build: add missing security/lint targets

Jaime Fournier

1eefcbef7c27fef545315365684af7b1967a00fd

diff --git a/Makefile b/Makefile
index 79f7dda..829ecf0 100644
--- a/Makefile
+++ b/Makefile
@@ -13,7 +13,7 @@ GENERATOR := support/generate/upstream-contracts.ss
 INVENTORY := contracts/generated/upstream-inventory.sexp
 UNIT_TESTS := $(wildcard test/unit/*.ss)
 
-.PHONY: all check-upstream contracts contracts-check unit test check-docs verify clean help lint
+.PHONY: all check-upstream contracts contracts-check unit test check-docs verify clean help lint security
 .DEFAULT_GOAL := help
 
 all: verify
@@ -48,6 +48,14 @@ test: unit
 
 lint: check-docs
 
+security:
+	@echo "==> security: high-confidence secret scan"
+	@if git grep -nIE '(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----|aws_secret_access_key|GH_TOKEN|sk-[A-Za-z0-9]{20,})' -- ':!vendor' ':!*.lock' ':!test*' ':!Makefile' 2>/dev/null; then \
+		echo "SECURITY: potential secret detected" >&2; exit 1; \
+	else \
+		echo "security: no high-confidence secrets found"; \
+	fi
+
 check-docs:
 	@test -s Project.md
 	@test -s README.md