prepublish-privacy-scrub

# Pre-Publish Privacy Scrub

Scan for sensitive data before publishing.

## Problem

Publishing accidentally exposes:
- API keys and tokens
- Gateway credentials
- Personal paths and emails
- Internal service URLs

## Workflow

### 1. Sensitive Pattern Detection

```powershell
function Test-PrivacyScan {
    param([string]$path)
    
    $sensitivePatterns = @(
        'apiKey\s*[=:]\s*["\']?[A-Za-z0-9]',
        'token\s*[=:]\s*["\']?[A-Za-z0-9]{10,}',
        'secret\s*[=:]\s*["\']?[A-Za-z0-9]',
        'password\s*[=:]\s*["\']?.+',
        'Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+',
        'sk-[A-Za-z0-9]{32,}',
        'OPENCLAW_\w+\s*[=:]\s*\S+',
        'https://\S+\.ngrok\S+',
        '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'
    )
    
    $files = Get-ChildItem $path -Recurse -File | 
        Where-Object { $_.Extension -in @('.md', '.ps1', '.json', '.txt') }
    
    $findings = @()
    
    foreach ($file in $files) {
        $content = Get-Content $file.FullName -Raw
        foreach ($pattern in $sensitivePatterns) {
            $matches = [regex]::Matches($content, $pattern, 'IgnoreCase')
            foreach ($m in $matches) {
                $findings += @{
                    File = $file.FullName
                    Pattern = $pattern
                    Match = $m.Value.Substring(0, [Math]::Min(20, $m.Value.Length)) + "..."
                }
            }
        }
    }
    
    return $findings
}
```

### 2. Scrubbing

```powershell
function Invoke-PrivacyScrub {
    param([string]$path)
    
    $replacements = @{
        'apiKey\s*[=:]\s*["\']?[^"''\s]+' = 'apiKey: "REDACTED"'
        'token\s*[=:]\s*["\']?[^"''\s]+' = 'token: "REDACTED"'
        'secret\s*[=:]\s*["\']?[^"''\s]+' = 'secret: "REDACTED"'
    }
    
    $files = Get-ChildItem $path -Recurse -File
    
    foreach ($file in $files) {
        $content = Get-Content $file.FullName -Raw
        $modified = $false
        
        foreach ($kv in $replacements.GetEnumerator())...