Goal

Configure SSH commit signing, wire gitleaks into a pre-commit hook to block accidental secret commits.

Changes

• .pre-commit-config.yaml — gitleaks v8.27.2 + detect-private-key + check-added-large-files hooks
• submissions/lab3.md — signing config, verified badge, blocked commit evidence, tune-out tradeoffs

Testing

• git log --show-signature -1 shows Good "git" signature for idiarephilip@gmail.com
• Commit 95d7d57 shows green Verified badge on GitHub
• gitleaks blocked submissions/leak-attempt.txt with RuleID github-pat
• Fake secret cleaned up — not committed to repo

Artifacts & Screenshots

• submissions/lab3.md — full lab write-up
• Verified badge visible at: https://github.com/Philip-78/DevSecOps-Intro/commits/feature/lab3

• Task 1 — SSH signing configured + Verified badge on commit
• Task 2 — .pre-commit-config.yaml + gitleaks demonstrably blocking
• Bonus — filter-repo rewrite practice documented