security: rust-secrets — require assignment to a literal, and cover static

[hyperpolymath]

Follow-up to #518, from triaging every remaining rust-secrets failure in the estate.

The false positives

The patterns matched = ... " — a quote anywhere after an equals. That flags code which hardcodes nothing at all:

let api_key = request["api_key"].as_str().unwrap_or("");   // a lookup
let api_key_file = temp_dir.path().join("config.js");      // a path
Query::new("Here's my api_key=sk-12345");                    // a demo string

A hardcoded secret is an assignment directly to a string literal. Each pattern now requires the quote to follow the =, with a minimum value length of 8 — a credential shorter than that is not a credential.

The missed detection (the more important half)

const.*KEY.*= never matched:

static AUTH_KEY: &str = "abcdef0123456789abcdef0123456789";

That is a genuine hardcoded secret the job was silently passing. I found it because a 5-secret canary fixture detected only 4 — not by reading the regex. static and mut are now accepted alongside const/let.

Verified, not assumed

Canary run against the script extracted from this YAML (yaml.safe_load → execute), not a hand-copy:

PASS  5 real hardcoded secrets           -> BLOCKS   (detected 5/5)
PASS  clean (env::var, comment, pragma, OAuth URL)
PASS  secret in ./src                    -> BLOCKS
PASS  crates/                            -> ADVISORY today
PASS  crates/                            -> BLOCKS after cutoff
PASS  literal + env mention after ;      -> BLOCKS
PASS  malformed cutoff                   -> refuses to run
7 passed, 0 failed

Replayed over all 64 Rust repos at both 2026-07-21 and post-cutoff 2026-09-01: 0 regressions, 3 verdicts fixed (aerie, and heterogenous-mobile-computing post-cutoff).

What deliberately still fails

conative-gating, echidnabot, filesoup carry genuinely secret-shaped fixtures — a fuzz corpus, and two secret-scanners' own detection test data inside r#"…"# raw strings. Those are real matches on real secret-shaped literals, so they get the explicit // scanner-allow: rust-secrets pragma rather than a pattern loophole that would weaken the gate for everyone. Separate one-line PRs.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud