fix: properly extract only file:line from secret findings to prevent clear-text logging

Author: fgogolli

dev-tools/security/detect_secrets.py

@@ -55,10 +55,15 @@ def detect_secrets(source_dir: str = "src") -> bool:
 
     if found_secrets:
         logger.error("Potential hardcoded secrets found:")
-        for secret_finding in found_secrets:
-            # Security: Don't log the actual secret content, only the location
-            location = secret_finding.split(":")[0] if ":" in secret_finding else "unknown location"
-            logger.error(f"  Secret detected at: {location}")
+        for finding in found_secrets:
+            # Security: Extract only file and line number, never log the actual secret content
+            parts = finding.split(":", 2)  # Split into file, line, content
+            if len(parts) >= 2:
+                file_path = parts[0]
+                line_number = parts[1]
+                logger.error(f"  Secret detected at: {file_path}:{line_number}")
+            else:
+                logger.error(f"  Secret detected at: {finding.split(':')[0]}")
         return False
     else:
         logger.info("No hardcoded secrets detected")