Secret exposure scanner

Known vendor formats are high confidence, not proof: a match means the string has the exact shape that vendor documents, so check it against your own code. The entropy findings are a heuristic and are labelled as one. Anything that already shipped to browsers, a bundle or a public repo, should be treated as public: rotate the credential rather than only deleting the file. Publishable keys are reported separately because they are designed to be public.