Audit handling of secrets, environment variables, and credentials — database URLs, JWT signing keys, API keys — across the backend config, .env files, and git history. Use when the user asks to check for leaked secrets, hardcoded credentials, "is anything sensitive committed to git," or before pushing to a public GitHub remote. Given this project uses a two-.env pattern (root .env for containerized backend, backend/.env for local hybrid), trigger this whenever either .env file or docker-compose config changes.
