Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payme

Static scan of source code or config for hardcoded secrets and credentials. Detects cloud keys, VCS and CI tokens, payment keys, messaging tokens, AI-provider keys, database URIs with passwords, private keys and high-entropy generic secrets. Returns a go/no-go verdict (pass, caution, block) with per-finding rule, provider, severity and location. Secret indicators, not a guarantee.