Blocks commits containing known secret patterns (e.g. Stripe sk_test_*) before they reach the remote. Exits gracefully with a warning when gitleaks is not in $PATH so developers who haven't installed it are not blocked. .gitleaks.toml extends the upstream default ruleset and allowlists __seeds__/** to prevent false positives from test fixtures. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>