# security-gate benchmark corpus: deliberate planted-vulnerability fixtures the
# scanner is benchmarked against — not live credentials (verified 2026-07-28).
d9be5d6f35bcdb8e1d5919c04b7208a6397d68b1:modules/security/domains/security/corpus/S8-attachment-cross-tenant-idor/vuln.ts:generic-api-key:193
d9be5d6f35bcdb8e1d5919c04b7208a6397d68b1:modules/security/domains/security/corpus/S8-attachment-cross-tenant-idor/safe.ts:generic-api-key:193
# harness delivery-publication test: synthetic receipt/token literal in a test fixture (historical commit, verified 2026-07-28) — not a live credential.
# cloudflareops skill doc: prose example `curl -u "$KEY:" …` — a shell variable placeholder in
# documentation, not a literal credential (verified 2026-07-28).
modules/workstation/claude/skills/cloudflareops/SKILL.md:curl-auth-user:527

# Synthetic fixture asserting the no-secret gate FIRES; not a credential.
modules/workstation/claude/workflows/lib/test-run-plan-lib.sh:generic-api-key:79
# Same prose example as the claude-tree entry above, in the codex copy of the skill: `curl -u "$KEY:" …` is a shell placeholder in documentation, not a credential (verified 2026-07-29).
modules/workstation/codex/skills/cloudflareops/SKILL.md:curl-auth-user:528
