fix(scan): require a real bucket listing body before flagging s3 exposure

[TBX3D]

No description provided.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 85.71429% with 2 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@7ea1cd2). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
internal/scan/cloudstorage.go	85.71%	1 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #282   +/-   ##
=======================================
  Coverage        ?   54.87%           
=======================================
  Files           ?       81           
  Lines           ?     6887           
  Branches        ?        0           
=======================================
  Hits            ?     3779           
  Misses          ?     2836           
  Partials        ?      272           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

pr summary

3 files changed (+164 -6)

category	files
go source	3
tests	2

[vmfunc]

good catch on the 200-alone false positive, and the tests actually pin the pre-fix bug (200 + AccessDenied body). LimitReader keeps the read bounded and DrainClose still returns the conn, so no leak.

one thing worth noting: the denial markers are matched with strings.Contains over the whole body, not scoped to .... so a genuinely listable bucket whose listing contains an object key like AccessDenied.txt or a PermanentRedirect/ prefix would get scored not-public. edge case, but if you want to tighten it later, matching AccessDenied would remove the collision. not blocking.

in.