credential-discipline

name	credential-discipline
description	Example/seed/fixture files must use placeholders not real credentials. Pre-commit grep check + enforcement hooks.

Rule: examples, seeds, and test fixtures must use placeholders, not real values.

What counts as an example

Any file under: examples/, seed/, seed_data/, test_data/, fixtures/, mocks/ Or filename contains: example, seed, fixture, mock, or sample

Required placeholder scheme

Real	Placeholder
AIzaSy... (Firebase API key)	<your-firebase-api-key>
cntvDfj7cGUhUFkxcmV3 (campaign ID)	<your-campaign-id>
0wf6sCREyLcgynidU5LjyZEfm7D2 (Firebase UID)	<your-firebase-uid>
<[e-mail]> (test email)	<your-test-user>@example.com
worldarchitecture-ai (GCP project)	<your-firebase-project-id>
Any other identifier	<your-<descriptor>>

Before-commit checklist

grep -rnE 'AIza[A-Za-z0-9_-]{35}|cntvDfj7cGUhUFkxcmV3|L5iB5eWq8TyzQW3qFDDv|z7eDk3NzY1mB6BTm23yu|Z2sEA1hQW3YJbyQHvvt6|XHWCpllzfKNgwf6o1Jvc|zheWLda5wsDVQTdXrRFm|0wf6sCREyLcgynidU5LjyZEfm7D2|<[e-mail]>|worldarchitecture-ai|worldai-prod-c4977' examples/ 2>&1

Enforcement

• Pre-commit hook: ~/.claude/hooks/pre-commit-git-identity-example-com-guard.sh blocks commits by @example.com.
• Per-repo test: tests/test_example_placeholder_discipline.sh in CI for browserclaw and jleechanclaw.
• Per-repo hook: .githooks/pre-commit chains identity guard + discipline test on staged examples/**.

Why

3 real production credential leaks landed in public repos between 2026-02 and 2026-04 (commits 3aac8fe8, 45836c8). .gitleaksignore is suppression, not a fix — rotate keys + rewrite history.

If example needs real credential: move to private repo, parameterize via env var, or use Firebase Emulator.