diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 000000000..063f7c13c
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,5 @@
+[allowlist]
+  description = "Allow documentation examples in submissions"
+  paths = [
+    '''submissions/lab3\.md''',
+  ]
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 000000000..0bd663214
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,12 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.27.2
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: detect-private-key
+      - id: check-added-large-files
+        args: ["--maxkb=500"]
diff --git a/labs/lab11/docker-compose.yml b/labs/lab11/docker-compose.yml
index edb9ca06b..2f5388be5 100644
--- a/labs/lab11/docker-compose.yml
+++ b/labs/lab11/docker-compose.yml
@@ -11,8 +11,8 @@ services:
     depends_on:
       - juice
     ports:
-      - "8080:8080"   # HTTP (will redirect to HTTPS)
-      - "8443:8443"   # HTTPS
+      - "80:80"    # HTTP (redirects to HTTPS)
+      - "443:443"  # HTTPS
     volumes:
       - ./reverse-proxy/nginx.conf:/etc/nginx/nginx.conf:ro
       - ./reverse-proxy/certs:/etc/nginx/certs:ro
diff --git a/labs/lab11/reverse-proxy/nginx.conf b/labs/lab11/reverse-proxy/nginx.conf
index b90f6c476..8b09b97a2 100644
--- a/labs/lab11/reverse-proxy/nginx.conf
+++ b/labs/lab11/reverse-proxy/nginx.conf
@@ -7,47 +7,49 @@ http {
   include       /etc/nginx/mime.types;
   default_type  application/octet-stream;
   sendfile      on;
-  keepalive_timeout  10;
   server_tokens off;
-  gzip off;
+  gzip          off;
 
-  # Security-focused logs
   log_format security '$remote_addr - $remote_user [$time_local] '
-                     '"$request" $status $body_bytes_sent '
-                     '"$http_referer" "$http_user_agent" '
-                     'rt=$request_time uct=$upstream_connect_time '
-                     'urt=$upstream_response_time';
+                      '"$request" $status $body_bytes_sent '
+                      '"$http_referer" "$http_user_agent" '
+                      'rt=$request_time uct=$upstream_connect_time '
+                      'urt=$upstream_response_time';
   access_log /var/log/nginx/access.log security;
   error_log  /var/log/nginx/error.log warn;
 
-  # Upstream app
   upstream juice {
     server juice:3000;
     keepalive 32;
   }
 
-  # Rate limit zone for login
-  # ~10 req/min per IP, burst of 5
+  # Rate limit: 10 req/min per IP on the login endpoint, burst of 5
   limit_req_zone $binary_remote_addr zone=login:10m rate=10r/m;
   limit_req_status 429;
 
-  map $http_upgrade $connection_upgrade { default upgrade; '' close; }
+  # Connection limit: max 50 concurrent connections per IP
+  limit_conn_zone $binary_remote_addr zone=conn:10m;
 
-  # Common proxy settings
-  proxy_set_header Host $host;
-  proxy_set_header X-Real-IP $remote_addr;
-  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+  map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+  }
+
+  proxy_set_header Host              $host;
+  proxy_set_header X-Real-IP         $remote_addr;
+  proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_http_version 1.1;
-  proxy_set_header Connection $connection_upgrade;
-  proxy_set_header Upgrade $http_upgrade;
-  # Prevent upstream TLS BREACH vector by disabling compression from upstream
-  proxy_set_header Accept-Encoding "";
-  proxy_read_timeout 30s;
-  proxy_send_timeout 30s;
-  proxy_connect_timeout 5s;
+  proxy_set_header Connection        $connection_upgrade;
+  proxy_set_header Upgrade           $http_upgrade;
+  # Strip Accept-Encoding to prevent BREACH compression oracle against upstream
+  proxy_set_header Accept-Encoding   "";
+  proxy_read_timeout    30s;
+  proxy_send_timeout    30s;
+  proxy_connect_timeout  5s;
+
+  # Strip headers upstream sets so proxy-level values are authoritative
   proxy_hide_header X-Powered-By;
-  # Hide upstream headers to avoid duplicates and enforce policy at the proxy
   proxy_hide_header X-Frame-Options;
   proxy_hide_header X-Content-Type-Options;
   proxy_hide_header Referrer-Policy;
@@ -58,62 +60,60 @@ http {
   proxy_hide_header Content-Security-Policy-Report-Only;
   proxy_hide_header Access-Control-Allow-Origin;
 
-  # HTTP server (redirect to HTTPS)
+  # ── HTTP → HTTPS redirect ────────────────────────────────────────────
   server {
