diff --git a/scripts/secrets.sh b/scripts/secrets.sh
index 868ab0a..1289aa8 100755
--- a/scripts/secrets.sh
+++ b/scripts/secrets.sh
@@ -170,7 +170,7 @@ PATTERNS=(
   # Anchored to the start of a line or an `export`, because unanchored it
   # matched `access_token = $1` in SQL and `apiKey=` in a property list — three
   # findings in src/ that were column names, not credentials.
-  '(^|export )[A-Z][A-Z0-9_]*(SECRET|TOKEN|PASSWORD|API_KEY|PASSWD)[A-Z0-9_]*=[^[:space:]"'"'"']{8,}'
+  '(^|[^A-Za-z0-9_])[A-Z0-9_]*(SECRET|TOKEN|PASSWORD|PASSWD|PASS|API_KEY)[A-Z0-9_]*=[^[:space:]"'"'"'$][^[:space:]"'"'"']{7,}'
   '-----BEGIN [A-Z ]*PRIVATE KEY-----'
   '\bghp_[A-Za-z0-9]{20,}'                              # GitHub
   '\bxox[baprs]-[A-Za-z0-9-]{10,}'                      # Slack
@@ -278,6 +278,16 @@ else
 fi
 
 if [ -z "$CONTENT" ]; then
+  # "Nothing to scan" means two different things and collapsing them makes a
+  # DELETE-ONLY COMMIT IMPOSSIBLE. In staged mode CONTENT is built from ADDED
+  # lines only, so a commit that only deletes has none — a correct measurement,
+  # not a failure to measure, because a deletion cannot introduce a credential.
+  # In tracked/built mode empty means nothing was examined at all, which IS the
+  # could-not-check state exit 2 exists to name.
+  if [ "$MODE" = "staged" ]; then
+    say "no added lines in $WHAT — a deletion cannot introduce a credential."
+    exit 0
+  fi
   say "nothing to scan in $WHAT."
   exit 2
 fi