@vaultcompass/vault-guard-core 1.2.3 → 1.4.0

package/dist/config-validate.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateVaultGuardConfig = validateVaultGuardConfig;
+const fail_on_1 = require("./utils/fail-on");
 const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'off']);
 /**
  * Structural validation for parsed `.vault-guard.json` (no file I/O).
@@ -19,6 +20,7 @@ function validateVaultGuardConfig(value) {
             'extra_patterns',
             'extra_patterns_unsafe',
             'entropy_threshold',
+            'fail_on',
         ]);
         if (!allowed.has(key)) {
             errors.push(`unknown top-level key: ${JSON.stringify(key)}`);
@@ -67,6 +69,9 @@ function validateVaultGuardConfig(value) {
             errors.push('entropy_threshold must be a finite number');
         }
     }
+    if (o.fail_on !== undefined && !(0, fail_on_1.isFailOnThreshold)(o.fail_on)) {
+        errors.push('fail_on must be critical|high|medium|low|none');
+    }
     if (o.extra_patterns !== undefined) {
         if (!Array.isArray(o.extra_patterns)) {
             errors.push('extra_patterns must be an array');

package/dist/config.d.ts

@@ -1,4 +1,5 @@
 import { SecretMatch } from './types';
+import type { FailOnThreshold } from './utils/fail-on';
 /**
  * Shape of .vault-guard.json in a repository root.
  *
@@ -40,6 +41,13 @@ export interface VaultGuardConfig {
      * generic catch-all patterns.  Lower = more matches but more false positives.
      */
     entropy_threshold?: number;
+    /**
+     * Minimum severity that fails the scan (non-zero exit). Findings below the
+     * threshold are still reported in text/JSON/SARIF, they just do not break
+     * the build. `"none"` reports everything and never fails, for advisory
+     * rollouts. Defaults to `"medium"`; overridden by `--fail-on`.
+     */
+    fail_on?: FailOnThreshold;
 }
 /**
  * Directories searched for `.vault-guard.json` / baseline files, in order

package/dist/index.d.ts

@@ -9,8 +9,9 @@ export { fingerprintForMatch } from './match-fingerprint';
 export * from './scan-output';
 export * from './diagnostics';
 export { shannonEntropy, DEFAULT_ENTROPY_THRESHOLD } from './utils/entropy';
-export { isPlaceholderSecret, isNonSecretConnectionString, isSampleJwt, isRedactedTemplateValue, isEnvVarNameToken } from './utils/placeholder';
-export { getGitStagedFilePaths, isInsideGitWorkTree } from './utils/git-utils';
+export { isPlaceholderSecret, isNonSecretConnectionString, isSampleJwt, isRedactedTemplateValue, isEnvVarNameToken, isCodeIdentifierReference, isPasswordHash, isPemHeaderWithoutBody } from './utils/placeholder';
+export { getGitStagedFilePaths, readGitIndexFile, isInsideGitWorkTree } from './utils/git-utils';
 export { validateRegexSafety, validateRegexLength, mapRegexSafetyReasonToDiagnosticCode, mapPatternRejectionReasonToDiagnosticCode, REGEX_REASON_TO_DIAGNOSTIC_CODE, REGEX_MAX_LENGTH, REGEX_MAX_QUANTIFIERS, } from './utils/regex-safety';
 export { scanTextFileAsync, scanTextFileSync } from './utils/scan-file';
-export { applyPathAwareSeverity, isTestFilePath } from './utils/path-severity';
+export { applyPathAwareSeverity, isTestFilePath, isLocalePath } from './utils/path-severity';
+export { DEFAULT_FAIL_ON, FAIL_ON_VALUES, isFailOnThreshold, meetsFailThreshold, countBlockingMatches, resolveFailOn, type FailOnThreshold, } from './utils/fail-on';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isTestFilePath = exports.applyPathAwareSeverity = exports.scanTextFileSync = exports.scanTextFileAsync = exports.REGEX_MAX_QUANTIFIERS = exports.REGEX_MAX_LENGTH = exports.REGEX_REASON_TO_DIAGNOSTIC_CODE = exports.mapPatternRejectionReasonToDiagnosticCode = exports.mapRegexSafetyReasonToDiagnosticCode = exports.validateRegexLength = exports.validateRegexSafety = exports.isInsideGitWorkTree = exports.getGitStagedFilePaths = exports.isEnvVarNameToken = exports.isRedactedTemplateValue = exports.isSampleJwt = exports.isNonSecretConnectionString = exports.isPlaceholderSecret = exports.DEFAULT_ENTROPY_THRESHOLD = exports.shannonEntropy = exports.fingerprintForMatch = void 0;
+exports.resolveFailOn = exports.countBlockingMatches = exports.meetsFailThreshold = exports.isFailOnThreshold = exports.FAIL_ON_VALUES = exports.DEFAULT_FAIL_ON = exports.isLocalePath = exports.isTestFilePath = exports.applyPathAwareSeverity = exports.scanTextFileSync = exports.scanTextFileAsync = exports.REGEX_MAX_QUANTIFIERS = exports.REGEX_MAX_LENGTH = exports.REGEX_REASON_TO_DIAGNOSTIC_CODE = exports.mapPatternRejectionReasonToDiagnosticCode = exports.mapRegexSafetyReasonToDiagnosticCode = exports.validateRegexLength = exports.validateRegexSafety = exports.isInsideGitWorkTree = exports.readGitIndexFile = exports.getGitStagedFilePaths = exports.isPemHeaderWithoutBody = exports.isPasswordHash = exports.isCodeIdentifierReference = exports.isEnvVarNameToken = exports.isRedactedTemplateValue = exports.isSampleJwt = exports.isNonSecretConnectionString = exports.isPlaceholderSecret = exports.DEFAULT_ENTROPY_THRESHOLD = exports.shannonEntropy = exports.fingerprintForMatch = void 0;
 __exportStar(require("./types"), exports);
 __exportStar(require("./errors"), exports);
 __exportStar(require("./scanners"), exports);
@@ -35,8 +35,12 @@ Object.defineProperty(exports, "isNonSecretConnectionString", { enumerable: true
 Object.defineProperty(exports, "isSampleJwt", { enumerable: true, get: function () { return placeholder_1.isSampleJwt; } });
 Object.defineProperty(exports, "isRedactedTemplateValue", { enumerable: true, get: function () { return placeholder_1.isRedactedTemplateValue; } });
 Object.defineProperty(exports, "isEnvVarNameToken", { enumerable: true, get: function () { return placeholder_1.isEnvVarNameToken; } });
+Object.defineProperty(exports, "isCodeIdentifierReference", { enumerable: true, get: function () { return placeholder_1.isCodeIdentifierReference; } });
+Object.defineProperty(exports, "isPasswordHash", { enumerable: true, get: function () { return placeholder_1.isPasswordHash; } });
+Object.defineProperty(exports, "isPemHeaderWithoutBody", { enumerable: true, get: function () { return placeholder_1.isPemHeaderWithoutBody; } });
 var git_utils_1 = require("./utils/git-utils");
 Object.defineProperty(exports, "getGitStagedFilePaths", { enumerable: true, get: function () { return git_utils_1.getGitStagedFilePaths; } });
+Object.defineProperty(exports, "readGitIndexFile", { enumerable: true, get: function () { return git_utils_1.readGitIndexFile; } });
 Object.defineProperty(exports, "isInsideGitWorkTree", { enumerable: true, get: function () { return git_utils_1.isInsideGitWorkTree; } });
 var regex_safety_1 = require("./utils/regex-safety");
 Object.defineProperty(exports, "validateRegexSafety", { enumerable: true, get: function () { return regex_safety_1.validateRegexSafety; } });
@@ -52,3 +56,11 @@ Object.defineProperty(exports, "scanTextFileSync", { enumerable: true, get: func
 var path_severity_1 = require("./utils/path-severity");
 Object.defineProperty(exports, "applyPathAwareSeverity", { enumerable: true, get: function () { return path_severity_1.applyPathAwareSeverity; } });
 Object.defineProperty(exports, "isTestFilePath", { enumerable: true, get: function () { return path_severity_1.isTestFilePath; } });
+Object.defineProperty(exports, "isLocalePath", { enumerable: true, get: function () { return path_severity_1.isLocalePath; } });
+var fail_on_1 = require("./utils/fail-on");
+Object.defineProperty(exports, "DEFAULT_FAIL_ON", { enumerable: true, get: function () { return fail_on_1.DEFAULT_FAIL_ON; } });
+Object.defineProperty(exports, "FAIL_ON_VALUES", { enumerable: true, get: function () { return fail_on_1.FAIL_ON_VALUES; } });
+Object.defineProperty(exports, "isFailOnThreshold", { enumerable: true, get: function () { return fail_on_1.isFailOnThreshold; } });
+Object.defineProperty(exports, "meetsFailThreshold", { enumerable: true, get: function () { return fail_on_1.meetsFailThreshold; } });
+Object.defineProperty(exports, "countBlockingMatches", { enumerable: true, get: function () { return fail_on_1.countBlockingMatches; } });
+Object.defineProperty(exports, "resolveFailOn", { enumerable: true, get: function () { return fail_on_1.resolveFailOn; } });

