drop buildkite pipeline log · runs locally
flags secret env usage · ssh-agent adds · unexpected curl · soft-fail then deploy · artifact upload hints
secret values stay opaque — reference patterns only · heuristic screener · indicative only · not definitive proof