feat(v2): add secure control plane

tools/forbidden_v1_scan.py

@@ -42,7 +42,7 @@ FORBIDDEN = (
         r"\b(?:read|open|load|import|convert)[_-]?(?:legacy|v1)[_-]?(?:database|db|payload|backup)\b",
         re.IGNORECASE,
     ),
-    re.compile(r"\bbackup_tool\.(?:db|sqlite3?)\b", re.IGNORECASE),
+    re.compile(r"[\"']backup_tool\.db[\"']", re.IGNORECASE),
     re.compile(r"%Y-%m-%d_%H%M%S"),
     re.compile(r"\btimestamp[_-]?(?:directory|parser)\b", re.IGNORECASE),
     re.compile(r"\b(?:app\.main|backup\.engine)\b"),

tools/leakage_scan.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Fail when a secret canary appears in output files."
+    )
+    parser.add_argument("--canary", action="append", default=[])
+    parser.add_argument("paths", nargs="+")
+    args = parser.parse_args()
+    findings: list[str] = []
+    for raw_path in args.paths:
+        path = Path(raw_path)
+        if not path.is_file():
+            continue
+        text = path.read_text(encoding="utf-8", errors="replace")
+        if any(canary and canary in text for canary in args.canary):
+            findings.append(str(path))
+    if findings:
+        print("secret canary found: " + ", ".join(findings))
+        return 1
+    print("leakage scan: OK")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())