-    listen 8080;
-    listen [::]:8080;
+    listen 80;
+    listen [::]:80;
     server_name _;
 
-    # Core headers (also on redirects)
-    add_header X-Frame-Options "DENY" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
-    add_header Cross-Origin-Opener-Policy "same-origin" always;
-    add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
-
-    return 308 https://$host:8443$request_uri;
+    return 308 https://$host$request_uri;
   }
 
-  # HTTPS server
+  # ── HTTPS server ─────────────────────────────────────────────────────
   server {
-    listen 8443 ssl;
-    listen [::]:8443 ssl;
-    http2 on;
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2  on;
     server_name _;
 
     ssl_certificate     /etc/nginx/certs/localhost.crt;
     ssl_certificate_key /etc/nginx/certs/localhost.key;
-    ssl_session_timeout 10m;
-    ssl_session_cache   shared:SSL:10m;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:EECDH+AESGCM:EDH+AESGCM";
-    ssl_prefer_server_ciphers on;
-    ssl_stapling off;
-    # If using a publicly-trusted certificate, you may enable OCSP stapling:
-    # ssl_stapling on;
-    # ssl_stapling_verify on;
-    # resolver 1.1.1.1 8.8.8.8 valid=300s;
-    # resolver_timeout 5s;
-    # ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
-
-    client_max_body_size 2m;
-    client_body_timeout 10s;
-    client_header_timeout 10s;
-    keepalive_timeout 10s;
-    send_timeout 10s;
-
-    # Security headers (include HSTS here only)
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
-    add_header X-Frame-Options "DENY" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Permissions-Policy "camera=(), geolocation=(), microphone=()" always;
-    add_header Cross-Origin-Opener-Policy "same-origin" always;
+
+    # TLS 1.3 only — eliminates all legacy handshake attack surface
+    ssl_protocols             TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    # TLS 1.3 cipher suites are not configurable via ssl_ciphers (OpenSSL manages them)
+    ssl_ecdh_curve            X25519:secp384r1;
+    ssl_session_cache         shared:SSL:10m;
+    ssl_session_timeout       1d;
+    ssl_session_tickets       off;
+
+    # OCSP stapling — no-op with self-signed cert; enable in production with CA-signed cert
+    # ssl_stapling on; ssl_stapling_verify on;
+    # resolver 1.1.1.1 8.8.8.8 valid=300s; resolver_timeout 5s;
+
+    limit_conn conn 50;
+
+    client_max_body_size    2m;
+    client_body_timeout     10s;
+    client_header_timeout   10s;
+    keepalive_timeout       10s;
+    send_timeout            10s;
+
+    # ── Six required security headers ──────────────────────────────────
+    add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options       "nosniff" always;
+    add_header X-Frame-Options              "DENY" always;
+    add_header Referrer-Policy              "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy           "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy-Report-Only
+                "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
+
+    # Additional hardening headers (beyond the required six)
+    add_header Cross-Origin-Opener-Policy   "same-origin" always;
     add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Content-Security-Policy-Report-Only "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
 
+    # Rate-limited login endpoint (10 req/min, burst 5, fail immediately)
     location = /rest/user/login {
       limit_req zone=login burst=5 nodelay;
       limit_req_log_level warn;
diff --git a/labs/lab11/waf/docker-compose.override.yml b/labs/lab11/waf/docker-compose.override.yml
new file mode 100644
index 000000000..3c76b789a
--- /dev/null
+++ b/labs/lab11/waf/docker-compose.override.yml
@@ -0,0 +1,20 @@
+services:
+  # ModSecurity v3 + OWASP CRS (nginx connector) — blocks attacks before they reach Juice Shop
+  waf:
+    image: owasp/modsecurity-crs:nginx-alpine
+    restart: unless-stopped
+    depends_on:
+      - juice
+    environment:
+      BACKEND: "http://juice:3000"
+      PORT: "8080"
+      MODSEC_RULE_ENGINE: "On"
+      PARANOIA: "1"
+      ANOMALY_INBOUND: "5"
+      ANOMALY_OUTBOUND: "4"
+      MODSEC_AUDIT_LOG: "/var/log/modsec/audit.log"
+      MODSEC_AUDIT_LOG_FORMAT: "JSON"
+    ports:
+      - "8080:8080"   # WAF HTTP endpoint (separate from Nginx HTTPS on 443)
