[ajianaz]

What

Classify the right-hand side of secret-named assignments before reporting a hardcoded secret. The file path is now passed to the hardcoded-secret filter (post_match_filter_for_path; the path-less post_match_filter is test-only), and the LLM cross-check (has_secret_literal) uses the same classifier.

Rules (non_literal_rhs in src/engine/rules/builtin.rs):

• Quoted RHS is a literal (also b"...", r#"..."#, String::from(".."), "a" + "b"), unless the whole value is a pure reference: "${X}", "$X", "$(cmd)".
• Unquoted RHS starting with $ or containing ${..}, $(..) or a backtick is interpolation/command substitution: not a secret, in any file.
• Other unquoted RHS: source code (js/ts/py/rs/go/java/kt/cs/php/rb/sql/...) means an expression (env read, call, member access, identifier): not a secret. Assignment-style files (.env*, .properties, .ini, .cfg, .conf, .toml, shell, yaml, Dockerfile...) means a bare token is the value: still flagged. Unknown path: unchanged.

Why

Env reads, calls and ${VAR} interpolation were reported as hardcoded secrets. Closes the FP groups pinned in KNOWN_GAPS by #615.

Testing

• 16 fix(rules): env-var reads and call expressions are reported as hardcoded secrets #616 and 9 fix(rules): ${VAR} / $VAR interpolation is flagged as a hardcoded secret in env, .properties and shell files #617 rows moved from KNOWN_GAPS into CASES (expected=false), plus new rows on both sides (real secrets in .env/.properties/shell/toml/ini/compose, concatenated and prefixed literals, mixed "${P}literal"). KNOWN_GAPS now only holds new FN shapes: os.environ.get("X", "literal"), process.env.X || "literal", unwrap_or("literal".into()), ${X:-literal}, new String("literal").
• bare_identifier_rhs_in_code_is_not_a_hardcoded_password replaces the old Rust let password = supersecret123; positive.
• fmt, clippy -D warnings, full cargo test x3 green. Verified with the built binary (cora scan / cora review --staged) on positive and negative samples per shape.

Closes #616
Closes #617

🤖 Generated with Claude Code