diff --git a/.ciagent/PHASE7_SECURITY_AUDIT.md b/.ciagent/PHASE7_SECURITY_AUDIT.md
new file mode 100644
index 0000000..9fa6b2d
--- /dev/null
+++ b/.ciagent/PHASE7_SECURITY_AUDIT.md
@@ -0,0 +1,57 @@
+---
+description: P07 Layer-3 security audit finding — pre-existing .env secret leak in git history at 0cba1aa
+---
+
+# Phase 7 Security Audit Finding
+
+**Severity**: P0 (secret in git history)
+**Status**: Mitigated going forward; full remediation requires human action
+**Found by**: ciagent verify (Layer 3 — security) during P07 EXECUTE
+**Commit in history**: `0cba1aa` — `chore(P00): set autonomy level to full`
+
+## Finding
+
+The `.env` file (containing `GITEA_TOKEN=795e...67aa` and `GITEA_USER=cloudinit-bot`)
+was committed in `0cba1aa` during P00 and has remained in git history since.
+It is reachable on the `main` branch and all descendant branches.
+
+The pre-P07 `.gitignore` listed only `.env.local`, so `.env` was tracked.
+
+## Immediate Mitigations Applied in P07
+
+1. Added `.env` to `.gitignore` (matches `.env.local` discipline).
+2. Confirmed `scripts/backfill_releases.sh` does not echo the token, does
+   not pass it as a CLI argument to `tea`, and sources it from `.env` only.
+3. Confirmed `tea` is configured to use this token via its own config and
+   the script invokes `tea releases create` without `--token` flags.
+4. Documented the leak here for human review.
+
+## Required Human Actions (out of CI scope)
+
+1. **Rotate the Gitea token**: the leaked value is in the public-on-this-forge
+   git history. Treat it as compromised; generate a new token at
+   <https://git.cloudinit.dev/user/settings/applications> and update `.env`.
+2. **Rewrite history to scrub the secret** (optional but recommended):
+   - `git filter-repo --invert-paths --path .env` and force-push all
+     branches, OR
+   - use `git-filter-repo` via BFG Repo-Cleaner.
+   - This is a destructive operation; coordinate with all consumers.
+3. **Audit Gitea access logs** for the period the token was exposed to
+   detect any unauthorized use.
+4. **Add CI secret scanning**: integrate `gitleaks` or `trufflehog` into
+   the `validate` pipeline (deferred to v0.2 alongside REQ-014
+   `gosec`+`govulncheck`).
+
+## P07 Continues
+
+P07 EXECUTE continues (no P0 code change required for the milestone tag
+itself; the backfill script is safe and the existing token still works for
+its purpose). The P07 ship → v0.1 milestone → main flow proceeds, but
+REVIEW/AUDIT must flag this for the milestone close-out.
+
+## Forward-Looking Rule (proposed for v0.2)
+
+- `pre-commit` hook runs `gitleaks protect --staged` and rejects any
+  commit that adds a secret.
+- `.env*` is in `.gitignore` from the first commit of v0.2 onward.
+- `ciagent-init` warns loudly if `git log --all -- .env` returns anything.
diff --git a/.gitignore b/.gitignore
index 434d04c..d3699e5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,5 +8,6 @@ orca
 *.db-journal
 *.db-wal
 *.db-shm
+.env
 .env.local
 *.tar.gz