diff --git a/scripts/verify-guidelines.sh b/scripts/verify-guidelines.sh
index a7e8576..b1dba14 100755
--- a/scripts/verify-guidelines.sh
+++ b/scripts/verify-guidelines.sh
@@ -123,10 +123,22 @@ section "General: No secrets committed"
 
 # GUIDELINE: NEVER commit files with secrets (.env, credentials.json, etc.)
 echo "Checking for secrets in repository..."
-if [ -f ".env" ] || [ -f "credentials.json" ]; then
-    error_msg "Found .env or credentials.json in repository (violation: secrets committed)"
+if git rev-parse --git-dir > /dev/null 2>&1; then
+    TRACKED_SECRETS=$(git ls-files | grep -E "^\.env$|^credentials.json$" || true)
+    if [ -n "$TRACKED_SECRETS" ]; then
+        error_msg "Found .env or credentials.json tracked in git (violation: secrets committed)"
+        echo "Tracked files:"
+        echo "$TRACKED_SECRETS"
+    else
+        success_msg "No secrets in repository"
+    fi
 else
-    success_msg "No secrets in repository"
+    # No git repo, just check if files exist
+    if [ -f ".env" ] || [ -f "credentials.json" ]; then
+        warning_msg ".env or credentials.json exist locally (ensure they're .gitignored)"
+    else
+        success_msg "No secrets in repository"
+    fi
 fi
 
 echo "Checking git history for secrets..."