diff --git a/.github/workflows/gitleaks.yml b/.github/workflows/gitleaks.yml
index 7cfc3bc52..f5e9af170 100644
--- a/.github/workflows/gitleaks.yml
+++ b/.github/workflows/gitleaks.yml
@@ -38,6 +38,18 @@ jobs:
           # steps (and Gitleaks itself) don't need it for repo operations.
           persist-credentials: false
 
+      # gitleaks-action builds `base^..head` for pull_request events; both SHAs
+      # must exist locally (fork PRs and shallow checkouts otherwise fail with
+      # "unknown revision" — see gitleaks/gitleaks-action#199).
+      - name: Fetch PR refs for gitleaks range
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git fetch --no-tags origin "$BASE_SHA"
+          git fetch --no-tags origin "$HEAD_SHA"
+
       # No GITLEAKS_LICENSE secret is required for OSS / public-repo usage.
       # If this repo becomes private, the action will require a license key.
       - name: Gitleaks
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..769b7eee9
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,12 @@
+title = "GitNexus"
+
+[extend]
+useDefault = true
+
+# Fake embedding API keys in unit tests (current probe + historical placeholder).
+[allowlist]
+description = "fake embedding API keys in http-embedder unit tests"
+regexes = [
+  '''secret-key-12345''',
+  '''test-api-key-redaction-check''',
+]
diff --git a/README.md b/README.md
index d8d1e7c92..28229c98c 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,3 @@
-[![CI](https://github.com/Arvuno/gitnexus/actions/workflows/ci.yml/badge.svg)](https://github.com/Arvuno/gitnexus/actions)
 # GitNexus
 
 **⚠️ Important Notice:** GitNexus has NO official cryptocurrency, token, or coin. Any token/coin using the GitNexus name on Pump.fun or any other platform is **not affiliated with, endorsed by, or created by** this project or its maintainers. Do not purchase any cryptocurrency claiming association with GitNexus.
@@ -23,6 +22,9 @@
   <a href="https://securityscorecards.dev/viewer/?uri=github.com/abhigyanpatwari/GitNexus">
     <img src="https://api.securityscorecards.dev/projects/github.com/abhigyanpatwari/GitNexus/badge" alt="OpenSSF Scorecard"/>
   </a>
+  <a href="https://github.com/abhigyanpatwari/GitNexus/actions/workflows/ci.yml">
+    <img src="https://github.com/abhigyanpatwari/GitNexus/actions/workflows/ci.yml/badge.svg" alt="CI Workflows"/>
+  </a>
 
   <p><strong>Enterprise (SaaS & Self-hosted)</strong> - <a href="https://akonlabs.com">akonlabs.com</a></p>
 
diff --git a/gitnexus/test/unit/http-embedder.test.ts b/gitnexus/test/unit/http-embedder.test.ts
index 4ac683095..c19bb4825 100644
--- a/gitnexus/test/unit/http-embedder.test.ts
+++ b/gitnexus/test/unit/http-embedder.test.ts
@@ -206,7 +206,8 @@ describe('HTTP embedding backend', () => {
     it('excludes API key from error messages', async () => {
       process.env.GITNEXUS_EMBEDDING_URL = 'http://test:8080/v1';
       process.env.GITNEXUS_EMBEDDING_MODEL = 'test-model';
-      process.env.GITNEXUS_EMBEDDING_API_KEY = 'secret-key-12345';
+      const redactionProbeKey = 'test-api-key-redaction-check';
+      process.env.GITNEXUS_EMBEDDING_API_KEY = redactionProbeKey;
 
       vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: false, status: 500 }));
 
@@ -214,7 +215,7 @@ describe('HTTP embedding backend', () => {
       try {
         await embedText('test');
       } catch (e: any) {
-        expect(e.message).not.toContain('secret-key-12345');
+        expect(e.message).not.toContain(redactionProbeKey);
         expect(e.message).not.toContain('Authorization');
       }
     });