docs: add before-push security checklist to CONTRIBUTING.md (Closes #50)

[laurentketterle-hub]

Summary

Closes #50

Adds a concrete, copy-paste friendly Before Push Security Checklist to CONTRIBUTING.md with:

• git status — verify the right branch
• git diff --staged — review staged changes
• grep scan — detect common credential patterns (API keys, tokens, secrets, private keys)
• Link to SECURITY.md for full security policy and reporting process

Files Changed

• CONTRIBUTING.md — Enhanced "Security Hygiene" section with actionable checklist

Verification

• Checklist is short, practical, and copy-paste friendly
• Security guidance consistent with existing SECURITY.md policy

Summary by CodeRabbit

• Documentation
  • Expanded security guidance with a pre-push checklist.
  • Added steps for reviewing changes, scanning for exposed credentials, and verifying branches.
  • Documented procedures for removing and rotating compromised secrets.
  • Linked to the full security policy.

[coderabbitai]

📝 Walkthrough

Walkthrough

CONTRIBUTING.md now provides a pre-push security checklist. It covers branch verification, staged-diff review, credential scanning, exposed-secret removal and rotation, and the SECURITY.md policy.

Changes

Security guidance

Layer / File(s)	Summary
Pre-push security checklist CONTRIBUTING.md	Adds checks for the current branch, staged changes, credential patterns, and exposed-secret handling. Links to SECURITY.md.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: adewolescott, chubbymmoh, flamki, thebigwealth89

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the documentation change and the added before-push security checklist.
Description check	✅ Passed	The description explains the change, affected file, purpose, and verification, although it does not use all template headings.
Linked Issues check	✅ Passed	The changes satisfy issue #50 by adding the requested commands, secret-scan guidance, SECURITY.md link, and practical checklist.
Out of Scope Changes check	✅ Passed	The changes are limited to the requested security guidance update in CONTRIBUTING.md.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CONTRIBUTING.md`:
- Around line 71-76: Update the credential-checking instructions in the staged
push workflow to state that the generic grep is insufficient. Require scanning
staged paths and content with policy-specific patterns or a dedicated secret
scanner, manually reviewing git diff --staged before git push, and preserving
.env.example as the documented placeholder exception.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f67e43a3-df32-413e-8ded-281d58a48e4c

📥 Commits

Reviewing files that changed from the base of the PR and between 6eb1d2b and c19d74b.

📒 Files selected for processing (1)

• CONTRIBUTING.md

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Do not treat this grep as a complete secret scan.

The command only searches for generic words such as secret, token, and password. It misses the policy-defined S... private keys, sk-ant-... API keys, .env files, and generated wallet secrets when their contents do not contain those words. A clean result therefore does not justify the next git push command.

Scan staged paths and content with policy-specific patterns, or use a dedicated secret scanner. Require manual review of git diff --staged before pushing, and preserve .env.example as the documented placeholder exception.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CONTRIBUTING.md` around lines 71 - 76, Update the credential-checking
instructions in the staged push workflow to state that the generic grep is
insufficient. Require scanning staged paths and content with policy-specific
patterns or a dedicated secret scanner, manually reviewing git diff --staged
before git push, and preserving .env.example as the documented placeholder
exception.