package/dist/scan-output.d.ts

@@ -17,6 +17,14 @@ export interface JsonRunMetadata {
     diagnostics_count?: number;
     /** Matches removed because they appeared in `.vault-guard.baseline.json`. */
     baseline_suppressed?: number;
+    /** Effective gate threshold for this run (`--fail-on` / `fail_on` / default). */
+    fail_on?: string;
+    /**
+     * Matches at or above {@link fail_on}. This, not the total match count, is
+     * what drives the process exit code; integrators gating a build should read
+     * this field rather than `summary.secrets`.
+     */
+    blocking_matches?: number;
 }
 export interface JsonOutput {
     version: string;

package/dist/scanners/pre-commit-hook.d.ts

@@ -18,6 +18,10 @@ export declare class PreCommitHook {
      * Absolute path to the \`pre-commit\` hook file for the given manager.
      */
     getPreCommitHookPath(cwd: string, manager?: HookManager): string;
+    /**
+     * Absolute path to the Windows \`pre-commit.cmd\` companion (native manager only).
+     */
+    getPreCommitCmdPath(cwd: string): string;
     install(options?: InstallHookOptions): {
         success: boolean;
         message: string;
@@ -28,6 +32,12 @@ export declare class PreCommitHook {
         message: string;
     };
     isInstalled(options?: InstallHookOptions): boolean;
+    /**
+     * Write or refresh our `pre-commit.cmd`. Never overwrites a foreign file.
+     * @returns whether our companion is present afterwards
+     */
+    private writeNativeCmdCompanion;
+    private removeNativeCmdCompanion;
     private installNative;
     private uninstallNative;
     private installHusky;

package/dist/scanners/pre-commit-hook.js

@@ -16,8 +16,16 @@ const NATIVE_HOOK_SCRIPT = `#!/bin/sh
 # vault-guard pre-commit (installed by @vaultcompass/vault-guard)
 set -e
 
-# Re-attach stdin for GUI git clients.
-if [ -t 0 ]; then :; else exec </dev/tty 2>/dev/null || true; fi
+# Re-attach stdin for GUI git clients when possible.
+# dash (Ubuntu /bin/sh) exits the whole shell on a failed \`exec </dev/tty\`
+# even with \`|| true\` / \`set +e\` — exit status 2. Probe in a subshell first;
+# only \`exec\` in the current shell when that open succeeds. \`[ -r /dev/tty ]\`
+# is not a usable guard: the node can exist and still fail open with ENXIO.
+if [ ! -t 0 ]; then
+  if (exec </dev/tty) 2>/dev/null; then
+    exec </dev/tty
+  fi
+fi
 
