Sensitive data element remediation (issue template + instructions)

## Sensitive data element remediation

When working on an issue labeled `copilot-remediate` whose body
declares an SDE class (`secret`, `token`, `pii`, `pci`, `phi`),
follow these rules.

### Exposure scope — classify first
- PRE-EXPOSURE: literal exists only in the current working
  tree. Never committed to a shared remote. Never printed in
  CI logs.
- EXPOSED: anything else. If in doubt, it's EXPOSED.

Determine scope by:
- Reading the "Exposure" field of the issue body.
- Running `git log --all -S '<literal-hash>'` (hash the
  literal; never echo it).

### EXPOSED — do NOT edit code
If scope is EXPOSED:
- Do not open a PR.
- Do not modify the offending file.
- Post a single comment on the issue with:
  - The rotation checklist (revoke, rotate, re-deploy,
    invalidate cached sessions).
  - The disclosure checklist (IR ticket, service owner, legal
    routing).
  - The first-seen commit sha + date.
- Add the `needs-rotation` label.
- Remove the `copilot-remediate` label (the finding is now a
  rotation task, not an agent task).

### PRE-EXPOSURE — minimal code fix
- Branch: `copilot/<finding-id>`.
- Commit: `fix(sec): remove <class> <finding-id>`.
- Replacement patterns:
  - `secret` / `token` → reference the project's approved
    secret store. Identify the client from
    `docs/security/secrets.md`. If that document doesn't
    exist or names no client, comment on the issue explaining
    why remediation is blocked and stop.
  - `pii` / `pci` / `phi` → route through the project's
    redaction helper (grep for `redact(`, `mask_pii`,
    `scrubPII`). If none exists, comment on the issue and
    stop — do not invent one.
  - Test fixtures with real user data → replace with
    Faker-style synthetic values. Comment each fixture with
    the finding id.
- Add a regression guard: a unit test that fails if the
  literal reappears, or a scanner-config entry that flags it.
  Allowlist only the synthetic-fixture path.
- Minimal edit only. No renames. No reformatting unrelated
  code.

### What you must NEVER do
- Rewrite git history.
- Echo the SDE literal in commit messages, PR bodies, chat
  output, or logs. When referring to it, hash it.
- Commit or remove `.env` / `credentials.json` files —
  those require a `git filter-repo` runbook + human sign-off.
- Merge your own PR. Never enable auto-merge.

### PR shape (pre-exposure path)
- Title: `fix(sec): remove <class> from <file> (<finding-id>)`.
- Body: link the issue (`Closes #NNN`), exposure scope
  (`pre-exposure`), replacement pattern used, test pass
  evidence, one-line revert instructions. Never include the
  literal.
- Labels: `security`, `sde-remediation`.
- Keep the PR as DRAFT. Never mark ready-for-review.

name: Security — Sensitive data element remediation
description: Open a remediation task for a single SDE finding.
title: "Remediate: <finding-id> (<sde-class>)"
labels: ["copilot-remediate", "security"]
assignees: ["copilot"]
body:
  - type: input
    id: finding_id
    attributes:
      label: Finding id
      placeholder: GITLEAKS-AWS-001
    validations:
      required: true
  - type: dropdown
    id: sde_class
    attributes:
      label: SDE class
      options: [secret, token, pii, pci, phi]
    validations:
      required: true
  - type: dropdown
    id: exposure
    attributes:
      label: Exposure scope
      description: Best-known answer at the time of filing. The agent will re-verify.
      options:
        - pre-exposure (literal only in working tree)
        - exposed (committed / pushed / seen in CI logs / public)
        - unknown
    validations:
      required: true
  - type: input
    id: file_path
    attributes:
      label: File path
      placeholder: src/config/stripe.ts
    validations:
      required: true
  - type: input
    id: line
    attributes:
      label: Line number
      placeholder: "42"
    validations:
      required: false
  - type: textarea
    id: notes
    attributes:
      label: Notes for the agent
      description: |
        DO NOT paste the literal SDE value in this field. Hash or
        abstract it. Example: "STRIPE_LIVE_KEY_sk_live_*** (last
        4 chars: abcd)".
    validations:
      required: false