v2.6.0 — Detection quality, safety & attack-surface breadth

Nine measured, test-backed slices (R1–R9), grounded in a fresh audit vs 2026
secret-scanning SOTA. Test suite 145 → 187, all green; ruff clean; the scanner
stays passive and verification stays off-by-default.

Added

• Verified-credential identity/scope (R1) — a live key now reports who it belongs
  to and what it reaches (GitHub scopes, Stripe account/LIVE, Slack workspace, …),
  surfaced in HTML/CSV/SARIF. Never includes the secret itself.
• FP/FN benchmark harness (R2) — labelled corpus + make bench + a CI gate.
  Current: precision 1.000 · recall 1.000 · F1 1.000 · 0 false positives.
• Live-verification coverage 9 → 17 providers (R6) — +Cloudflare, DigitalOcean,
  Datadog, Notion, Linear, Figma, Postman, Doppler (read-only, fail-closed).
• Source-map original-source scanning (R5) — decode & scan sourcesContent
  with per-file attribution.
• Passive attack-surface / security-posture checks (R8) — missing/weak headers,
  version disclosure, insecure cookies; even a clean credential scan now returns
  actionable ASM findings.
• Executive-summary report (R9) — verification-evidence callout + measured-
  precision statement.
• SARIF full detector catalog (R4).

Security / hardening

• Regex ReDoS-proofing (R3) — per-pattern match cap + automated backtracking gate.

Notes

• New env toggles: SCAN_SOURCEMAP_CONTENT, MAX_SOURCEMAP_SOURCES, SCAN_HTTP_POSTURE.
• Backward compatible: verify_finding() keeps its string API; verify_finding_detailed() is new.