{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=lgoyal6/tracked-leaks@0.3.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"Finds the files git is TRACKING that should never have been committed, and the gap between what a repo's .gitignore claims to exclude and what its index actually holds. Adding a pattern to .gitignore does nothing for a file that is already tracked, which is exactly why the same leak keeps coming back, so every finding is checked with \u0060git check-ignore --no-index\u0060 and then dated and tested for reachability from a remote-tracking ref, because a pushed secret is a rotation job and an unpushed one is a rebase. Precision is the point: \u0060.env.example\u0060, \u0060.env.sample\u0060 and \u0060.env.local.example\u0060 are meant to be committed and are never flagged, a \u0060!\u0060-negated ignore rule is read as the repo re-including a file rather than as a gap, a credential-shaped file under a test fixture path is reported apart from one at the repo root, and a \u0060.pem\u0060 with no PRIVATE KEY header or a \u0060.npmrc\u0060 with no auth token is cleared by inspection instead of raised. Read-only, needs no credentials, and never prints the contents of any file it finds","distribution":{"digest":"sha256:7c59505c52ae4d5367ef41334e9a0c58ea77a6075b1e764034044cb44f42b62e","mediaType":"application/vnd.modiqo.rote-flow","size":19497,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0.json"},"name":"tracked-leaks","owner":{"kind":"user","slug":"lgoyal6"},"parameters":[{"description":"Path to the git repository to audit; a subdirectory resolves to its top level","example":".","input":{"allowCustom":true,"choices":[],"label":"Repo"},"name":"repo","required":true,"type":"string"},{"default":"origin","description":"Which remote decides whether a finding has already left this machine","example":"origin","input":{"allowCustom":true,"choices":[],"label":"Remote"},"name":"remote","required":false,"type":"string"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/lgoyal6/tracked-leaks@0.3.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.78.0"},"publishedAt":"2026-09-02T19:43:44.474146+00:00","reference":"lgoyal6/tracked-leaks@0.3.0","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":2,"names":["forensics","inventory"]},"title":"tracked-leaks","type":"play","version":"0.3.0","visibility":"public"}