fix: resolve clear-text logging of sensitive data (CodeQL py/clear-text-logging-sensitive-data)

Store only file path and line number as tuples instead of retaining secret content.
This prevents sensitive data from being logged or stored in memory.

Author: fgogolli

dev-tools/security/detect_secrets.py

@@ -48,17 +48,17 @@ def detect_secrets(source_dir: str = "src") -> bool:
                 for _match in matches:
                     # Check if this is an exception
                     if not any(exc in line for exc in exceptions):
-                        found_secrets.append(f"{py_file}:{line_num}: {line.strip()}")
+                        # Store only file path and line number to avoid retaining secret content
+                        found_secrets.append((str(py_file), line_num))
 
         except Exception as e:
             logger.warning(f"Could not read {py_file}: {e}")
 
     if found_secrets:
         logger.error("Potential hardcoded secrets found:")
-        for secret in found_secrets:
-            # Security: Don't log the actual secret content, only the location
-            location = secret.split(":")[0] if ":" in secret else "unknown location"
-            logger.error(f"  Secret detected at: {location}")
+        for file_path, line_number in found_secrets:
+            # Security: Log only file and line number, never the actual secret content
+            logger.error(f"  Secret detected at: {file_path}:{line_number}")
         return False
     else:
         logger.info("No hardcoded secrets detected")