// Package testdata contains fixtures used by the security tests.
// This file deliberately carries a G101 pattern (hardcoded
// credential) so that any gosec run that doesn't allowlist this
// path will fail. The allowlist lives in .golangci.yml and
// .gitleaks.toml. Removing this fixture will break the
// TestHardcodedCredsFixturePresent meta-test.
package testdata

// HardcodedCredsFixture is a stub function whose body carries a
// G101 pattern. gosec (with severity=high and confidence=medium,
// per .golangci.yml) flags `apiKey := "..."` as G101. The value
// is intentionally not a real secret (just the literal prefix
// "GOSEC_G101_FIXTURE_VALUE_") so it doesn't trigger gitleaks.
func HardcodedCredsFixture() string {
	apiKey := "GOSEC_G101_FIXTURE_VALUE_NOT_A_REAL_SECRET"
	_ = apiKey
	return apiKey
}