 if ! command -v vault-guard >/dev/null 2>&1; then
   echo "❌ vault-guard: command not found (install: npm i -g @vaultcompass/vault-guard)"
@@ -35,6 +43,30 @@ echo "❌ COMMIT BLOCKED: secrets detected in staged files"
 echo "💡 Fix or unstage, then retry. Emergency bypass (discouraged): git commit --no-verify"
 exit 1
 `;
+/**
+ * Optional `pre-commit.cmd` beside the POSIX hook. Git for Windows runs the
+ * extensionless `pre-commit` via sh; a few clients may invoke `.cmd` directly.
+ */
+const NATIVE_HOOK_CMD = `@echo off
+REM vault-guard pre-commit (installed by @vaultcompass/vault-guard)
+where vault-guard >nul 2>&1
+if errorlevel 1 (
+  echo ❌ vault-guard: command not found ^(install: npm i -g @vaultcompass/vault-guard^)
+  exit /b 1
+)
+
+echo 🔍 vault-guard: scanning staged files...
+call vault-guard scan --staged
+if errorlevel 1 (
+  echo.
+  echo ❌ COMMIT BLOCKED: secrets detected in staged files
+  echo 💡 Fix or unstage, then retry. Emergency bypass ^(discouraged^): git commit --no-verify
+  exit /b 1
+)
+
+echo ✅ vault-guard: no secrets in staged files
+exit /b 0
+`;
 /** Husky-friendly hook (sources \`_/husky.sh\` when present). */
 const HUSKY_HOOK_SCRIPT = `#!/usr/bin/env sh
 if [ -f "$(dirname "$0")/_/husky.sh" ]; then
@@ -110,6 +142,12 @@ class PreCommitHook {
         }
         return path_1.default.join(this.getEffectiveHooksDir(cwd).hooksDir, 'pre-commit');
     }
+    /**
+     * Absolute path to the Windows \`pre-commit.cmd\` companion (native manager only).
+     */
+    getPreCommitCmdPath(cwd) {
+        return path_1.default.join(this.getEffectiveHooksDir(cwd).hooksDir, 'pre-commit.cmd');
+    }
     install(options = {}) {
         const cwd = options.cwd ?? process.cwd();
         const manager = options.manager ?? 'native';
@@ -160,9 +198,37 @@ class PreCommitHook {
     // -------------------------------------------------------------------------
     // native (Git hooks / core.hooksPath)
     // -------------------------------------------------------------------------
+    /**
+     * Write or refresh our `pre-commit.cmd`. Never overwrites a foreign file.
+     * @returns whether our companion is present afterwards
+     */
+    writeNativeCmdCompanion(hooksDir) {
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
+        if (fs_1.default.existsSync(cmdPath)) {
+            const existing = fs_1.default.readFileSync(cmdPath, 'utf-8');
+            const isOurs = existing.includes('vault-guard') && existing.includes('scan --staged');
+            if (!isOurs) {
+                return false;
+            }
+        }
+        fs_1.default.writeFileSync(cmdPath, NATIVE_HOOK_CMD, { encoding: 'utf-8' });
+        return true;
+    }
+    removeNativeCmdCompanion(hooksDir) {
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
+        if (!fs_1.default.existsSync(cmdPath))
+            return false;
+        const content = fs_1.default.readFileSync(cmdPath, 'utf-8');
+        if (!content.includes('vault-guard') || !content.includes('scan --staged')) {
+            return false;
+        }
+        fs_1.default.unlinkSync(cmdPath);
+        return true;
+    }
     installNative(cwd) {
         const { hooksDir, viaHooksPath } = this.getEffectiveHooksDir(cwd);
         const hookPath = path_1.default.join(hooksDir, 'pre-commit');
+        const cmdPath = path_1.default.join(hooksDir, 'pre-commit.cmd');
         try {
             if (!fs_1.default.existsSync(hooksDir)) {
                 fs_1.default.mkdirSync(hooksDir, { recursive: true });
@@ -170,18 +236,31 @@ class PreCommitHook {
             if (fs_1.default.existsSync(hookPath)) {
                 const existing = fs_1.default.readFileSync(hookPath, 'utf-8');
                 if (existing.includes('vault-guard') && existing.includes('scan --staged')) {
+                    // Refresh the Windows companion if missing or stale (never clobber foreign).
+                    const cmdOk = this.writeNativeCmdCompanion(hooksDir);
                     return {
                         success: true,
-                        message: 'Hook already installed',
+                        message: cmdOk
+                            ? 'Hook already installed (POSIX + Windows .cmd companion)'
+                            : fs_1.default.existsSync(cmdPath)
+                                ? 'Hook already installed (left foreign pre-commit.cmd untouched)'
+                                : 'Hook already installed',
                         hookPath,
                     };
                 }
             }
             fs_1.default.writeFileSync(hookPath, NATIVE_HOOK_SCRIPT, { mode: 0o755 });
+            const cmdOk = this.writeNativeCmdCompanion(hooksDir);
             const hint = viaHooksPath
                 ? `Installed to hooksPath: ${hooksDir}`
-                : 'Installed to .git/hooks/pre-commit';
-            return { success: true, message: `Pre-commit hook installed (${hint})`, hookPath };
+                : cmdOk
+                    ? 'Installed to .git/hooks/pre-commit (+ pre-commit.cmd)'
+                    : 'Installed to .git/hooks/pre-commit';
+            return {
+                success: true,
+                message: `Pre-commit hook installed (${hint})`,
+                hookPath,
+            };
         }
         catch (error) {
             const hookError = new errors_1.HookError(`Failed to install hook: ${error}`, 'install');
@@ -189,17 +268,34 @@ class PreCommitHook {
         }
     }
     uninstallNative(cwd) {
-        const hookPath = this.getPreCommitHookPath(cwd, 'native');
+        const { hooksDir } = this.getEffectiveHooksDir(cwd);
+        const hookPath = path_1.default.join(hooksDir, 'pre-commit');
+        const cmdRemoved = this.removeNativeCmdCompanion(hooksDir);
         if (!fs_1.default.existsSync(hookPath)) {
-            return { success: true, message: 'No hook to remove' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Removed Windows pre-commit.cmd companion'
+                    : 'No hook to remove',
+            };
         }
         const content = fs_1.default.readFileSync(hookPath, 'utf-8');
         if (!content.includes('vault-guard')) {
-            return { success: true, message: 'No vault-guard hook to remove' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Removed Windows pre-commit.cmd companion'
+                    : 'No vault-guard hook to remove',
+            };
         }
         try {
             fs_1.default.unlinkSync(hookPath);
-            return { success: true, message: 'Pre-commit hook removed' };
+            return {
+                success: true,
+                message: cmdRemoved
+                    ? 'Pre-commit hook and Windows .cmd companion removed'
+                    : 'Pre-commit hook removed',
+            };
         }
         catch (error) {
             const hookError = new errors_1.HookError(`Failed to remove hook: ${error}`, 'uninstall');

