build: add missing security/lint targets

ober

1b9d59a7603fdbd6f89c3015e2fad069f53c6aa8

diff --git a/Makefile b/Makefile
index 60420ca..5a6e3fa 100644
--- a/Makefile
+++ b/Makefile
@@ -4,7 +4,7 @@ GXI ?= gxi
 REPO_DIR := $(abspath $(dir $(lastword $(MAKEFILE_LIST))))
 LOADPATH := $(dir $(REPO_DIR))
 
-.PHONY: test lint
+.PHONY: test lint security
 
 test:
 	GERBIL_LOADPATH='$(LOADPATH)' $(GXI) test/convert-test.ss
@@ -12,3 +12,11 @@ test:
 lint:
 	GERBIL_LOADPATH='$(LOADPATH)' $(GXI) -e '(import :jerboa-gerbil/convert)' \
 		-e '(displayln "lint OK: convert.ss loads and expands cleanly")'
+
+security:
+	@echo "==> security: high-confidence secret scan"
+	@if git grep -nIE '(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----|aws_secret_access_key|GH_TOKEN|sk-[A-Za-z0-9]{20,})' -- ':!vendor' ':!*.lock' ':!test*' ':!Makefile' 2>/dev/null; then \
+		echo "SECURITY: potential secret detected" >&2; exit 1; \
+	else \
+		echo "security: no high-confidence secrets found"; \
+	fi