# Leak Audit

Leak Audit is a zero-dependency, offline source-tree scanner for common exposed
credentials. It emits a Markdown report, redacts matches, skips binary and
common generated/vendor trees, and can fail CI when findings exist.

```sh
./leak-audit.py /path/to/repository -o report.md --fail-on-findings
```

Exit status is 2 when `--fail-on-findings` is set and matches are found, 0
otherwise. Results are heuristic and require human confirmation. A confirmed
credential must be revoked or rotated even if it is removed from source.

Only scan repositories you own or are explicitly authorized to assess.
