Exact-path deny packs for deploy debris, without handling secrets.
LeakDeny checks a public host for signature-confirmed deploy debris and, when it qualifies, provides a host-native deny/404 pack. It shows redacted path shapes, never stores secret contents, and does not rotate keys.