Defame1297
925f04acdb
validate-secrets.sh checked the placeholder allowlist regex against the whole line before running any secret-pattern regex. An unrelated placeholder-looking token anywhere on the line (e.g. "example" or "your-token-here" in a trailing comment) suppressed detection of a real credential earlier on the same line. Scope the allowlist check to the matched secret-candidate substring only, which the per-match re-check already did downstream but the whole-line pre-check short-circuited before it ever ran. Extend validate-secrets.bats with a case proving a real AWS-style key is still caught when a placeholder token sits elsewhere on the line. Regenerate the flat-mirror copy at plugins/core/skills/agentsmd-audit/scripts/validate-secrets.sh via scripts/sync-plugin-content.sh --all per ADR-0016.