diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index a8395b9..921a382 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -45,3 +45,12 @@ Reviewers: this section is for you, not the author. Do not approve until every b
 - [ ] This PR has no user-visible changes → stated "no user-visible change" in summary above
 
 Reviewers: if "user-visible" is checked but README diff is empty, block merge (per 5.3 reviewer gate).
+
+### Privacy self-check (for PUBLIC repos) — Iron Rule adjacent
+
+- [ ] This PR does not introduce real names, nicknames, or handles that identify specific individuals. All references use role-based terms (`project maintainer`, `contributor`, `user`, `reviewer`).
+- [ ] This PR does not introduce literal personal paths (`/Users/<username>/`, `/home/<username>/`). Uses `$HOME/` or `~/` instead.
+- [ ] This PR does not introduce personal machine hostnames. Uses role-based names or generic descriptors.
+- [ ] This PR does not introduce personal email addresses beyond automated placeholders like `noreply@<vendor>.com`.
+
+Reviewers: if any of the above is violated and the repo is PUBLIC, block merge and request scrub.
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..96679b2
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,14 @@
+title = "OCP gitleaks configuration"
+
+[allowlist]
+description = "OCP known-safe allowlist"
+regexes = [
+  # Public OAuth client ID for Claude Code PKCE flow (constant, not a secret)
+  '''9d1c250a-e61b-44d9-88ed-5944d1962f5e''',
+  # OCP README API key placeholder example
+  '''ocp_(example|XXX+|xxxx+)''',
+]
+paths = [
+  # Old plan doc with test-admin-123 placeholders
+  '''docs/superpowers/plans/2026-04-10-lan-mode\.md''',
+]
diff --git a/README.md b/README.md
index 63fafb1..95b2d22 100644
--- a/README.md
+++ b/README.md
@@ -83,7 +83,7 @@ export OCP_ADMIN_KEY=your-secret-admin-key
 
 ocp keys add wife-laptop
 #  ✓ Key created for "wife-laptop"
-#    API Key: ocp_xDYzOB9ZKYzn...
+#    API Key: ocp_example12345abcde...
 #    Copy this key now — you won't see it again.
 
 ocp keys add son-ipad