Redacted excerpt; full evidence withheld.

$ pwd && rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'AGENTS.md' -g 'Makefile' | head -80 && sed -n '1,240p' README.md
exit: 0
 folders.

A project that commits an env file on purpose (Symfony's `.env`, Vite's `.env.production`, dotenvx) lists in `env-files` only those that hold its secrets, as in the example above.

## Requirements and security

- **git 2.31** or later on `PATH`, and **2.45** in a partial clone, the first that can be kept from fetching. A CI container whose user does not own the checkout needs `git config --global --add safe.directory "$PWD"`.
- **Python 3.11** or later, which `uvx` brings along. On Windows on ARM, use an x64 Python: hyperscan, which omerta searches with, has no wheels for Windows on ARM.
- **Security:** its two dependencies are pinned to exact versions, and git is run by its absolute path, never from inside the repository it checks, and is never given a value on its command line. See [SECURITY.md](SECURITY.md).

[excerpt truncated]