A one-letter `exclude_path_fragments` entry (for example `e`) passes `mergeConfig`, matches by substring nearly every path, and drops a file holding a secret from the release scan while one other scanned file keeps the zero-coverage sentinel quiet, so the secret is copied into the release payload and the ship gate does not refuse.

A one-letter exclude_path_fragments entry (for example e) passes mergeConfig, matches by substring nearly every path, and drops a file holding a secret from the release scan while one other scanned file keeps the zero-coverage sentinel quiet, so the secret is copied into the release payload and the ship gate does not refuse.

Private security advisory GHSA-4f3r-hxcm-crq4 (draft, severity medium). Follows GHSA-8fqr-pv94-5jwp, which refused a punctuation-only fragment. Full text, evidence and reproduction: .abcd/.work.local/scratch/security-drain-2026-10-11/advisories/ in the main checkout's local tier. This record stays uncommitted until its fix lands; the fix commit adds it directly to resolved/.

Evidence (main 3d171421a): mergeConfig (internal/adapter/scanner/scanner.go) refuses a blank, slash-only or punctuation-only fragment and accepts any fragment holding a letter or digit; excludedBy matches with strings.Contains on the slash path. Confirmed by reading the code at that commit; not re-run.