Four repos, fifteen historical secrets, zero live ones

Rolling Gitleaks across four repos surfaced 15 real historical findings — Flutterwave keys, Stripe keys, a GCP key. The discipline that mattered wasn't the scan; it was what came after:

1. Never bless blind. Every finding was checked against HEAD (`git grep` + file reads) before entering a baseline. Two repos were already clean at HEAD; placeholders, not keys.

2. The wrapper betrayed us twice. First it demanded a token on PR events; then it needed PR API access that restricted-permission repos don't grant. The fix: run the Gitleaks binary directly — no API, no token, no permissions coupling. Identical file on all four repos.

3. Baselines are promises. Each `.gitleaksbaseline` commit message states counts: 12 historical, 0 live at HEAD. A baseline you can't audit is just a suppressed alarm.

The fleet procedure is written up as a reusable runbook — same one I'd run on your repo. Start with the free check.