Merge remote-tracking branch 'origin/main' into fix/pr3649-review

scripts/prompt-injection-scan.sh

@@ -77,13 +77,15 @@ ALLOWLIST=(
   'hooks/gsd-prompt-guard.js'
   'hooks/gsd-read-injection-scanner.js'
   'tests/read-injection-scanner.test.cjs'
+  'tests/security-prompt-injection.test.cjs'
+  'tests/fixtures/adversarial/security/'
   'SECURITY.md'
 )
 
 is_allowlisted() {
   local file="$1"
   for allowed in "${ALLOWLIST[@]}"; do
-    if [[ "$file" == *"$allowed" ]]; then
+    if [[ "$file" == *"$allowed"* ]]; then
       return 0
     fi
   done

scripts/secret-scan.sh

@@ -107,6 +107,8 @@ should_skip_file() {
   case "$file" in
     */secret-scan.sh) return 0 ;;
     */security-scan.test.cjs) return 0 ;;
+    */security-prompt-injection.test.cjs) return 0 ;;
+    tests/fixtures/adversarial/security/*|*/tests/fixtures/adversarial/security/*) return 0 ;;
   esac
   return 1
 }