I Almost Published 3 Live API Keys to GitHub — An Auto-Commit Cross-Repo Disaster
On June 16, 2026 at 07:55 JST, while adding a 6/15 addendum to the UTF-8 disaster postmortem, GitHub's secret scanner blocked my push. Three live API keys (GitHub PAT + OpenRouter + Cloudflare) were about to be pushed to a public repo by an auto-commit script. Four independent defense layers all assumed 'someone else will catch this' — nobody did. Same pattern as the 6/10, 6/12, and 6/14 incidents.