SAMPLE EVIDENCE for SK-02 (made-up app Tidyhaus; not a real review)

gitleaks detect --log-opts="--all": 1 finding, commit 3f2a91 (2026-09-14), an old Stripe test key sk_test_[redacted].
.gitignore includes .env and .env.*