secret_detected fires on commented-out lines (critical + revoke_rotate_and_purge) in template .envrc boilerplate

[hyperpolymath]

security_errors/secret_detected does not skip comments

Found while repairing the unconditionally-vacuous Hypatia gate across 90 consumer repos
(2>&1 folded the stderr summary into the JSON payload, so jq empty failed every run and the
[] fallback made CRITICAL always 0). With the gate working, this rule became the single
largest source of new critical findings in the canary.

What fires

.envrc line 24 in metadatastician/burble, metadatastician/paint-type and
hyperpolymath/scaffoldia is flagged Secret found: Generic API key, severity critical,
action revoke_rotate_and_purge.

That line is commented out. The file is the RSR template's own direnv boilerplate:

# Project environment variables
export PROJECT_NAME=...
export RSR_TIER=...
# export DATABASE_URL=...
# export API_KEY=...        <-- line 24, flagged

# Source .env if it exists (gitignored)
dotenv_if_exists

Why this is not simply "a placeholder that looks real"

It is value-dependent, which makes it worse rather than better:

• 58 of 90 surveyed repos carry this identical commented API_KEY line.
• 3 of the 11 repos that scanned clean also carry it and were not flagged.
  hyperpolymath/game-server-admin's .envrc is structurally identical to burble's — same
  comment, one-line offset — and produced no finding.

So the rule fires on a commented-out line whenever the placeholder value happens to look
key-like. The comment is never consulted. Because the file ships in the template, whether a
given repo is blocked is effectively arbitrary.

Impact

critical blocks merges on the (now-working) Fail on critical security findings gate, and
revoke_rotate_and_purge tells the reader to treat a commented placeholder as a live leaked
credential. That is the expensive direction to be wrong in.

Same class, already recorded elsewhere

code_safety/unwrap_without_check has the identical defect — it matches the literal token in
comments and strings, proven previously by a controlled three-commit sequence. This is the
second instance, now in a critical-severity rule.

Suggested fix

Strip comments for the file's language before secret matching (at minimum # line comments for
.envrc/shell/YAML/TOML), or demote a match whose line is a comment to medium with a distinct
reason such as commented-out credential placeholder.

Also seen in the same sample (lower confidence, not filed separately)

• machine-readable-design/harvested-registry/elixir/phoenix-service.ncl lines 286/315 —
  Secret found: Password in harvested third-party reference material, which is by nature
  full of example credentials. A path-based carve-out for harvested-registry/ may be warranted.