fix: store only file path and line number as tuples to prevent secret content retention

Author: fgogolli

dev-tools/security/detect_secrets.py

@@ -48,22 +48,17 @@ def detect_secrets(source_dir: str = "src") -> bool:
                 for _match in matches:
                     # Check if this is an exception
                     if not any(exc in line for exc in exceptions):
-                        found_secrets.append(f"{py_file}:{line_num}: {line.strip()}")
+                        # Store only file path and line number to avoid retaining secret content
+                        found_secrets.append((str(py_file), line_num))
 
         except Exception as e:
             logger.warning(f"Could not read {py_file}: {e}")
 
     if found_secrets:
         logger.error("Potential hardcoded secrets found:")
-        for finding in found_secrets:
-            # Security: Extract only file and line number, never log the actual secret content
-            parts = finding.split(":", 2)  # Split into file, line, content
-            if len(parts) >= 2:
-                file_path = parts[0]
-                line_number = parts[1]
-                logger.error(f"  Secret detected at: {file_path}:{line_number}")
-            else:
-                logger.error(f"  Secret detected at: {finding.split(':')[0]}")
+        for file_path, line_number in found_secrets:
+            # Security: Log only file and line number, never the actual secret content
+            logger.error(f"  Secret detected at: {file_path}:{line_number}")
         return False
     else:
         logger.info("No hardcoded secrets detected")