package/dist/scanners/secret-scanner.js

@@ -47,7 +47,26 @@ const BUILTIN_PATTERNS = new Map([
     ['openai', { regex: /(?<![A-Za-z0-9_-])sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20,}/g, severity: 'critical' }],
     ['huggingface', { regex: /hf_[a-zA-Z0-9]{34,}/g, severity: 'critical' }],
     ['replicate', { regex: /r8_[a-zA-Z0-9]{32}/g, severity: 'critical' }],
+    // Post-2023 AI provider keys. The product's stated wedge is AI-assisted
+    // coding, so these carry the same weight as the OpenAI/Anthropic rules.
+    // Every one is prefix-anchored with a fixed length, so no entropy gate is
+    // needed (same precision profile as `ghp_` / `hf_`).
+    ['groq', { regex: /(?<![A-Za-z0-9_-])gsk_[a-zA-Z0-9]{52}/g, severity: 'critical' }],
+    ['openrouter', { regex: /sk-or-v1-[a-f0-9]{64}/g, severity: 'critical' }],
+    ['xai', { regex: /(?<![A-Za-z0-9_-])xai-[a-zA-Z0-9]{80}/g, severity: 'critical' }],
+    ['perplexity', { regex: /(?<![A-Za-z0-9_-])pplx-[a-zA-Z0-9]{40,}/g, severity: 'critical' }],
+    ['mistral', { regex: /(?:mistral_api_key|MISTRAL_API_KEY)\s*[=:]\s*["']?([a-zA-Z0-9]{32})/g, severity: 'critical' }],
+    ['together-ai', { regex: /(?:together_api_key|TOGETHER_API_KEY)\s*[=:]\s*["']?([a-f0-9]{64})/g, severity: 'critical' }],
+    ['fireworks-ai', { regex: /(?<![A-Za-z0-9_-])fw_[a-zA-Z0-9]{24,}/g, severity: 'critical' }],
+    ['langsmith', { regex: /lsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}/g, severity: 'critical' }],
+    ['deepseek', { regex: /(?:deepseek_api_key|DEEPSEEK_API_KEY)\s*[=:]\s*["']?(sk-[a-f0-9]{32})/g, severity: 'critical' }],
     // --- Payment processors ---
+    // NOTE: `sk_live_` / `sk_test_` are not unique to Stripe — Clerk uses the
+    // same prefixes and there is no reliable discriminator in the key body, so a
+    // Clerk secret key is reported under the `stripe` rule id. The finding is
+    // correct (it IS a live secret key); only the vendor label may be wrong. The
+    // id is kept as-is because baseline fingerprints include the rule id and
+    // renaming it would silently invalidate every existing baseline entry.
     ['stripe', { regex: /sk_live_[a-zA-Z0-9]{24,}/g, severity: 'critical' }],
     ['stripe-test', { regex: /sk_test_[a-zA-Z0-9]{24,}/g, severity: 'high' }],
     ['paypal', { regex: /access_token\$production\$[a-zA-Z0-9]{20,}/g, severity: 'critical' }],
@@ -87,12 +106,34 @@ const BUILTIN_PATTERNS = new Map([
     ['mailgun-api', { regex: /key-[a-zA-Z0-9]{32}/g, severity: 'critical', minEntropy: 3.5 }],
     // --- Package managers ---
     ['npm-token', { regex: /npm_[a-zA-Z0-9]{36}/g, severity: 'critical' }],
+    // --- Backend / infra platforms ---
+    ['supabase-token', { regex: /(?<![A-Za-z0-9_-])sbp_[a-f0-9]{40}/g, severity: 'critical' }],
+    ['supabase-secret', { regex: /(?<![A-Za-z0-9_-])sb_secret_[a-zA-Z0-9_-]{20,}/g, severity: 'critical' }],
+    ['vercel-blob', { regex: /vercel_blob_rw_[a-zA-Z0-9]{20,}_[a-zA-Z0-9]{20,}/g, severity: 'critical' }],
+    ['planetscale', { regex: /pscale_(?:tkn|pw)_[a-zA-Z0-9_-]{32,}/g, severity: 'critical' }],
+    ['doppler-token', { regex: /dp\.(?:pt|st|sa|scim|audit)\.[a-zA-Z0-9]{40,}/g, severity: 'critical' }],
+    ['databricks-token', { regex: /(?<![A-Za-z0-9_-])dapi[a-f0-9]{32}/g, severity: 'critical' }],
+    ['cloudflare-token', { regex: /(?:cloudflare_api_token|CLOUDFLARE_API_TOKEN)\s*[=:]\s*["']?([a-zA-Z0-9_-]{40})/g, severity: 'critical' }],
+    // --- SaaS / productivity ---
+    ['notion-token', { regex: /(?<![A-Za-z0-9_-])(?:ntn_[a-zA-Z0-9]{40,}|secret_[a-zA-Z0-9]{43})/g, severity: 'critical' }],
+    ['airtable-pat', { regex: /(?<![A-Za-z0-9_-])pat[a-zA-Z0-9]{14}\.[a-f0-9]{64}/g, severity: 'critical' }],
+    ['figma-token', { regex: /(?<![A-Za-z0-9_-])figd_[a-zA-Z0-9_-]{40,}/g, severity: 'critical' }],
     // --- Monitoring ---
     ['newrelic-api', { regex: /NRAK-[a-zA-Z0-9]{26}/g, severity: 'critical' }],
+    // A Sentry DSN is designed to be embedded in client-side bundles — the
+    // public key it carries only permits event ingestion, not data read. Kept at
+    // `low` for visibility under the same policy as `gcp-oauth`: real, but not a
+    // credential leak worth blocking a commit over.
+    ['sentry-dsn', { regex: /https:\/\/[a-f0-9]{32}@o\d+\.ingest\.(?:[a-z]{2}\.)?sentry\.io\/\d+/g, severity: 'low' }],
     // --- E-commerce ---
     ['shopify-admin', { regex: /shp(?:ss|at|ca)_[a-zA-Z0-9]{32}/g, severity: 'critical' }],
     // --- Keys and auth tokens ---
-    ['ssh-private-key', { regex: /-----BEGIN [A-Z ]+ PRIVATE KEY-----/g, severity: 'critical' }],
+    // The algorithm prefix is optional. `-----BEGIN PRIVATE KEY-----` (PKCS#8)
+    // has no prefix at all, and it is what modern OpenSSL emits by default and
+    // what GCP service-account JSON embeds — i.e. the most common private key
+    // form in circulation. Requiring `[A-Z ]+` between BEGIN and PRIVATE meant
+    // the scanner printed "No secrets found" on a bare PKCS#8 key file.
+    ['ssh-private-key', { regex: /-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----/g, severity: 'critical' }],
     ['jwt-token', { regex: /eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g, severity: 'high' }],
     // Generic patterns — entropy-gated AND placeholder-filtered (aggressive) to
     // suppress false positives on documentation samples and unit-test fixtures.
@@ -292,6 +333,17 @@ class SecretScanner {
                 if (type === 'jwt-token' && (0, placeholder_1.isSampleJwt)(fullMatch)) {
                     continue;
                 }
+                // A password hash is the safe-at-rest form, not a usable credential.
+                // Seed data and fixtures are full of bcrypt/argon2 digests.
+                if (type === 'password-in-code' && (0, placeholder_1.isPasswordHash)(rawValue)) {
+                    continue;
+                }
+                // A bare PEM header with no key material after it is a UI label or an
+                // input placeholder, not a leaked key.
+                if (type === 'ssh-private-key' &&
+                    (0, placeholder_1.isPemHeaderWithoutBody)(content, match.index + fullMatch.length)) {
+                    continue;
+                }
                 // Suppress unquoted assignments whose "value" is actually a function
                 // call — e.g. `csrf_secret = _add_new_csrf_cookie(request)`. The value
                 // capture group stops at `(`, so a `(` immediately following the match
@@ -303,6 +355,19 @@ class SecretScanner {
                     content[match.index + fullMatch.length] === '(') {
                     continue;
                 }
+                // Suppress unquoted assignments whose "value" is a bare reference to
+                // another identifier — e.g. `'x-api-key': scheduledIngestApiKey`. Only
+                // applies when the captured value was NOT wrapped in quotes: a quoted
+                // string is a literal, and literals are what we are hunting. Scoped to
+                // the low-precision generic assignment patterns.
+                if (GENERIC_ASSIGNMENT_IDS.has(type) && match[1] !== undefined) {
+                    const valueStart = fullMatch.lastIndexOf(rawValue);
+                    const charBefore = valueStart > 0 ? fullMatch[valueStart - 1] : '';
+                    const quoted = charBefore === '"' || charBefore === "'";
+                    if (!quoted && (0, placeholder_1.isCodeIdentifierReference)(rawValue)) {
+                        continue;
+                    }
+                }
                 const line = this.lineFromIndex(lineIndex, match.index);
                 const lineContent = this.lineContentAt(content, lineIndex, line);
                 if (opts?.filePath &&

