mirror of
https://github.com/maziggy/bambuddy.git
synced 2026-09-30 03:01:21 +02:00
GitGuardian still flagged the file after the previous round even though every call site used a constant — the constant itself was a static string built by concatenation, which the generic-password detector still matched on. Generate the test credential per process via secrets.token_urlsafe so no password literal lives in the source, and mark the single line where the variable is bound with the standard `pragma: allowlist secret` marker ggshield / detect-secrets honour.