Veto if any file contains what looks like a real, live credential committed
in plaintext: an API key, access token, private key (e.g. `-----BEGIN
PRIVATE KEY-----`), database connection string with an embedded password, or
a cloud provider secret. Do NOT veto placeholder values that are obviously
fake or documented as examples (e.g. `sk-xxx...`, `YOUR_API_KEY_HERE`,
`<token>`), references to environment variables (`os.environ["API_KEY"]`),
or secrets read from a config/secret-manager rather than embedded in source.
When uncertain whether a value is a real secret or a placeholder, do not veto.