package/dist/scanners/token-counter.js

@@ -96,8 +96,9 @@ class TokenCounter {
         return ['.png', '.jpg', '.jpeg', '.gif', '.pdf', '.zip', '.lock', '.log'].includes(ext);
     }
     getExtension(filePath) {
-        const parts = filePath.split('.');
-        return parts.length > 1 ? `.${parts[parts.length - 1]}` : '(no ext)';
+        // Use basename so parent dirs with '.' (e.g. macOS temp paths) are ignored.
+        const ext = path_1.default.extname(path_1.default.basename(filePath));
+        return ext.length > 0 ? ext : '(no ext)';
     }
 }
 exports.TokenCounter = TokenCounter;

package/dist/utils/fail-on.d.ts

@@ -0,0 +1,47 @@
+import type { SecretMatch } from '../types';
+import type { FileScanResult } from '../scan-output';
+/**
+ * Severity threshold at or above which a finding makes the scan **fail**
+ * (non-zero exit). `'none'` never fails the gate — findings are still
+ * reported, which is the right mode for an advisory / observe-only rollout.
+ */
+export type FailOnThreshold = SecretMatch['severity'] | 'none';
+/**
+ * Default gate threshold.
+ *
+ * `medium` (not `low`) because the scanner deliberately downgrades findings to
+ * `low` in exactly the places where they are not real leaks:
+ *
+ *   - `path-severity.ts` downgrades generic patterns inside test / fixture /
+ *     docs / `*.example` paths;
+ *   - public identifiers that are documented as safe to embed (`gcp-oauth`)
+ *     are `low` by definition.
+ *
+ * Blocking a commit on those was the dominant real-world complaint: the
+ * downgrade existed but bought the user nothing because any match at all
+ * returned exit 1. Findings below the threshold are still printed and still
+ * appear in JSON / SARIF; they just do not fail the build.
+ */
+export declare const DEFAULT_FAIL_ON: FailOnThreshold;
+/** Accepted `--fail-on` / `fail_on` values, in descending strictness. */
+export declare const FAIL_ON_VALUES: readonly FailOnThreshold[];
+export declare function isFailOnThreshold(v: unknown): v is FailOnThreshold;
+/** True when `severity` is at or above the gate `threshold`. */
+export declare function meetsFailThreshold(severity: SecretMatch['severity'], threshold: FailOnThreshold): boolean;
+/**
+ * Count findings at or above `threshold` across scan results. A non-zero
+ * count is what drives the CLI exit code; the full result set is still what
+ * gets displayed and serialized.
+ */
+export declare function countBlockingMatches(results: FileScanResult[], threshold: FailOnThreshold): number;
+/**
+ * Resolve the effective threshold from (highest priority first) the CLI flag,
+ * the repo config, then {@link DEFAULT_FAIL_ON}.
+ */
+export declare function resolveFailOn(flagValue: string | undefined, configValue: unknown): {
+    ok: true;
+    threshold: FailOnThreshold;
+} | {
+    ok: false;
+    invalid: string;
+};

package/dist/utils/fail-on.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FAIL_ON_VALUES = exports.DEFAULT_FAIL_ON = void 0;
+exports.isFailOnThreshold = isFailOnThreshold;
+exports.meetsFailThreshold = meetsFailThreshold;
+exports.countBlockingMatches = countBlockingMatches;
+exports.resolveFailOn = resolveFailOn;
+/**
+ * Default gate threshold.
+ *
+ * `medium` (not `low`) because the scanner deliberately downgrades findings to
+ * `low` in exactly the places where they are not real leaks:
+ *
+ *   - `path-severity.ts` downgrades generic patterns inside test / fixture /
+ *     docs / `*.example` paths;
+ *   - public identifiers that are documented as safe to embed (`gcp-oauth`)
+ *     are `low` by definition.
+ *
+ * Blocking a commit on those was the dominant real-world complaint: the
+ * downgrade existed but bought the user nothing because any match at all
+ * returned exit 1. Findings below the threshold are still printed and still
+ * appear in JSON / SARIF; they just do not fail the build.
+ */
+exports.DEFAULT_FAIL_ON = 'medium';
+const SEVERITY_RANK = {
+    critical: 4,
+    high: 3,
+    medium: 2,
+    low: 1,
+};
+/** Accepted `--fail-on` / `fail_on` values, in descending strictness. */
+exports.FAIL_ON_VALUES = [
+    'low',
+    'medium',
+    'high',
+    'critical',
+    'none',
+];
+function isFailOnThreshold(v) {
+    return typeof v === 'string' && exports.FAIL_ON_VALUES.includes(v);
+}
+/** True when `severity` is at or above the gate `threshold`. */
+function meetsFailThreshold(severity, threshold) {
+    if (threshold === 'none')
+        return false;
+    return SEVERITY_RANK[severity] >= SEVERITY_RANK[threshold];
+}
+/**
+ * Count findings at or above `threshold` across scan results. A non-zero
+ * count is what drives the CLI exit code; the full result set is still what
+ * gets displayed and serialized.
+ */
+function countBlockingMatches(results, threshold) {
+    let n = 0;
+    for (const r of results) {
+        for (const m of r.matches) {
+            if (meetsFailThreshold(m.severity, threshold))
+                n++;
+        }
+    }
+    return n;
+}
+/**
+ * Resolve the effective threshold from (highest priority first) the CLI flag,
+ * the repo config, then {@link DEFAULT_FAIL_ON}.
+ */
+function resolveFailOn(flagValue, configValue) {
+    if (flagValue !== undefined) {
+        if (!isFailOnThreshold(flagValue))
+            return { ok: false, invalid: flagValue };
+        return { ok: true, threshold: flagValue };
+    }
+    if (configValue !== undefined) {
+        if (!isFailOnThreshold(configValue))
+            return { ok: false, invalid: String(configValue) };
+        return { ok: true, threshold: configValue };
+    }
+    return { ok: true, threshold: exports.DEFAULT_FAIL_ON };
+}

