Release TRAP v2.2.2 — sharper, less noisy findings · bikr/TRAP

Three output-quality refinements. No methodology change; all three pull the same direction: findings that are specific, real, and hard to dismiss.

What's new

"What a finding must look like" (Evidence Standard). A compact ❌/✅ contrast putting a vague finding next to a citable one, plus a ban on vague quantifiers (regular, promptly, strong, properly, as needed). The rule: if you cannot name the file, the number, or the command, you do not have a finding yet.
Placeholder-vs-leak discipline (Secrets). A dummy value in .env.example or an obvious fake fixture (sk_test_…, your-api-key-here) is not a leaked secret and must not be reported as one. A real-looking, live-format credential is a finding wherever it lives, including test files. Precision, without weakening the floor: it doesn't suppress a category, it demands you tell a fake from a real one.
Test and demo backdoor hunt (Phase 3). Actively hunts the dev shortcuts AI-assisted development leaves behind: hardcoded bypass branches (if (email.endsWith('@test.com')) skipAuth()), magic values (fixed OTPs, universal passwords, ?admin=true), seeded admin accounts, and auth checks disabled behind an env flag that defaults open. Trivially exploitable, and previously only covered as a release-checklist line rather than an active hunt.