test(security): reword #4687's log_sanitizer example literals on landing (tripwire)

Author: LearningCircuitCreated Sep 19, 2026Updated Sep 19, 2026

When #4687 (feat: centralized SecretRegistry auto-redacts known secrets from logs, branch feat/secret-registry-log-redaction) lands, it will bring the quoted example mappings from its log_sanitizer.py docstring ({"api_key": "alice123"}, {'password': 'alice123'}, and the ValueError rendering) onto main — and tests/security/test_gitleaks_credential_rule.py::test_log_sanitizer_path_allowlist_is_a_tripwire will fail (by design).

Context: #6624 closed gitleaks alerts #8263–#8265 by path-allowlisting the credential-literal rule for src/local_deep_research/security/log_sanitizer.py (the module documents credential shapes, so quoting example mappings is inherent). The tripwire test enforces that the exemption never becomes a place where example literals accumulate unnoticed.

On landing #4687, pick one of the two documented resolutions:

  1. Preferred: reword the example values in #4687's docstring to rule-level placeholders (example-secret, changeme — already in the rule's placeholder allowlist in .gitleaks.toml). The tripwire then passes as-is.
  2. Or extend the placeholder allowlist in .gitleaks.toml for alice123 (the PR body of #6624 explains why path-scoping was chosen over value-chasing — option 1 avoids that tradeoff).

Do not delete the tripwire assertion — it is the guard that keeps the credential-literal exemption honest.

Source: LearningCircuit/local-deep-research