# The first entry, and the reasoning is the reason it is short.
#
# `generic-api-key` fired on a doc comment in ApprovalCard.tsx that wrote an i18n key as an EXAMPLE of
# a literal map's entry. The rule matches a keyword, a separator and a quoted token, then keeps the
# match only when the captured value's Shannon entropy is >= 3.5 — and that example scores 3.6818807.
# It is not a credential; it is the name of a test file, `src/lib/i18n.reachable.test.ts`.
#
# This file deliberately does NOT quote the offending text. Writing it out to explain it would
# reproduce the same shape one file over — which is what happened on the first attempt at this
# comment, and the scanner reported THIS file for it, at its own line 4.
#
# Rewording the comment (487dc73) cleans the TREE, which is necessary and not sufficient: the action
# scans a range of COMMITS (`--no-merges --first-parent base^..head`), so the finding still lives in
# 7190c2f, and that commit is inside the pull request's range. The `supply-chain` job goes red on the
# history, not on the tree.
#
# A fingerprint carries the commit SHA, so this exempts one finding in one commit. Measured against
# the pinned binary (8.30.1), each case with its own control:
#
#   synthetic leak, no entry           -> flagged   (the payload really is detectable)
#   synthetic leak, entry present      -> flagged   (the entry is NOT commit-wide)
#   same commit, other line            -> flagged   (the entry is NOT line-wide)
#   the historical finding, entry      -> silenced
#
# A new key-shaped string in this file is therefore still reported as usual. The test that pins this
# shape and this reason is tests/test_the_secret_scanner_is_told_which_finding_is_not_a_secret.py —
# an allowlist entry is silent, and that test is the only thing that will notice it going stale.
7190c2f9c663febb2b9ef4ed6207b12ee2bc41b4:apps/desktop/src/components/code/ApprovalCard.tsx:generic-api-key:128

# 2026-10-05 - four more, from the weekly full-history scan (run 37274192328), which reads every
# ref with `--all` and not just a pull request's range. All four are FAKE values written into tests
# and a bench precisely to check that a credential is redacted or never leaves: a bearer token that
# the access card must not echo, a provider key that the privacy card must not show, a Google-shaped
# key the diagnostics scrubber must mask (one line, two matches, one fingerprint), and the bait a
# hostile page asks the browser agent to send. Each was read and classified before being listed here;
# none is a key anyone was issued. The values are deliberately not repeated in this file.
#
# The three in 59b05e5 are tests still on main: their tree versions were rewritten in the same
# change that added these lines (a digest, a split literal, a value built at run time), so the
# fingerprints cover the history only. 957ff40 is NOT on main: it lives on the branch
# `bench/study24-browser-reads`, which the full-history scan reads because it scans every ref. That
# branch is not the one #566 merged (that was `-v2`) and may hold unmerged work, so it stays; this
# entry, not a deleted ref, is what keeps the finding quiet. main's copy of the file has a placeholder.
59b05e5ac5b670d1b01a319126f4c050dce861ea:tests/test_every_way_into_this_machine_is_on_one_card.py:generic-api-key:47
59b05e5ac5b670d1b01a319126f4c050dce861ea:tests/test_the_privacy_card_says_who_reads_your_prompts.py:generic-api-key:173
59b05e5ac5b670d1b01a319126f4c050dce861ea:tests/test_the_storage_and_diagnostics_routes_ask_before_removing_and_scrub_what_they_show.py:gcp-api-key:238
957ff402dee2a2e6cf04c6350421fd3601f796e9:bench/browser_taint_cards/run.py:generic-api-key:28