+    volumes:
+      - ./waf/logs:/var/log/modsec:rw
diff --git a/submissions/lab11.md b/submissions/lab11.md
new file mode 100644
index 000000000..3b3242bbf
--- /dev/null
+++ b/submissions/lab11.md
@@ -0,0 +1,203 @@
+# Lab 11 — BONUS — Submission
+
+## Task 1: TLS + Security Headers
+
+### nginx.conf — SSL + header sections
+
+```nginx
+  # ── HTTP → HTTPS redirect ────────────────────────────────────────────
+  server {
+    listen 80;
+    listen [::]:80;
+    server_name _;
+
+    return 308 https://$host$request_uri;
+  }
+
+  # ── HTTPS server ─────────────────────────────────────────────────────
+  server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    http2  on;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/localhost.crt;
+    ssl_certificate_key /etc/nginx/certs/localhost.key;
+
+    # TLS 1.3 only — eliminates all legacy handshake attack surface
+    ssl_protocols             TLSv1.3;
+    ssl_prefer_server_ciphers off;
+    # TLS 1.3 cipher suites are not configurable via ssl_ciphers (OpenSSL manages them)
+    ssl_ecdh_curve            X25519:secp384r1;
+    ssl_session_cache         shared:SSL:10m;
+    ssl_session_timeout       1d;
+    ssl_session_tickets       off;
+
+    # ── Six required security headers ──────────────────────────────────
+    add_header Strict-Transport-Security    "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Content-Type-Options       "nosniff" always;
+    add_header X-Frame-Options              "DENY" always;
+    add_header Referrer-Policy              "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy           "camera=(), microphone=(), geolocation=()" always;
+    add_header Content-Security-Policy-Report-Only
+                "default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'" always;
+  }
+```
+
+### A. HTTPS redirect proof
+
+```
+HTTP/1.1 308 Permanent Redirect
+Server: nginx
+Date: Sat, 04 Jul 2026 14:11:27 GMT
+Content-Type: text/html
+Content-Length: 164
+Connection: keep-alive
+Location: https://localhost/
+```
+
+### B. TLS 1.3 proof
+
+```
+Connecting to ::1
+Can't use SSL_get_servername
+depth=0 CN=juice.local
+verify error:num=18:self-signed certificate
+CONNECTION ESTABLISHED
+Protocol version: TLSv1.3
+Ciphersuite: TLS_AES_256_GCM_SHA384
+Peer certificate: CN=juice.local
+Hash used: SHA256
+Signature type: rsa_pss_rsae_sha256
+```
+
+### C. Security headers proof (all 6 present)
+
+```
+HTTP/2 200 
+server: nginx
+date: Sat, 04 Jul 2026 14:11:27 GMT
+content-type: text/html; charset=UTF-8
+strict-transport-security: max-age=63072000; includeSubDomains; preload
+x-content-type-options: nosniff
+x-frame-options: DENY
+referrer-policy: strict-origin-when-cross-origin
+permissions-policy: camera=(), microphone=(), geolocation=()
+content-security-policy-report-only: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'
+cross-origin-opener-policy: same-origin
+cross-origin-resource-policy: same-origin
+```
+
+### What each header defends against (1 sentence each)
+
+- **HSTS**: Forces all future browser connections to use HTTPS for 2 years, preventing protocol-downgrade and SSL-stripping attacks by a network-level adversary.
+- **X-Content-Type-Options: nosniff**: Stops browsers from MIME-sniffing a response away from the declared Content-Type, blocking attacks where an attacker uploads a polyglot file (e.g., a PNG that is also valid JavaScript) that the browser would otherwise execute.
+- **X-Frame-Options: DENY**: Prevents any site from embedding this page in an `<iframe>`, eliminating clickjacking attacks where the attacker overlays an invisible frame to steal clicks.
+- **Referrer-Policy**: Limits the Referer header to origin-only when crossing origins, preventing sensitive URL paths (e.g., `/account/reset?token=…`) from leaking to third-party servers via HTTP Referer.
+- **Permissions-Policy**: Explicitly revokes access to camera, microphone, and geolocation APIs for all origins, so even a successfully injected script cannot silently invoke sensitive browser features.
+- **Content-Security-Policy-Report-Only**: Declares a content source allowlist and ships violations to a report endpoint without blocking (report-only mode), providing visibility into injection attempts and inline-script abuse while iteratively tightening the policy without breaking the app.
