immune-check

A pre-flight reflex that scans any outbound artifact — a commit, a publish, a release, a message, a payload to an external service — for foreign or dangerous material before it crosses the boundary out of the body. Catches secrets, keys, tokens, credentials, personal/medical data, private paths, and oversized vendored deps. Wraps whatever secret scanner you have (Argus, gitleaks, trufflehog, detect-secrets, git-secrets) and falls back to a built-in pattern pass. TRIGGERS: 'immune check', 'scan before publish', 'is this safe to push', 'check this before it goes out', 'pre-flight scan', 'about to make this public', 'leak check', 'scan the diff'. Run before anything leaves the body: publishing a repo, pushing a commit, cutting a release, sending an artifact outward.