feat: block secrets from indexing (deferred)

[Lucas-Bur]

What to build

Add a scanner-level regex filter that detects common secret patterns (API keys, tokens, private keys) before indexing. Files containing matches are skipped with a warning log.

Decision: Deferred for later

• Approach: A (Scanner-level regex filter). Small set of well-known patterns catches 90% of cases with zero dependencies.
• Not now: Keep in mind for later implementation. Secrets should not be indexed.

Proposed patterns (for future implementation)

• AWS access keys (AKIA[0-9A-Z]{16})
• GitHub tokens (ghp_[a-zA-Z0-9]{36})
• Private key headers (-----BEGIN (RSA )?PRIVATE KEY-----)
• Generic API key patterns (api[_-]?key\s*[:=]\s*['"][a-zA-Z0-9]{20,}['"])
• Password assignments (password\s*[:=]\s*['"][^'"]{8,}['"])

Acceptance criteria (for future implementation)

• Scanner skips files matching secret patterns
• Warning logged for each skipped file
• --json output includes skipped secrets in result
• Configurable pattern list via config.secretPatterns
• Adapter test verifies secret detection and skipping

Blocked by

None - can start when prioritized