ci(6dq): add G2 security scanning

[nocoo]

6DQ G2 Security Scanning Compliance

Adds G2 (security scanning) to meet 6DQ quality standard:

Changes

• .gitleaks.toml — Secret detection configuration with test file allowlist
• osv-scanner.toml — Dependency vulnerability scanner configuration
• Pre-commit hook — Added gitleaks protect --staged (G2a) + typecheck if missing
• Pre-push hook — Added osv-scanner scan (G2b)

6DQ Standard Reference

• G2a (Secrets): gitleaks in pre-commit — zero tolerance for leaked secrets
• G2b (Dependencies): osv-scanner in pre-push — scan lockfile for known CVEs
• Benchmark: Zhe project (Tier S standard)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
echo	Ready	Preview, Comment	Apr 20, 2026 6:34am