1#!/bin/bash2# Fails if tracked files contain FinData keys, bearer tokens, vendor user ids or real-data parquet files.3set -euo pipefail4cd "$(dirname "$0")/.."5bad=06if git ls-files -z | xargs -0 grep -nE "fd_[A-Za-z0-9]{6,}\.[A-Za-z0-9_-]{10,}|userid=[A-Za-z0-9]{8,}|Bearer [A-Za-z0-9._-]{20,}" 2>/dev/null; then bad=1; fi7if git ls-files | grep -E "\.(parquet|arrow)$" | grep -vE "^datasets/(fixtures|synthetic)/"; then bad=1; fi8if git ls-files | grep -E "api-key|\.env$"; then bad=1; fi9[ $bad -eq 0 ] && echo "no secrets or vendor data tracked" || { echo "SECRET/DATA CHECK FAILED"; exit 1; }10