Update

Author: Pringled

internal/scan/apikeys.go

@@ -365,11 +365,18 @@ func (s *APIKeyScanner) scanCredentialFiles() []models.Finding {
 	// If home directory cannot be resolved, skip all ~-based paths to avoid
 	// scanning incorrect root-relative paths (e.g. /.aws/credentials).
 	homeDir := s.resolveHomeDir()
+	// seenPath is shared across built-in and extra loops so that an extra path
+	// duplicating a built-in (e.g. ~/.netrc in both lists) produces only one finding.
+	seenPath := make(map[string]bool)
 	for _, cf := range credentialFiles {
 		if homeDir == "" && len(cf.Path) > 0 && cf.Path[0] == '~' {
 			continue
 		}
-		expanded := expandHome(cf.Path, homeDir)
+		expanded := filepath.Clean(expandHome(cf.Path, homeDir))
+		if seenPath[expanded] {
+			continue
+		}
+		seenPath[expanded] = true
 		if fsutil.Exists(expanded) {
 			findings = append(findings, models.Finding{
 				Scanner:     "api_keys",
@@ -381,17 +388,15 @@ func (s *APIKeyScanner) scanCredentialFiles() []models.Finding {
 	}
 
 	// Extra credential files from user config.
-	// Deduplicate by expanded path to avoid reporting the same file twice.
-	seenExtraPath := make(map[string]bool, len(s.ExtraCredentialFiles))
 	for _, cf := range s.ExtraCredentialFiles {
 		if homeDir == "" && len(cf.Path) > 0 && cf.Path[0] == '~' {
 			continue
 		}
-		expanded := expandHome(cf.Path, homeDir)
-		if seenExtraPath[expanded] {
-			continue // duplicate path in extras list
+		expanded := filepath.Clean(expandHome(cf.Path, homeDir))
+		if seenPath[expanded] {
+			continue // already reported by built-in or earlier extra
 		}
-		seenExtraPath[expanded] = true
+		seenPath[expanded] = true
 		if fsutil.Exists(expanded) {
 			findings = append(findings, models.Finding{
 				Scanner:     "api_keys",

internal/scan/apikeys_test.go

@@ -246,6 +246,25 @@ func TestAPIKeyScanner_NoDuplicateFindings(t *testing.T) {
 				return tokenFile
 			},
 		},
+		{
+			name: "extra credential file duplicates built-in path",
+			makeScanner: func(home string) *scan.APIKeyScanner {
+				return &scan.APIKeyScanner{
+					HomeDir: home,
+					ExtraCredentialFiles: []config.CredentialFile{
+						{Path: "~/.netrc", Label: "netrc (duplicate of built-in)"},
+					},
+				}
+			},
+			setup: func(t *testing.T, home string) string {
+				netrcFile := filepath.Join(home, ".netrc")
+				if err := os.WriteFile(netrcFile, []byte("machine example.com"), 0o600); err != nil {
+					t.Fatalf("create .netrc: %v", err)
+				}
+				clearHighRiskEnv(t)
+				return netrcFile
+			},
+		},
 	}
 
 	for _, tc := range cases {