The account-key walk gives up after eight blanks, which fails away from the finding. maxKeyGap (internal/adapter/scanner/identity.go) bounds the blanks afterAccountKey reads between a key and its value at eight, so a column-aligned config dump (USER= or username: followed by ten blanks and the login) raises no finding for a login on the generic list. Every other bound in the position checks stops reading and keeps the match; this one stops reading and drops it.

The account-key walk gives up after eight blanks, which fails away from the finding. maxKeyGap (internal/adapter/scanner/identity.go) bounds the blanks afterAccountKey reads between a key and its value at eight, so a column-aligned config dump (USER= or username: followed by ten blanks and the login) raises no finding for a login on the generic list. Every other bound in the position checks stops reading and keeps the match; this one stops reading and drops it.

Grounds

• pursued: a generic login after an account key or command separated by up to maxKeyGap blanks is reported as local_username; a column-aligned USER= or username: line within the bound that yields no local_username finding would show it wrong.