The 2026-08-29 cross-project update of scripts/secrets.sh reached this
checkout as a working-tree edit and was never committed. For the twelve days
since, .githooks/pre-push refused every push, because a tracked file was
modified, so nothing else could land.
Committed as-is, by Null's decision, so the work that follows can push. What
the change does:
- the bare NAME=value pattern can now match. It was anchored to the start of
a line, and neither scan mode ever presents one: a staged diff starts every
line with "+", and --tracked prefixes each line with its file name.
- a commit that only deletes lines is no longer refused as a possible
credential. Staged mode reads added lines only, so "nothing to scan" there
is a correct measurement, not a failure to measure.
Known, and fixed in the next security commit (Batch 18): the new pattern
flags two comment lines, so `npm run verify` fails until then, and the
private-key pattern still never runs because grep is called without -e.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
7415e190e3