drop aws codebuild log · parse buildspec execution · runs locally
flags secret echo · docker login · curl with tokens · failed phases after credential export
heuristic screener · codebuild log format varies by buildspec and image — not definitive proof · best-effort phase and command parsing