From the #746/748 sweep (sample read at lower confidence, recorded on #746 and not fixed by the comment/placeholder disposition in e8eebda):
machine-readable-design/harvested-registry/elixir/phoenix-service.ncl lines 286/315 — Secret found: Password — fires in harvested third-party reference material, which is by nature full of example credentials (harvested-registry/ is a corpus of other projects' manifests).
These are not the #748 placeholder class (the values are third-party examples, not template fillers), so the placeholder demotion does not cover them; demoting them to medium still produces permanent noise on every scan.
Suggested fix: a path-based exemption in Hypatia.ScannerSuppression's default exemption map for security_errors/secret_detected on harvested-registry/ (same mechanism and justification as the existing .audittraining/ training-corpus carve-out — the corpus IS example credentials). Scope it to the secret rules only, like benches/ is scoped to code_safety only: a real workflow leak elsewhere still fails the gate.
Per the standing ruling this is filed as an issue, not treated as a merge blocker of the #746/#748 fix.
From the #746/748 sweep (sample read at lower confidence, recorded on #746 and not fixed by the comment/placeholder disposition in e8eebda):
machine-readable-design/harvested-registry/elixir/phoenix-service.ncllines 286/315 —Secret found: Password— fires in harvested third-party reference material, which is by nature full of example credentials (harvested-registry/is a corpus of other projects' manifests).These are not the #748 placeholder class (the values are third-party examples, not template fillers), so the placeholder demotion does not cover them; demoting them to medium still produces permanent noise on every scan.
Suggested fix: a path-based exemption in
Hypatia.ScannerSuppression's default exemption map forsecurity_errors/secret_detectedonharvested-registry/(same mechanism and justification as the existing.audittraining/training-corpus carve-out — the corpus IS example credentials). Scope it to the secret rules only, likebenches/is scoped to code_safety only: a real workflow leak elsewhere still fails the gate.Per the standing ruling this is filed as an issue, not treated as a merge blocker of the #746/#748 fix.