package/dist/utils/git-utils.d.ts

@@ -1,11 +1,20 @@
 /**
  * Return absolute paths of files staged for commit (cached index vs HEAD).
- * Excludes deleted paths; only returns paths that still exist on disk.
+ *
+ * Uses `--diff-filter=ACMRT` so deleted index entries are excluded, but
+ * **does not** require the path to exist in the worktree. A staged add that
+ * was later deleted from disk (`AD` in `git status`) still appears — that
+ * blob will be committed and must be scanned.
  *
  * Throws `GitError` on git failure rather than returning an empty list.
  * Returning `[]` silently on git failure would produce a false "✅ nothing
  * staged" result in pre-commit, letting secrets through undetected.
  */
 export declare function getGitStagedFilePaths(cwd?: string): string[];
+/**
+ * Read a staged blob from the index (`git show :path`), not the worktree.
+ * `relativePath` may use OS separators; it is normalized to git's `/` form.
+ */
+export declare function readGitIndexFile(cwd: string, relativePath: string): string;
 /** True when `cwd` is inside a work tree with a `.git` directory or file. */
 export declare function isInsideGitWorkTree(cwd?: string): boolean;

package/dist/utils/git-utils.js

@@ -4,24 +4,28 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getGitStagedFilePaths = getGitStagedFilePaths;
+exports.readGitIndexFile = readGitIndexFile;
 exports.isInsideGitWorkTree = isInsideGitWorkTree;
 const child_process_1 = require("child_process");
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const errors_1 = require("../errors");
 /**
  * Return absolute paths of files staged for commit (cached index vs HEAD).
- * Excludes deleted paths; only returns paths that still exist on disk.
+ *
+ * Uses `--diff-filter=ACMRT` so deleted index entries are excluded, but
+ * **does not** require the path to exist in the worktree. A staged add that
+ * was later deleted from disk (`AD` in `git status`) still appears — that
+ * blob will be committed and must be scanned.
  *
  * Throws `GitError` on git failure rather than returning an empty list.
  * Returning `[]` silently on git failure would produce a false "✅ nothing
  * staged" result in pre-commit, letting secrets through undetected.
  */
 function getGitStagedFilePaths(cwd = process.cwd()) {
-    const cmd = 'git diff --cached --name-only --diff-filter=ACMRT';
+    const args = ['diff', '--cached', '--name-only', '--diff-filter=ACMRT', '-z'];
     let out;
     try {
-        out = (0, child_process_1.execSync)(cmd, {
+        out = (0, child_process_1.execFileSync)('git', args, {
             cwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],
@@ -29,19 +33,37 @@ function getGitStagedFilePaths(cwd = process.cwd()) {
     }
     catch (err) {
         throw new errors_1.GitError(`Failed to list staged files — is this a git repository? (cwd: ${cwd})\n` +
-            `Run 'git status' to verify.\nUnderlying error: ${String(err)}`, cmd, err);
+            `Run 'git status' to verify.\nUnderlying error: ${String(err)}`, `git ${args.join(' ')}`, err);
     }
     return out
-        .split('\n')
+        .split('\0')
         .map((line) => line.trim())
         .filter(Boolean)
-        .map((rel) => path_1.default.resolve(cwd, rel))
-        .filter((abs) => fs_1.default.existsSync(abs) && fs_1.default.statSync(abs).isFile());
+        .map((rel) => path_1.default.resolve(cwd, rel));
+}
+/**
+ * Read a staged blob from the index (`git show :path`), not the worktree.
+ * `relativePath` may use OS separators; it is normalized to git's `/` form.
+ */
+function readGitIndexFile(cwd, relativePath) {
+    const normalized = relativePath.split(path_1.default.sep).join('/');
+    const args = ['show', `:${normalized}`];
+    try {
+        return (0, child_process_1.execFileSync)('git', args, {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            maxBuffer: 32 * 1024 * 1024,
+        });
+    }
+    catch (err) {
+        throw new errors_1.GitError(`Failed to read staged blob for ${normalized}\nUnderlying error: ${String(err)}`, `git ${args.join(' ')}`, err);
+    }
 }
 /** True when `cwd` is inside a work tree with a `.git` directory or file. */
 function isInsideGitWorkTree(cwd = process.cwd()) {
     try {
-        (0, child_process_1.execSync)('git rev-parse --is-inside-work-tree', {
+        (0, child_process_1.execFileSync)('git', ['rev-parse', '--is-inside-work-tree'], {
             cwd,
             encoding: 'utf-8',
             stdio: ['ignore', 'pipe', 'pipe'],

package/dist/utils/path-severity.d.ts

@@ -1,4 +1,14 @@
 import type { SecretMatch } from '../types';
+/**
+ * True when a file is a translation catalogue.
+ *
+ * These are entirely natural-language strings keyed by identifiers, so a key
+ * such as `tfa_secret` or `api_key_label` puts a translated *label* where the
+ * generic assignment patterns expect a value — `tfa_secret: Zwei-Faktor-
+ * Authentifizierung` reads as a 29-character high-entropy secret. Translation
+ * files never hold real credentials.
+ */
+export declare function isLocalePath(filePath: string): boolean;
 /**
  * Return `true` when `filePath` looks like a test or fixture file.
  */

