Scan parsed secrets, not credential-shaped source syntax

Credential scanners over generated test reports can mistake source-code syntax for a literal secret. A broad pattern such as password:\s*<token-like text> may match a harmless property assignment whose value begins with an identifier. Prefer parsing known report/source formats or requiring literal-value evidence; if scanner changes are too risky during a release, refactor synthetic fixtures to shorthand construction while preserving behavior, then validate the exact scanner path. Do not globally exempt reports or weaken detection for actual literals.

Applies when: CI scans generated HTML, JSON, or archive evidence that embeds test source. Keywords: Playwright secret scanner false positive source code regex fixture CI