Colin 533b518553 fix(security-scan): update scanner self-exemption allowlists for renamed suite files ...

The three shell scanners exempt their own adversarial test fixtures by exact
filename; the *.security.test.cjs renames broke those entries, so the PR diff
scan flagged the scanners' own test payloads. Verified locally with all three
scanners in --diff origin/next mode (0 findings) and the security suite
(207/207). The .sh files were missed in the original reference sweep because
the rename grep filtered to .cjs/.yml/.json/.md extensions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-10 00:15:02 -04:00

12 KiB

Executable File

Raw Blame History

View Raw