feat(security): hardcoded secret/credential detection + git-history scan

[alxxjohn]

Summary

Adds a repository-wide hardcoded secret/credential scanner to the security suite that runs in both full scans and diff (PR) scans, plus a new codeguard scan-history command. Replaces the previous single name-based regex.

Detection tiers

• security.hardcoded-credential (fail) — known provider formats: AWS, GitHub, GitLab, Slack (token + webhook), Stripe, Google, npm, PyPI, Docker Hub, SendGrid, Twilio, Azure storage keys, DB connection strings with embedded passwords, and Authorization: Bearer tokens — plus config-defined custom_patterns.
• security.hardcoded-secret (warn) — lower-confidence name-based heuristic. Reclassified from fail → warn (high-confidence detection now lives in the credential rule).
• security.high-entropy-string (warn, opt-in) — Shannon-entropy detection of unknown/random secrets matching no known format.

Config (security_rules.secrets)

enabled, allow_paths (globs), allow_patterns (regex), custom_patterns, and entropy (enabled/min_length/threshold/level). Findings show the value masked (AKIA…CDEF); placeholders and secret references (op://, vault://, $(...), ${ENV}) are skipped automatically.

codeguard scan-history

Walks git history for secrets that were committed and later removed (still leaked — need rotation), reusing the same scanner/allowlist. Supports -all, -max-commits, -format json; exits non-zero on fail-level hits.

Performance & hardening

• A fast literal pre-filter gates the per-pattern regexes — ~31× faster default scan (3.2 → 99 MB/s), ~15× with entropy. (strings.Contains proved ~85× faster than the equivalent regex alternation; a leading \b/(?i) defeats RE2's literal-prefix fast path.)
• Bounds for untrusted PR input: skips binary files and files >5 MiB; scans only the first 64 KiB of any line.
• History parsing uses bufio.Reader (not Scanner) to avoid silent truncation on over-long lines.
• Runs across all target languages, including TypeScript/JavaScript (which previously bypassed the secret pass).

Testing

• go test ./... green (7 packages); go vet and gofmt clean.
• New table tests per provider format, placeholder/allowlist/custom-pattern/entropy/masking/binary/long-line cases, a gate-superset guard, and git-history integration tests.
• Test fixtures assemble tokens at runtime (cred(prefix, body)) so no contiguous real-format secret is committed — required for GitHub push protection and good practice in a secret-detection suite.

Self-scan

codeguard (full + diff vs main), validate, doctor, and make check all pass on this branch: 0 fail findings.

Knowledge captured

.claude/knowledge/architecture-boundaries.md updated with: diff-vs-full is centralized in FinalizeSection; TS/JS bypass findingsForFile (repo-wide rules need a separate pass); the literal-gate perf insight and gate-superset invariant; the ScanTargetFiles per-section cache-key gotcha; and the history package layering (must be top-level to avoid an import cycle).

🤖 Generated with Claude Code