- gate needs: expanded to include security - individual needs.security.result check added (requires success, not success-or-skipped) - security not folded into api/harness for loop — gitleaks always runs so it cannot be skipped - follows Gitea #31007 individual needs.X.result pattern