Harden public showcase privacy controls

README.md

@@ -24,7 +24,7 @@ A public-safe overview of a real multi-host homelab built around segmented netwo
 | **GPU workstation** | CachyOS workstation | Operator workstation and opportunistic high-performance GPU compute |
 | **Edge node** | Low-power Linux node | Weather dispatch and mesh-radio edge services |
 
-See [Architecture](docs/architecture.md) for the data flow and [Services](docs/services.md) for the current service placement.
+See [Architecture](docs/architecture.md) for the data flow and [Services](docs/services.md) for the representative service design by role.
 
 ## Design highlights
 
@@ -45,7 +45,7 @@ docs/
   networking.md     Segmentation and access-control model
   operations.md     Deployment, verification, backup, and rollback patterns
   security.md       Public/private boundary and secret-handling rules
-  services.md       Current service placement by host
+  services.md       Representative service design by host role
 examples/
   compose/           Sanitized Compose and environment examples
 scripts/
@@ -62,7 +62,7 @@ scripts/
 
 ## Public-safety policy
 
-Every commit is checked for:
+Every commit is checked with a repository-specific privacy scanner for:
 
 - private or management addresses
 - MAC addresses and device identifiers
@@ -70,7 +70,7 @@ Every commit is checked for:
 - private-key material, tokens, passwords, and authorization headers
 - real `.env` files and key-bearing file types
 
-Gitleaks also scans the complete Git history in CI. See [Security](docs/security.md).
+The detector source is executed and syntax-checked rather than matched against its own regex literals. Binary files are rejected for manual review. Gitleaks separately scans the complete Git history in CI. See [Security](docs/security.md).
 
 ## Scope