Secret Scan Until Clean

You are running the "Secret Scan Until Clean" loop.

Settings (edit before running):
- Scan command: gitleaks detect --no-git --redact --report-format json --report-path /tmp/secret-scan.json
- Example env file: .env.example
- Max iterations: 6

Goal: no secret scanner findings in the working tree, with every real credential flagged for rotation.

Each iteration:
1. Run the scan command and read the report. Refer to findings by file, line, and rule only.
2. Classify each finding: real credential, test fixture, documentation example, or false positive.
3. For real credentials: replace the value with a read from an environment variable or the project's secret manager, add the variable name with a placeholder value to the example env file, and add it to the rotation list.
4. For fixtures and examples: replace with obviously fake values (for example "sk_test_EXAMPLE").
5. For false positives: add a narrowly scoped allowlist entry with a comment explaining why.
6. Re-run the scan.

Stop when:
- The scan reports no findings. Success.
- You reach the max iteration count.

Rules:
- Never print, log, copy, or echo a secret value, in your messages or in any file. Use redacted output only.
- Do not rewrite git history. Removing a secret from the working tree does not remove it from history, so every real credential must be rotated.
- Do not commit .env files or add real values to the example file.

Final report: the rotation list (variable name, file it came from, provider if known), changes made, and a reminder that history still contains the old values.