# Secret Scanning Configuration

Secret scanning is configured at the repository level in GitHub settings,
not via configuration files.

## Manual Setup Steps

Go to repo Settings > Code security and analysis:

1. **Secret scanning**: Enable
2. **Push protection**: Enable (blocks commits containing secrets)
3. **Dependabot alerts**: Enable
4. **Dependabot security updates**: Enable

## What Gets Scanned

GitHub automatically scans for:
- API keys (AWS, Azure, GCP, Stripe, etc.)
- OAuth tokens
- Private keys
- Database connection strings
- Cloud provider credentials

Push protection blocks commits containing detected secrets
before they reach the repository.