+
+---
+
+## Task 2: Production Posture
+
+### Rate limit proof
+
+60 concurrent POST requests to `/rest/user/login`:
+
+| HTTP code | Count out of 60 |
+|-----------|----------------:|
+| 401       | 6               |
+| 429       | 54              |
+
+Rate limiting engaged immediately — 54/60 requests returned 429 (Too Many Requests). Only 6 burst slots + initial tokens passed before the zone was exhausted.
+
+### Timeout enforced
+
+```nginx
+client_body_timeout     10s;
+client_header_timeout   10s;
+proxy_read_timeout      30s;
+proxy_connect_timeout    5s;
+send_timeout            10s;
+```
+
+Nginx closes connections that send partial headers after `client_header_timeout` (10s), protecting against Slowloris-style attacks. `proxy_read_timeout` ensures stalled upstream responses don't hold connections open indefinitely.
+
+### Cipher hardening
+
+```
+Peer Temp Key: X25519, 253 bits
+New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
+```
+
+TLS 1.3 with X25519 key exchange (forward secrecy per-session) and AES-256-GCM-SHA384 cipher (AEAD, no separate MAC negotiation). `ssl_session_tickets off` disables session ticket reuse, which would otherwise allow a compromised ticket key to retroactively decrypt recorded sessions.
+
+### Cert rotation runbook (7 steps)
+
+1. **Detect expiry**: Monitor cert expiry with `openssl s_client -connect host:443 </dev/null 2>/dev/null | openssl x509 -noout -enddate` and alert at 30-day and 7-day thresholds via a cron job or Prometheus `ssl_expiry_seconds` metric.
+2. **Order new cert**: Request a replacement from the CA (Let's Encrypt: `certbot renew --dry-run` then `certbot renew`; internal CA: submit CSR via ACME or PKI portal) — keep the existing cert live throughout.
+3. **Validate**: Verify the new cert chain with `openssl verify -CAfile ca-bundle.crt new.crt` and confirm it covers the correct SANs with `openssl x509 -noout -text -in new.crt | grep -A1 "Subject Alternative Name"`.
+4. **Atomic swap**: Copy `new.crt` → `localhost.crt` and `new.key` → `localhost.key` (keep the old files as `.bak`), then reload Nginx without dropping connections: `nginx -s reload` (or `docker exec nginx nginx -s reload`).
+5. **Verify**: Confirm the new cert is live with `openssl s_client -connect host:443 </dev/null 2>/dev/null | openssl x509 -noout -subject -enddate` and ensure browsers no longer show cert warnings.
+6. **Rollback plan**: If the new cert causes errors (chain mismatch, wrong CN), restore from `.bak` files and `nginx -s reload` — downtime is limited to the reload window (~1 s).
+7. **Audit**: Log the rotation event (old serial → new serial, timestamp, operator) to an immutable audit trail (SIEM or append-only S3 bucket) for compliance and post-incident forensics.
+
+### What OCSP stapling buys you
+
+OCSP stapling lets Nginx pre-fetch the CA's "this cert is still valid" response and attach it to the TLS handshake, saving the browser from making a separate real-time OCSP request that leaks browsing intent to the CA and adds 50–200 ms of latency. For a production CA-signed certificate this eliminates the privacy leak and removes the CA as a latency dependency for every new TLS session. For a self-signed lab certificate there is no CA to query, so `ssl_stapling on` is a no-op — the directive is commented out in this config and would only be enabled when a publicly-trusted cert is deployed.
+
+---
+
+## Bonus: WAF Sidecar with OWASP CRS
+
+### Setup choice
+- **WAF used**: ModSecurity v3.0.16 via `owasp/modsecurity-crs:nginx-alpine` (nginx connector, not Coraza)
+- **OWASP CRS version**: 4.28.0 (851 rules loaded)
+- **Paranoia level**: 1
+- **Mode**: `SecRuleEngine On` (blocking, not detection-only)
+- **Stack**: WAF proxies directly to `juice:3000` and is exposed on host port 8080; Nginx (TLS hardened, Tasks 1+2) is on port 443
+
+> Coraza is the modern Go-based rewrite of ModSecurity (~70% feature parity as of 2026). ModSecurity v3 was chosen here because the OWASP CRS documentation is richer and the `owasp/modsecurity-crs:nginx-alpine` image gives a batteries-included demo with minimal config.
