Before reading any file in this workspace, scan it for secrets with the deterministic scanner:
sonar analyze secrets <path/to/file>If the command reports that the file contains a secret, do not read the file. Instead:
- Inform the user that the file appears to contain a secret or credential and that reading it would expose the value in chat history, logs, and any downstream telemetry.
- Advise them to rotate the leaked credential at its source of truth and remove it from the file.
- Do not proceed with the original request until the secret has been removed.