diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..b7f2445
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# gitleaks configuration for avow-protocol.
+#
+# TWO SILENT SYNTAX TRAPS in the pinned gitleaks — both fail with NO error and
+# NO effect, so a config written either way looks correct and suppresses
+# nothing:
+#   1. The block must be `[allowlist]` (SINGULAR). `[[allowlists]]` is ignored.
+#   2. `regexes = [...]` is ignored; only `paths` is honoured.
+#
+# ⚠ NOTHING HERE SUPPRESSES SOURCE OR SCRIPTS. This repository had a REAL
+# Cloudflare API token committed in deploy-repos.sh and published for as long
+# as the repo has been public. The scanner found it only because it inspects
+# generic high-entropy strings — Cloudflare tokens carry no prefix, so
+# prefix-matching scanners miss them entirely. Keep these exclusions narrow.
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = """
+Lockfile integrity hashes and documentation placeholders.
+
+telegram-bot/deno.lock — content-addressed integrity hashes, machine-generated.
+telegram-bot/README.md, NEXT-STEPS.md — setup docs showing where a bot token
+goes, not a token.
+avow-lib/ffi/zig/src/example.zig — an example carrying the literal
+`.token = "abc123def456..."` with the trailing comment `// Would be real token`.
+"""
+paths = [
+  '''^telegram-bot/deno\.lock$''',
+  '''^telegram-bot/README\.md$''',
+  '''^telegram-bot/NEXT-STEPS\.md$''',
+  '''^avow-lib/ffi/zig/src/example\.zig$''',
+]
diff --git a/deploy-repos.sh b/deploy-repos.sh
index 71a793e..6c79e53 100755
--- a/deploy-repos.sh
+++ b/deploy-repos.sh
@@ -2,7 +2,14 @@
 # SPDX-License-Identifier: MPL-2.0
 # Deploy all repos to Cloudflare Pages
 
-export CLOUDFLARE_API_TOKEN="xjmFyko52yeQ-3DPYxDTOZwM3DYwqRFU84f0UN40"
+# Authentication is via `wrangler login` (OAuth), NOT an API token.
+# Run it once; wrangler stores the session under ~/.config/.wrangler/.
+# Do not reintroduce `export CLOUDFLARE_API_TOKEN=...` here — a token in a
+# tracked file is a published credential, and this repository is public.
+#
+# The account id below is NOT a secret: Cloudflare treats it as an ordinary
+# identifier and it appears in dashboard URLs. It is kept because this login
+# can see more than one account.
 export CLOUDFLARE_ACCOUNT_ID="b72dd54ed3ee66088950c82e0301edbb"
 
 REPOS_DIR="$HOME/Documents/hyperpolymath-repos"
@@ -39,7 +46,7 @@ for project in "${!PROJECTS[@]}"; do
 
   cd "$repo_path" || continue
 
-  deno run -A npm:wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
+  bunx wrangler pages deploy . --project-name="$project" --branch=main 2>&1 | grep -E "✨|Deployment complete|View your site"
 
   if [ ${PIPESTATUS[0]} -eq 0 ]; then
     echo "   ✅ Deployed successfully"