diff --git a/.gitleaksignore b/.gitleaksignore
index 20c6879..ef8806e 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -16,5 +16,8 @@
 
 # tests/integration/test_commit_failure.py:37 — the same fake webhook test secret "0123456789abcdef",
 # copied into the AURORA-3 commit-failure tests. It signs nothing outside the test process. Flagged
-# by the generic-api-key rule on entropy alone; the value was replaced in a50c7f9.
+# by the generic-api-key rule on entropy alone; the value was replaced later on the same branch.
+# 52380ec is the commit on the PR branch; the rebase merge rewrote it as 103c04e on main, so both
+# fingerprints are listed (a rebase changes the SHA, and the fingerprint carries it).
 52380ec296e26e2a6ae13701064b1b611d74bd9e:tests/integration/test_commit_failure.py:generic-api-key:37
+103c04e8cd787fe0a2bc6c646562082989820287:tests/integration/test_commit_failure.py:generic-api-key:37
diff --git a/README.md b/README.md
index e4e18e2..084e5db 100644
--- a/README.md
+++ b/README.md
@@ -62,7 +62,7 @@ make test      # run the test suite
 make dev       # start the API on http://localhost:8000
 ```
 
-Then open http://localhost:8000/health/live.
+Then open `http://localhost:8000/health/live` in your browser.
 
 ## Try the API by hand
 
@@ -79,8 +79,8 @@ reserved `.test` TLD.
 
 | Tool | How | Notes |
 |---|---|---|
-| **Swagger UI** | http://localhost:8000/docs | Browse every endpoint and send requests from the browser. Run `POST /api/v1/auth/login`, copy `access_token`, click *Authorize*, and paste it (just the token, no `Bearer ` prefix). Protected endpoints then send it for you; they show a lock icon. |
-| **ReDoc** | http://localhost:8000/redoc | Read-only reference view of the same spec. |
+| **Swagger UI** | `http://localhost:8000/docs` | Browse every endpoint and send requests from the browser. Run `POST /api/v1/auth/login`, copy `access_token`, click *Authorize*, and paste it (just the token, no `Bearer ` prefix). Protected endpoints then send it for you; they show a lock icon. |
+| **ReDoc** | `http://localhost:8000/redoc` | Read-only reference view of the same spec. |
 | **`.http` files** | [`requests/`](requests) | The recommended way. Open in VS Code with the [REST Client](https://marketplace.visualstudio.com/items?itemName=humao.rest-client) extension (or a JetBrains IDE) and click *Send Request*. Send the login request first; later requests reuse its token automatically. See [`requests/README.md`](requests/README.md). |
 | **Postman** | *Import* → *Link* → `http://localhost:8000/openapi.json` (or the committed [`contracts/openapi.json`](contracts/openapi.json)) | Postman builds a collection from the spec. Call `POST /api/v1/auth/login`, then set *Authorization* → *Bearer Token* to the returned `access_token` on the collection. |