Scan parsed secrets, not credential-shaped source syntax
Credential scanners over generated test reports can mistake source-code syntax for a literal secret. A broad pattern such as `password:\s*<token-like text>` may match a harmless property assignment whose value begins with an identifier. Prefer parsing known report/source formats …