diff --git a/scripts/publish-github.sh b/scripts/publish-github.sh
index 9fcab17..db123e4 100755
--- a/scripts/publish-github.sh
+++ b/scripts/publish-github.sh
@@ -39,6 +39,11 @@ while IFS= read -r p; do
   rm -rf "${TMP_EXPORT:?}/$p"
 done < "$EXCLUDE_FILE"
 
+# 3.5) repo 自備的遮蔽腳本（可選）：對匯出樹做內容級遮蔽（如指南去帳密）
+if [ -f "$REPO_ROOT/scripts/github-publish-sanitize.py" ]; then
+  python3 "$REPO_ROOT/scripts/github-publish-sanitize.py" "$TMP_EXPORT"
+fi
+
 # 4) 同步進常駐 mirror（mirror 自己的 .git = 公開端乾淨歷史）
 mkdir -p "$MIRROR_DIR"
 [ -d "$MIRROR_DIR/.git" ] || git -C "$MIRROR_DIR" init -q -b main