.secrets.baseline contains 21 entries across 5 files, every one with is_secret: null — meaning nobody has triaged whether any of them is a real secret. The baseline was generated 2026-05-22 and has not been audited since.
Compounding it: detect-secrets runs only via pre-commit, which is installed locally (Makefile:25-30) but never enforced in CI. So the hook is advisory — a contributor who skips it, or who has not run make install, gets no gate at all.
Why it matters for a 1.0
A baseline of unaudited entries is indistinguishable from a baseline of accepted false positives. If a real credential were among them it would be silently allowlisted, and the tool would keep reporting clean.
Suggested actions
- Audit the 21 entries (
detect-secrets audit .secrets.baseline) so each is explicitly marked true/false. This is the substantive half.
- Add a pre-commit run to CI so the hook is actually a gate.
pre-commit/action or a plain uv run pre-commit run --all-files step.
- Consider whether the baseline should be regenerated after the audit.
Note
pip-audit is separately clean and is wired into make check via the security target — this issue is specifically about the secrets hook, not dependency CVEs.
.secrets.baselinecontains 21 entries across 5 files, every one withis_secret: null— meaning nobody has triaged whether any of them is a real secret. The baseline was generated 2026-05-22 and has not been audited since.Compounding it:
detect-secretsruns only via pre-commit, which is installed locally (Makefile:25-30) but never enforced in CI. So the hook is advisory — a contributor who skips it, or who has not runmake install, gets no gate at all.Why it matters for a 1.0
A baseline of unaudited entries is indistinguishable from a baseline of accepted false positives. If a real credential were among them it would be silently allowlisted, and the tool would keep reporting clean.
Suggested actions
detect-secrets audit .secrets.baseline) so each is explicitly marked true/false. This is the substantive half.pre-commit/actionor a plainuv run pre-commit run --all-filesstep.Note
pip-auditis separately clean and is wired intomake checkvia thesecuritytarget — this issue is specifically about the secrets hook, not dependency CVEs.