When a secret scanner rejects a symbolic environment-variable name instead of a credential value, the visible bug looks like a false positive. It usually is not. The durable defect is duplicated security policy—the same rule implemented independently in several paths—creating inconsistent behaviour,...