RUMMAGE → INSPECT → SANITIZE → PURGE → VERIFY
    ↓         ↓          ↓         ↓         ↓
Search   Examine   Cleanse   Remove   Confirm
Everything  Closely   Contaminated Dead     Clean

undefined

**Common Hiding Spots:**
- `.env` files (should be in `.gitignore`)
- `config.json` with hardcoded values
- Test fixtures with real credentials
- Documentation examples that look too real
- Commented-out code containing keys
- Git history (check `git log -p` for deleted secrets)

**Bare Error Detection (Signpost Compliance):**

Grove requires all errors to use Signpost codes. Search for violations:

```bash

**Signpost Compliance Checklist:**
- [ ] No bare `throw error()` — use `throwGroveError()` or `buildErrorJson()`
- [ ] No `console.error` without `logGroveError()` companion
- [ ] No ad-hoc JSON error shapes — all use `buildErrorJson()`
- [ ] No `alert()` — use `toast` from `@autumnsgrove/groveengine/ui`
- [ ] `adminMessage` never exposed to client responses

**Dependency Check:**
```bash

**Output:** Inventory of potential secrets, vulnerabilities, and suspicious patterns found

---

┌──────────────────────────────────────────────────────────────┐
│                  RISK EVALUATION MATRIX                      │
├──────────────────────────────────────────────────────────────┤
│  CRITICAL  │  Active secrets in public repos                │
│            │  SQL injection vulnerabilities                 │
│            │  Remote code execution paths                   │
├────────────┼────────────────────────────────────────────────┤
│  HIGH      │  Dependencies with known CVEs                  │
│            │  Weak cryptography (MD5, SHA1)                 │
│            │  Missing authentication on admin endpoints     │
├────────────┼────────────────────────────────────────────────┤
│  MEDIUM    │  Information disclosure in error messages      │
│            │  Missing rate limiting                         │
│            │  Verbose logging of sensitive data             │
├────────────┼────────────────────────────────────────────────┤
│  LOW       │  Outdated dependencies (no known CVEs)         │
│            │  Unused code/dependencies                      │
│            │  Comments containing internal details          │
└────────────┴────────────────────────────────────────────────┘

undefined

**Code Sanitization:**
```typescript
// BEFORE: Secret in code
const API_KEY = 'sk-live-abc123xyz789';

// AFTER: Environment variable
const API_KEY = process.env.SERVICE_API_KEY;
if (!API_KEY) {
  throw new Error('SERVICE_API_KEY environment variable required');
}

// Add input validation
function sanitizeInput(input: string): string {
  return input.replace(/[<>\"']/g, '');
}

// Add rate limiting
const rateLimiter = new Map<string, number[]>();

// Remove debug endpoints
// DELETE: app.get('/debug/users', ...)

undefined

**Output:** Clean code with secrets externalized, vulnerabilities patched

---

undefined

**Dead Code Removal:**
```bash

**Environment Cleanup:**
- Remove old API keys from services
- Delete test accounts created with real credentials
- Clear CI/CD cache if it contains secrets
- Rotate database credentials if exposed

**Documentation Updates:**
- Remove internal URLs from public docs
- Scrub employee names/IDs from examples
- Update architecture diagrams (remove sensitive details)

**Output:** Clean repository, fresh credentials, purged history

---

undefined

**Manual Checks:**
- [ ] Application starts without hardcoded secrets
- [ ] All environment variables documented (not their values!)
- [ ] Test suite passes
- [ ] No sensitive data in logs
- [ ] Error messages don't reveal internals

**Preventive Measures:**
```bash

**Verification Report:**
```markdown

**Output:** Clean bill of health with preventive measures in place

---