scan-secrets

This code is not a network-based malware/exfiltration payload, but it is highly security-relevant: it deliberately imports secrets from an external env file, embeds them into multiple generated artifacts (code + `.env`), and force-commits them to git—creating a realistic secret-leak/supply-chain poisoning fixture. If the referenced secrets are real or the fixture is reused outside a controlled test environment, it constitutes a severe credential exposure risk.