package/dist/utils/path-severity.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLocalePath = isLocalePath;
 exports.isTestFilePath = isTestFilePath;
 exports.applyPathAwareSeverity = applyPathAwareSeverity;
 const path_1 = __importDefault(require("path"));
@@ -37,7 +38,11 @@ const TEST_DIR_SEGMENTS = new Set([
     'tests',
     'test',
     'fixtures',
+    'fixture',
     'testdata',
+    'test-data',
+    'test_data',
+    'testfixtures',
     'spec',
     'e2e',
     'examples',
@@ -75,6 +80,35 @@ function isTestDirectorySegment(seg) {
         seg.length >= 7 &&
         !NON_TEST_TEST_SUFFIX_DIRS.has(seg));
 }
+/** Directory segments holding UI translation catalogues. */
+const LOCALE_DIR_SEGMENTS = new Set([
+    'locales',
+    'locale',
+    'translations',
+    'translation',
+    'i18n',
+    'lang',
+    'langs',
+]);
+/**
+ * Locale file basenames: `en.json`, `de-DE.yaml`, `pt_BR.yml`, `zh-Hant.json`.
+ */
+const LOCALE_BASENAME = /^[a-z]{2}(?:[-_][A-Za-z]{2,4})?\.(json|ya?ml|ts|js|po|properties)$/;
+/**
+ * True when a file is a translation catalogue.
+ *
+ * These are entirely natural-language strings keyed by identifiers, so a key
+ * such as `tfa_secret` or `api_key_label` puts a translated *label* where the
+ * generic assignment patterns expect a value — `tfa_secret: Zwei-Faktor-
+ * Authentifizierung` reads as a 29-character high-entropy secret. Translation
+ * files never hold real credentials.
+ */
+function isLocalePath(filePath) {
+    const parts = (0, path_parts_1.splitPathParts)(filePath);
+    if (parts.some(p => LOCALE_DIR_SEGMENTS.has(p.toLowerCase())))
+        return true;
+    return LOCALE_BASENAME.test(path_1.default.basename(filePath));
+}
 /**
  * Celery / Perl-style test root: `t/unit/…`, `t/integration/…`.
  */
@@ -112,7 +146,7 @@ function isTestFilePath(filePath) {
  * file is still worth a `critical` alert.
  */
 function isLowPrecisionContextPath(filePath) {
-    return isTestFilePath(filePath) || (0, doc_context_1.isDocumentationPath)(filePath);
+    return isTestFilePath(filePath) || (0, doc_context_1.isDocumentationPath)(filePath) || isLocalePath(filePath);
 }
 function applyPathAwareSeverity(matches, filePath) {
     if (matches.length === 0)

package/dist/utils/placeholder.d.ts

@@ -20,11 +20,61 @@
  * by chance.
  */
 export declare function isRedactedTemplateValue(value: string): boolean;
+/**
+ * A stored password *hash* is the safe-at-rest form of a credential, not a
+ * credential. Seed data, fixtures, and migration files are full of them, and
+ * flagging them as `password-in-code` is noise: rotating them is meaningless
+ * and they cannot be used to authenticate.
+ *
+ * Covers modular crypt format (bcrypt `$2a/2b/2y$`, sha-crypt `$1/5/6$`,
+ * yescrypt `$y$`, `$argon2i/d/id$`, `$pbkdf2-*$`) and the Django/Passlib
+ * `algo$iterations$salt$hash` convention.
+ */
+export declare function isPasswordHash(value: string): boolean;
+/**
+ * True when a PEM `-----BEGIN … PRIVATE KEY-----` header is not followed by
+ * any key material.
+ *
+ * UI code and documentation carry the header on its own as a label or an
+ * input placeholder (`const privateKeyBeginsWith = '-----BEGIN RSA PRIVATE
+ * KEY-----'`). A header with no body leaks nothing. Real PEM files wrap their
+ * base64 at 64 characters per line, so requiring a single long base64 run
+ * right after the header separates the two cleanly, and still works when the
+ * key is embedded in JSON with escaped newlines.
+ */
+export declare function isPemHeaderWithoutBody(content: string, headerEndOffset: number): boolean;
 /**
  * ALL_CAPS identifiers (e.g. `PLAID_TOKEN_ENCRYPTION_KEY`) are env-var names,
  * not secret values — common in GitHub Actions `secret:NAME` checks.
  */
 export declare function isEnvVarNameToken(value: string): boolean;
+/**
+ * True when an **unquoted** captured value is a reference to a code
+ * identifier rather than a literal credential — e.g.
+ *
+ *     headers: { 'x-api-key': scheduledIngestApiKey }
+ *     api_key = defaultServiceCredential
+ *
+ * The generic assignment patterns capture whatever follows `:`/`=`, and in
+ * real code that is very often a variable, not a secret. An existing check
+ * covers the function-call case (`= makeKey(...)`); this covers the far more
+ * common bare-reference case.
+ *
+ * Discriminator: generated credentials are random, so they mix digits into the
+ * alphabet and do not decompose into word-shaped segments. We require the
+ * value to split (on `_` and camelCase boundaries) into **two or more**
+ * segments that are each purely alphabetic and at least two characters long.
+ *
+ *   `scheduledIngestApiKey` → scheduled | Ingest | Api | Key  → identifier
+ *   `default_service_token` → default | service | token       → identifier
+ *   `x7Kf9mQ2pL8vB3nR5wT1`  → contains digits                 → NOT identifier
+ *   `qwertyuiopasdfghjklz`  → one segment                     → NOT identifier
+ *
+ * Callers must only apply this to unquoted values on low-precision generic
+ * patterns; a quoted string literal is a literal, and vendor-anchored rules
+ * must never be weakened by it.
+ */
+export declare function isCodeIdentifierReference(value: string): boolean;
 /**
  * Return `true` when a database/Redis connection string is **not** a real
  * credential leak — i.e. it targets a local/dev/docker/example host, or uses

package/dist/utils/placeholder.js

@@ -22,7 +22,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isRedactedTemplateValue = isRedactedTemplateValue;
+exports.isPasswordHash = isPasswordHash;
+exports.isPemHeaderWithoutBody = isPemHeaderWithoutBody;
 exports.isEnvVarNameToken = isEnvVarNameToken;
+exports.isCodeIdentifierReference = isCodeIdentifierReference;
 exports.isSampleJwt = isSampleJwt;
 exports.isNonSecretConnectionString = isNonSecretConnectionString;
 exports.isPlaceholderSecret = isPlaceholderSecret;
@@ -73,6 +76,7 @@ const AGGRESSIVE_MARKERS = [
     'qwerty',
     'letmein',
     'your_', // your_google_places_key, your_api_key_here
+    'your-', // your-anthropic-api-key — hyphen form is just as common in docs
 ];
 /** Known vendor key prefixes whose remainder is often redacted with X/* in docs. */
 const REDACTED_PREFIXES = [
@@ -109,6 +113,52 @@ function isRedactedTemplateValue(value) {
     }
     return false;
 }
+/**
+ * A stored password *hash* is the safe-at-rest form of a credential, not a
+ * credential. Seed data, fixtures, and migration files are full of them, and
+ * flagging them as `password-in-code` is noise: rotating them is meaningless
+ * and they cannot be used to authenticate.
+ *
+ * Covers modular crypt format (bcrypt `$2a/2b/2y$`, sha-crypt `$1/5/6$`,
+ * yescrypt `$y$`, `$argon2i/d/id$`, `$pbkdf2-*$`) and the Django/Passlib
+ * `algo$iterations$salt$hash` convention.
+ */
+function isPasswordHash(value) {
+    if (/^\$(?:2[abxy]?|1|5|6|7|y|gy|argon2(?:i|d|id)?|scrypt|pbkdf2(?:-[a-z0-9]+)?|sha1|md5|apr1|bcrypt)\$/i.test(value)) {
+        return true;
+    }
+    // Django: pbkdf2_sha256$390000$<salt>$<hash>, argon2$..., bcrypt_sha256$...
+    return /^(?:pbkdf2_[a-z0-9]+|argon2[a-z]*|bcrypt(?:_sha256)?|scrypt|sha1|md5|crypt|unsalted_[a-z0-9]+)\$\d*\$?/i.test(value);
+}
+/**
+ * True when a PEM `-----BEGIN … PRIVATE KEY-----` header is not followed by
+ * any key material.
+ *
+ * UI code and documentation carry the header on its own as a label or an
+ * input placeholder (`const privateKeyBeginsWith = '-----BEGIN RSA PRIVATE
+ * KEY-----'`). A header with no body leaks nothing. Real PEM files wrap their
+ * base64 at 64 characters per line, so requiring a single long base64 run
+ * right after the header separates the two cleanly, and still works when the
+ * key is embedded in JSON with escaped newlines.
+ */
+function isPemHeaderWithoutBody(content, headerEndOffset) {
+    const window = content.slice(headerEndOffset, headerEndOffset + 400);
+    // Split on real newlines and on the escaped `\n` used when a key is embedded
+    // in JSON or YAML, then strip the quoting that survives that embedding.
+    const lines = window.split(/\r?\n|\\r\\n|\\n/);
+    for (const line of lines) {
+        const token = line.replace(/["'`\\\s]/g, '');
+        // A PEM body wraps base64 at 64 characters, so a body line is base64 and
+        // nothing else. Requiring the *whole* line to match is what separates it
+        // from surrounding code: a long camelCase identifier such as
+        // `onUpdateDatasourceSecureJsonDataOption` is a valid base64 substring,
+        // but the line it sits on never is.
+        if (token.length >= 32 && /^[A-Za-z0-9+/]+={0,2}$/.test(token)) {
+            return false;
+        }
+    }
+    return true;
+}
 /**
  * ALL_CAPS identifiers (e.g. `PLAID_TOKEN_ENCRYPTION_KEY`) are env-var names,
  * not secret values — common in GitHub Actions `secret:NAME` checks.
@@ -116,6 +166,58 @@ function isRedactedTemplateValue(value) {
 function isEnvVarNameToken(value) {
     return /^[A-Z][A-Z0-9_]{7,}$/.test(value);
 }
+/**
+ * True when an **unquoted** captured value is a reference to a code
+ * identifier rather than a literal credential — e.g.
+ *
+ *     headers: { 'x-api-key': scheduledIngestApiKey }
+ *     api_key = defaultServiceCredential
+ *
+ * The generic assignment patterns capture whatever follows `:`/`=`, and in
+ * real code that is very often a variable, not a secret. An existing check
+ * covers the function-call case (`= makeKey(...)`); this covers the far more
+ * common bare-reference case.
+ *
+ * Discriminator: generated credentials are random, so they mix digits into the
+ * alphabet and do not decompose into word-shaped segments. We require the
+ * value to split (on `_` and camelCase boundaries) into **two or more**
+ * segments that are each purely alphabetic and at least two characters long.
+ *
+ *   `scheduledIngestApiKey` → scheduled | Ingest | Api | Key  → identifier
+ *   `default_service_token` → default | service | token       → identifier
+ *   `x7Kf9mQ2pL8vB3nR5wT1`  → contains digits                 → NOT identifier
+ *   `qwertyuiopasdfghjklz`  → one segment                     → NOT identifier
+ *
+ * Callers must only apply this to unquoted values on low-precision generic
+ * patterns; a quoted string literal is a literal, and vendor-anchored rules
+ * must never be weakened by it.
+ */
+function isCodeIdentifierReference(value) {
+    if (!/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(value))
+        return false;
+    if (/\d/.test(value))
+        return false;
+    const segments = value
+        .replace(/\$/g, '_')
+        .split('_')
+        .filter(s => s.length > 0)
+        .flatMap(part => part.split(/(?=[A-Z])/));
+    if (segments.length < 2)
+        return false;
+    if (!segments.every(s => s.length >= 2 && /^[A-Za-z]+$/.test(s)))
+        return false;
+    // Guard against alpha-only random keys with alternating capitals
+    // (`PmZkQvXtLdRwNbGhYuJcEaSf` splits into twelve 2-char "segments"). Real
+    // identifiers are made of words, so beyond a handful of segments the mean
+    // segment length stays word-like. Values of three segments or fewer are
+    // exempt: `myApiKey` is a legitimate identifier with short parts.
+    if (segments.length > 3) {
+        const mean = segments.reduce((n, s) => n + s.length, 0) / segments.length;
+        if (mean < 3)
+            return false;
+    }
+    return true;
+}
 /**
  * A value made of one or two distinct characters (e.g. `xxxxxxxx`, `00000000`)
  * is padding, never a real secret.
@@ -189,7 +291,12 @@ function isSampleJwt(token) {
     }
     return (/"sub"\s*:\s*"1234567890"/.test(payload) ||
         /"name"\s*:\s*"John Doe"/.test(payload) ||
-        /\b1516239022\b/.test(payload));
+        /\b1516239022\b/.test(payload) ||
+        // Supabase ships fixed anon / service_role keys for local development.
+        // They are printed by `supabase start`, published in Supabase's own docs,
+        // and signed with a well-known secret, so they appear verbatim in a large
+        // share of Supabase projects. Same category as the jwt.io sample.
+        /"iss"\s*:\s*"supabase-demo"/.test(payload));
 }
 function isNonSecretConnectionString(url) {
     const m = /^[a-z][a-z0-9+.-]*:\/\/([^:@/\s]+):([^@/\s]+)@([^:/?\s]+)/i.exec(url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vaultcompass/vault-guard-core",
-  "version": "1.2.3",
+  "version": "1.4.0",
   "description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",