+
+### Attack payload sent
+
+```
+GET /rest/products/search?q=' OR 1=1-- (URL-encoded)
+```
+
+### Before WAF (Nginx alone)
+
+```
+no-waf: HTTP 500
+```
+
+*(Juice Shop backend received the SQL injection payload — returned 500 from its own error handler, not an Nginx block.)*
+
+### After WAF
+
+```
+with-waf: HTTP 403
+```
+
+### Audit log excerpt (the rule that fired)
+
+```
+2026/07/04 14:12:48 [error] ModSecurity: Access denied with code 403 (phase 2).
+  Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5')
+  [file "REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"]
+  [id "949110"]
+  [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"]
+  [ver "OWASP_CRS/4.28.0"] [tag "anomaly-evaluation"]
+  [uri "/rest/products/search"]
+  [request "GET /rest/products/search?q=%27%20OR%201%3D1-- HTTP/1.1"]
+```
+
+**Rule ID: 949110** — OWASP CRS rule: **Inbound Anomaly Score Exceeded** (accumulation rule).  
+The SQL injection pattern `' OR 1=1--` first scored against rule **942100** (SQL Injection Attack: Common Injection Testing), accumulating an inbound anomaly score of 5. Rule 949110 then evaluated the total and blocked the request because it reached the paranoia-1 threshold.
+
+### Tradeoff analysis (3 sentences)
+
+**What the WAF buys**: SAST (Lab 5) found the SQL injection vulnerability at the source-code level and DAST sent synthetic attack traffic during testing, but both operate in the development pipeline — neither protects production traffic in real time; the WAF is the only control that inspects and blocks live attack payloads before they reach the vulnerable endpoint, buying time when a patch is not yet deployed or when a zero-day variant wasn't in the DAST wordlist.  
+**What it costs**: At paranoia level 1 the false-positive rate is low but non-zero — legitimate requests with SQL-like tokens in search parameters (e.g., `search?q=select`) can be blocked, ops teams must continuously tune exclusions, the WAF config becomes a compliance artifact that needs its own change-management process, and adding a synchronous WAF in the request path increases p99 latency by 5–30 ms per hop.  
+**When not to deploy**: A WAF in front of a gRPC or binary-framed API (e.g., Protobuf over HTTP/2) gives near-zero value because the CRS rules were written for HTTP/1.1 text payloads — you would only add latency, false positives, and ops burden without the blocking benefit; in those cases, input validation at the application layer and mTLS between services are the correct controls.
diff --git a/submissions/lab3.md b/submissions/lab3.md
new file mode 100644
index 000000000..d9266c565
--- /dev/null
+++ b/submissions/lab3.md
@@ -0,0 +1,137 @@
+# Lab 3 — Submission
+
+## Task 1: SSH Commit Signing
+
+### Local configuration
+- `git config --global gpg.format` → `ssh`
+- `git config --global user.signingkey` → `/home/pavel/.ssh/id_ed25519.pub`
+- `git config --global commit.gpgsign` → `true`
+
+### Local verification
+Output of `git log --show-signature -1`:
+```
+commit 92499f1601e4733d054faacca7834ae1e4370dee
+Good "git" signature for alexander@heronwater.com with ED25519 key SHA256:vwqxlQeyMQRmpij9axlAMAhQZB9aoV+I7goi6xeApDs
+Author: Temniy Princ <alexander@heronwater.com>
+Date:   Thu Jun 18 17:04:36 2026 +0300
+
+    feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice
+```
+
+### GitHub verification
+- Latest commit (docs update): https://github.com/wannebetheshy/DevSecOps-Intro/commit/cdf834e428199df34a611a8878e05d7e48e16ffc
+- First lab3 commit: https://github.com/wannebetheshy/DevSecOps-Intro/commit/198206d60ddcb453193e67a8ff05665c270ee83c
+- Screenshot of the Verified badge: ![Verified badge](verified-badge.png)
+
+### One-paragraph reflection
+A forged-author commit allows an attacker (or a malicious insider) to plant backdoors, sabotage releases, or comply fraud while attributing the change to a trusted colleague — perfect Repudiation under STRIDE-R: the actual actor can deny the action, and the framed developer cannot prove their innocence. Without signing, `git log --author` is trivially spoofable via `git commit --author "trusted@example.com"`. The Verified badge breaks this attack by binding the commit to the SSH private key only the real author possesses: a commit showing "Unverified" next to a trusted name is an immediate red flag that triggers investigation rather than silent acceptance.
