#!/bin/bash
# Fails if tracked files contain FinData keys, bearer tokens, vendor user ids or real-data parquet files.
set -euo pipefail
cd "$(dirname "$0")/.."
bad=0
if git ls-files -z | xargs -0 grep -nE "fd_[A-Za-z0-9]{6,}\.[A-Za-z0-9_-]{10,}|userid=[A-Za-z0-9]{8,}|Bearer [A-Za-z0-9._-]{20,}" 2>/dev/null; then bad=1; fi
if git ls-files | grep -E "\.(parquet|arrow)$" | grep -vE "^datasets/(fixtures|synthetic)/"; then bad=1; fi
if git ls-files | grep -E "api-key|\.env$"; then bad=1; fi
[ $bad -eq 0 ] && echo "no secrets or vendor data tracked" || { echo "SECRET/DATA CHECK FAILED"; exit 1; }