Secret Shape Audit

Report credential-shaped values in supplied configuration, by shape class and position, never by value. Recognises a PEM private key block, a JSON Web Token whose header actually decodes, documented key prefixes, a URL carrying a password, and a long run with the character mix of a generated key rather than of text. Also reports a field named like a credential whose value matches no listed shape. The shape classes are published in every response.