-vsix
+          path: vscode/artifact
+
+      - name: Publish reviewed VSIX
+        env:
+          VSCE_PAT: ${{ secrets.VSCE_PAT }}
+        run: |
+          : "${VSCE_PAT:?missing environment-scoped VSCE_PAT}"
+          mapfile -t packages < <(find artifact -type f -name 'leakwatch-*.vsix' -print)
+          if [[ ${#packages[@]} -ne 1 ]]; then
+            echo "expected exactly one VSIX artifact" >&2
+            exit 1
+          fi
+          npx --no-install vsce publish --packagePath "${packages[0]}"

.gitignore

@@ -20,6 +20,7 @@ vendor/
 # IDE
 .idea/
 .vscode/
+.claude/
 *.swp
 *.swo
 *~
@@ -30,6 +31,7 @@ Thumbs.db
 
 # Code Reviews
 docs/code-reviews/
+review/
 
 # Marketing (internal, not published)
 docs/marketing/

.leakwatchignore

@@ -2,6 +2,10 @@
 # These are NOT real secrets — they are fixtures that match regex patterns.
 **/*_test.go
 
+# This fixture contains deterministic, synthetic, intentionally matchable
+# credentials. Keep the exemption exact so future testdata remains scanned.
+internal/detector/generic/testdata/appsettings.synthetic.json
+
 # Verifier implementations contain API URL patterns that may match detectors.
 internal/verifier/**
 

CHANGELOG.md

@@ -7,11 +7,49 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
-_Nothing yet._
+## [v1.8.0] - 2026-08-11
+
+### Added
+
+- A default-on `structured-config-secret` detector for JSON, YAML, TOML, INI,
+  dotenv, and XML configuration values, bringing the catalog to **65
+  detectors**. It can be disabled explicitly with
+  `--exclude-detectors structured-config-secret`.
+- Repeatable `--verifier-origin detector-id=https://host` routing for
+  operator-trusted verifier targets, plus the backward-compatible
+  `--grafana-instance-url` alias.
+- Opt-in Slack text-attachment scanning with Slack-owned HTTPS enforcement,
+  operation-scoped request limiting, byte-bounded backpressure, bounded file
+  size/retries, UTF-8 text classification, token-safe errors/logs, and file-ID
+  de-duplication.
+- Best-effort GitHub scope/expiration and GitLab PAT standard or GitLab 19.2+ granular scope/expiration metadata
+  after authoritative active verification.
+- A reviewable VSIX artifact, 256×256 Marketplace icon, main-only manual VS Code
+  publication workflow with executable environment-policy and environment-secret
+  provenance audits, and a scheduled provider-contract freshness/link gate.
+
+### Changed
+
+- Auth0, Datadog, GitHub, GitHub OAuth, GitLab, Grafana, Shopify, Snyk, and
+  Twilio verification now requires an explicit operator-trusted origin. Without
+  one, Leakwatch sends no credential and reports the finding as `unverified`.
+- Slack's `--rate-limit` default changed from `1` to `0`; zero preserves the
+  provider-safe, operation-specific limits instead of imposing one global
+  request rate on every Slack method.
+- Source cleanup or partial-scan failures are now visible and non-clean. A
+  cleanup failure without findings exits `2`; partial results still exit `1`
+  while retaining and reporting the source error.
+- Finding JSON now distinguishes calculated zero entropy from absent entropy and
+  omits an unset detection timestamp; terminal tables use Unicode display width,
+  visibly escape bidi controls, and render `--show-raw` as a reversible quoted
+  value instead of passing terminal controls through or dropping secret bytes.
+- Detector/verifier registries fail closed on invalid or duplicate registration,
+  matcher results are explicitly stable, and obsolete global custom-rule APIs
+  were removed.
 
 ---
 
-## [v1.7.0] - 2026-07-19
+## [v1.7.0] - 2026-07-20
 
 > A comprehensive, multi-dimensional review of the entire project (code, tests, docs, CI/CD, VS Code extension, and website) was completed and its findings remediated across the changes below.
 

CLAUDE.md

@@ -66,11 +66,12 @@ Architecture decisions are documented in ADR format under `docs/decisions/`. The
 | [ADR-0002](docs/decisions/ADR-0002-cli-frame.md) | Cobra + Viper | Nested commands, hierarchical configuration |
 | [ADR-0003](docs/decisions/ADR-0003-git-library.md) | go-git | Pure Go, no CGO, no external dependencies |
 | [ADR-0004](docs/decisions/ADR-0004-plugin-architecture.md) | Compile-time registration | init() + blank import, type-safe |
-| [ADR-0005](docs/decisions/ADR-0005-pattern-matching.md) | Aho-Corasick hybrid | AC pre-filter → regex validation → entropy |
+| [ADR-0005](docs/decisions/ADR-0005-pattern-matching.md) | Aho-Corasick hybrid | Entropy clause amended; AC pre-filter → regex validation remains active |
 | [ADR-0006](docs/decisions/ADR-0006-container-library.md) | go-containerregistry | Daemonless, layer-based analysis |
 | [ADR-0007](docs/decisions/ADR-0007-license.md) | MIT | Enterprise adoption, open-core compatibility |
 | [ADR-0008](docs/decisions/ADR-0008-concurrency-model.md) | Worker Pool | Fixed worker count, channel-based |
 | [ADR-0009](docs/decisions/ADR-0009-github-marketplace-action.md) | Marketplace Action | Root `action.yml`, prebuilt-binary composite, `@v1` |
+| [ADR-0010](docs/decisions/ADR-0010-entropy-gating-policy.md) | Entropy gating | Threshold gates opt-in heuristic findings only |
 
 ## Coding Standards
 
@@ -124,6 +125,11 @@ Full standards: [docs/standards/04-DEVELOPMENT-STANDARDS.md](docs/standards/04-D
 Types: feat, fix, docs, test, refactor, perf, ci, chore
 ```
 
+Before every commit, review the documentation surfaces affected by the change
+(including README, changelog, roadmap, guides, user manuals, and generated site
+artifacts). A commit must not knowingly leave product behavior, counts, versions,
+or capability claims stale.
+
 **Examples:**
 ```
 feat(detector): add AWS Secret Access Key detector