+
+---
+
+## Task 2: Pre-commit + gitleaks
+
+### `.pre-commit-config.yaml` (full content)
+```yaml
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.27.2
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: detect-private-key
+      - id: check-added-large-files
+        args: ["--maxkb=500"]
+```
+
+### `pre-commit install` output
+```
+pre-commit installed at .git/hooks/pre-commit
+```
+
+### The blocked commit
+Output of the `git commit` that gitleaks blocked:
+```
+Detect hardcoded secrets.................................................Failed
+- hook id: gitleaks
+- exit code: 1
+
+○
+    │╲
+    │ ○
+    ○ ░
+    ░    gitleaks
+
+Finding:     GH_PAT=REDACTED
+Secret:      REDACTED
+RuleID:      github-pat
+Entropy:     4.143943
+File:        submissions/leak-attempt.txt
+Line:        2
+Fingerprint: submissions/leak-attempt.txt:github-pat:2
+
+5:02PM INF 0 commits scanned.
+5:02PM INF scanned ~101 bytes (101 bytes) in 23.8ms
+5:02PM WRN leaks found: 1
+
+detect private key.......................................................Passed
+check for added large files..............................................Passed
+```
+
+### Tune-out exercise
+
+**1. Inline allowlist** — `[allowlist]` block in `.gitleaks.toml`
+
+Example:
+```toml
+[allowlist]
+  regexes = ['''ghp_16C7e42F292c6912E7710c838347Ae178B4a''']  # exact known example value
+```
+(In practice, write the regex as a fixed-string match so it doesn't accidentally catch real tokens.)
+
+This approach is OK when the pattern is highly specific (a single known example value, not a broad regex), the exemption is peer-reviewed and intentional, and the file lives in the repo itself so it's version-controlled and auditable. If you use a broad regex like `ghp_[A-Za-z0-9]+` you effectively disable the rule for the entire codebase — that's when it becomes dangerous.
+
+**2. Path exclusion** — `paths: [docs/]` in `.gitleaks.toml`
+
+Example:
+```toml
+[allowlist]
+  paths = ['''docs/''']
+```
+
+This is risky because it creates a blind spot: once `docs/` is excluded, anyone who wants to sneak a real secret past gitleaks just names the file `docs/my-config.md`. Path exclusions are also fragile — a file move from `src/` into `docs/` silently removes it from scanning. Use only for tightly scoped paths (e.g., `docs/examples/fake-credentials.md`) and add a comment explaining the rationale.
+
+---
+
+## Bonus: History Rewrite
+
+### Before
+```
+16ddad0 docs: add usage notes
+7761171 feat: empty log
+6796a92 feat: add config
+f3bd98b init
+```
+Output of `git log -p | grep -c 'ghp_AAAA'`: **2**
+
+### After
+```
+e5eacd4 docs: add usage notes
+b0aee0d feat: empty log
+1a0d567 feat: add config
+18f8d28 init
+```
+Output of `git log -p | grep -c 'ghp_AAAA'`: **0**
+Output of `git log -p | grep -c 'REDACTED'`: **2**
+
+### The two-step pattern in real life
+1. `git filter-repo --replace-text replacements.txt` — rewrite locally
+2. **Rotate the secret immediately** — what's the MANDATORY second step in a real incident. Even after a successful `--force` push that overwrites all branches, the token was already exposed: GitHub's API, CDN caches, local clones on every contributor's machine, and any CI log that ever printed it may still hold the live value. Rewriting history removes the evidence but does not invalidate the credential. Rotation (revoking the old token and issuing a new one) is the only action that actually closes the attack window.
+
+### Two real-world gotchas
+
+1. **filter-repo refused to run because the repo was not a fresh clone.** The tool checks reflog depth and aborts with "this does not look like a fresh clone" if there is more than one entry for HEAD. In the sandbox this was hit immediately because commits had been added after `git init`. The fix is `--force`, but in a real incident you should work on a dedicated fresh clone (so your working copy stays clean) and only force-push once the rewrite is verified.
+
+2. **All commit SHAs change after the rewrite, breaking every in-flight PR and CI run.** After `filter-repo` runs, every commit hash is different — the history is literally a new DAG. In a team repo this means every open pull request shows as "nothing to merge" or conflicts, every local clone is now diverged, and CI pipelines referencing old SHAs point to orphaned objects. The standard playbook is: announce the rewrite, ask everyone to re-clone or hard-reset their local branches, and re-open any PRs that were in progress.
diff --git a/submissions/verified-badge.png b/submissions/verified-badge.png
new file mode 100644
index 000000000..b47a9f5dc
Binary files /dev/null and b/submissions/verified-badge.png differ