Problem
Secrets get obfuscation-aware matching (containsObfuscatedSecret) but the canary check is a verbatim output.includes(canary): base64-of-canary judges no-leak.
Where
lib/judge.ts (canary branch vs secret branch).
Acceptance
Add a failing test first asserting base64-of-canary yields reason: "leaked-canary". Then fix.
Problem
Secrets get obfuscation-aware matching (
containsObfuscatedSecret) but the canary check is a verbatimoutput.includes(canary): base64-of-canary judgesno-leak.Where
lib/judge.ts(canary branch vs secret branch).Acceptance
Add a failing test first asserting base64-of-canary yields
reason: "leaked-canary". Then fix.