test(security): reword #4687's log_sanitizer example literals on landing (tripwire)
When #4687 (feat: centralized SecretRegistry auto-redacts known secrets from logs, branch feat/secret-registry-log-redaction) lands, it will bring the quoted example mappings from its log_sanitizer.py docstring ({"api_key": "alice123"}, {'password': 'alice123'}, and the ValueError rendering) onto main — and tests/security/test_gitleaks_credential_rule.py::test_log_sanitizer_path_allowlist_is_a_tripwire will fail (by design).
Context: #6624 closed gitleaks alerts #8263–#8265 by path-allowlisting the credential-literal rule for src/local_deep_research/security/log_sanitizer.py (the module documents credential shapes, so quoting example mappings is inherent). The tripwire test enforces that the exemption never becomes a place where example literals accumulate unnoticed.
On landing #4687, pick one of the two documented resolutions:
- Preferred: reword the example values in #4687's docstring to rule-level placeholders (
example-secret,changeme— already in the rule's placeholder allowlist in.gitleaks.toml). The tripwire then passes as-is. - Or extend the placeholder allowlist in
.gitleaks.tomlforalice123(the PR body of #6624 explains why path-scoping was chosen over value-chasing — option 1 avoids that tradeoff).
Do not delete the tripwire assertion — it is the guard that keeps the credential-literal exemption honest.
Source: LearningCircuit/local-deep-research