[hessabi]

The HOL plugin scanner (3.4.2, fail_on_severity: high) reports one HIGH HARDCODED_SECRET finding on main: the fake API key in tests/cloud-url.test.mjs line 19. It came from my PR #11.

This renames the two fake key literals in that file to placeholder-style values the scanner recognizes: apk_secret_example and cog_service_example. The cog_ prefix is kept, so service-key detection is unchanged. No scanner thresholds, workflow files or ignore files are touched, and the test logic is unchanged.

Verified:

• node --test passes 68/68 before and after.
• The scanner's check_no_hardcoded_secrets returns the line 19 finding on main and no findings on this branch.
• Merged together with Stop cloud sessions on cancel and read the v3 PR url #15 and Fix EAGAIN crash when stdin is a non-blocking handle with no data #16, the full suite passes and the secrets check reports zero findings.

[TheOnlyFusionCube]

Reviewed against current main. This only replaces two synthetic credential literals in tests/cloud-url.test.mjs; it retains the cog_ service-key prefix and leaves test semantics and HOL scanner policy unchanged. The PR's Test matrix and HOL Plugin Scanner both passed; scanner reports zero high findings (100/100). Merging this first will remove the pre-existing scanner finding that also affects #19 and #20.

[TheOnlyFusionCube]

Approved. The diff changes only two synthetic credentials in tests/cloud-url.test.mjs; neither endpoint validation nor the malicious-URL matrix, assertion logic, or workflows/scanner configuration changes. Both literals remain nonempty, and cog_service_example retains the cog_ prefix used by getCloudConfig to select the service-key path. For each malicious URL, the test still requires create/get/message calls plus service-key create to reject, and withMockedFetch still asserts calls.length === 0 (no credential-bearing fetch can be attempted).

Verified on the PR head: Test passed on Node 18/20/22 (68/68 each); HOL Plugin Scanner 3.4.2 completed successfully, reporting 0 critical/high/medium/low/info findings and score 100/100. Existing scanner gates remain min_score: 80 and fail_on_severity: high; there is no evidence of relaxed security thresholds or reduced regression coverage. The default branch's earlier scanner run still has one HIGH finding, so confirm new main checks after merge.