.gitleaks.toml

@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [

index.html

@@ -16,14 +16,16 @@
     <meta property="og:type" content="website" />
     <meta property="og:url" content="https://auto.levkin.ca/" />
     <meta property="og:site_name" content="AutoBank" />
-    <meta property="og:image" content="https://auto.levkin.ca/assets/logos/00-full-128.png" />
-    <meta name="twitter:card" content="summary" />
+    <meta property="og:image" content="https://auto.levkin.ca/og-image.png" />
+    <meta property="og:image:width" content="1200" />
+    <meta property="og:image:height" content="630" />
+    <meta name="twitter:card" content="summary_large_image" />
     <meta name="twitter:title" content="AutoBank — Stop doing by hand what a computer can do for you" />
     <meta
       name="twitter:description"
       content="Automation for small and medium businesses — invoicing, follow-ups, data entry, and reports, fixed and running on their own."
     />
-    <meta name="twitter:image" content="https://auto.levkin.ca/assets/logos/00-full-128.png" />
+    <meta name="twitter:image" content="https://auto.levkin.ca/og-image.png" />
     <link rel="canonical" href="https://auto.levkin.ca/" />
     <link
       rel="icon"