chore(security): fail closed booking development configuration

scripts/verify-no-secrets.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Lightweight fail-closed scan for the checked-out source tree. Historical Git
+# secrets are deliberately not rewritten here; this gate prevents new obvious
+# plaintext credentials from entering the current product tree.
+set -euo pipefail
+
+if ! command -v rg >/dev/null 2>&1; then
+  echo 'rg is required for the repository secret scan.' >&2
+  exit 69
+fi
+
+# Only configuration and executable wiring can introduce a usable credential.
+# Application code contains benign variables such as `rawPassword`; scanning it
+# creates noise and makes a security gate easy to ignore.
+scan_args=(--hidden --pcre2 --glob '!.git/**' --glob '!client/node_modules/**' --glob '!server/target/**' --glob '!client/dist/**' --glob '*.yml' --glob '*.yaml' --glob '*.properties' --glob '.env' --glob '.env.*' --glob '*.sh')
+
+# Ignore environment placeholders and explicitly fake examples. Reject literal
+# values of at least 12 characters, which includes all deployable credentials.
+credential_pattern='(?i)(?<![A-Za-z0-9_])(password|passwd|secret|api[_-]?key|access[_-]?key)[[:space:]]*[:=][[:space:]]*["\x27]?(?!\$\{|<|your-|[A-Za-z0-9._-]*xxx)[A-Za-z0-9][A-Za-z0-9_+/.=-]{11,}'
+credential_matches="$(rg -n -I "${scan_args[@]}" "${credential_pattern}" . || true)"
+if [[ -n "${credential_matches}" ]]; then
+  echo 'Potential plaintext credential(s) detected outside tests:' >&2
+  printf '%s\n' "${credential_matches}" >&2
+  exit 73
+fi
+
+jdbc_userinfo_matches="$(rg -n -I "${scan_args[@]}" 'jdbc:(mysql|postgresql):[^[:space:]]*//[^[:space:]@/]+:[^[:space:]@/]+@' . || true)"
+if [[ -n "${jdbc_userinfo_matches}" ]]; then
+  echo 'JDBC URL with embedded user information detected:' >&2
+  printf '%s\n' "${jdbc_userinfo_matches}" >&2
+  exit 74
+fi
+
+for config_file in server/src/main/resources/application-dev.yml server/src/main/resources/application-prod.yml; do
+  if [[ ! -f "${config_file}" ]]; then
+    continue
+  fi
+  if rg --pcre2 -n '^\s*(url|username|password):\s*(?!\$\{)[^#\s].*$' "${config_file}" >/dev/null; then
+    echo "${config_file} contains a non-environment datasource value." >&2
+    exit 75
+  fi
+done
+
+echo 'Repository plaintext-secret scan passed.'