Scans a code string for hardcoded secrets (AWS keys, Stripe keys, GitHub tokens, Google API keys, Slack tokens, private key blocks, JWTs, and generic high-entropy credentials assigned to secret/token/password/key-like variable names) BEFORE that code is written to a file or committed. Call this proactively whenever you are about to write, edit, or commit code that could plausibly contain a credential — config files, env handling, API client setup, tests with fixture values, or any snippet you're not 100% sure is clean — and again right before creating a commit or PR. Every reported line is redacted; the raw secret value is never returned.