feat: implement secret scanner, redaction utility, and update docs #1313 - #1321

Pull Request Description

Overview

This PR addresses the security vulnerability outlined in Issue #1313. Previously, when CodeGraphContext (CGC) indexed a codebase, string literals containing plain-text secrets (API keys, tokens, passwords) were stored verbatim in the graph database (KuzuDB/Neo4j/FalkorDB) as node metadata. This posed a leakage risk if .cgc bundles were shared or if an LLM accessed the graph via MCP.

This implementation introduces runtime regex/entropy scanning, a warning mechanism, and an optional redaction system.

Proposed Changes

• Secret Detection Engine: Implemented string literal scanning against common token entropy patterns and regular expressions (e.g., sk-, ghp_, Bearer, AWS keys).
• Index-time Warnings: The system now emits a non-blocking warning to the console if potential secrets are detected during repository scanning.
• Redaction Support: Added a new configuration flag CGC_REDACT_SECRETS. When active, any string matching a secret pattern is replaced with [REDACTED] prior to DB persistence.
• Security Documentation: Updated the security guide and bundle export documentation to advise users on how string literals are handled.

⚙️ Configuration

CGC_REDACT_SECRETS is set via environment variable and defaults to false, preserving existing behavior. Set CGC_REDACT_SECRETS=true to enable redaction.

Before / After

Before (redaction off — default):

{ "function_name": "fetchData", "api_key": "sk-abc123def456ghi789" }
After (CGC_REDACT_SECRETS=true):
{ "function_name": "fetchData", "api_key": "[REDACTED]" }
  Key Files Modified
- src/codegraphcontext/tools/graph_builder.py
- Hooked into the node property assembly pipeline to scan string literal values before they are assigned to function/class metadata.
- src/codegraphcontext/tools/indexing/persistence/writer.py
- Integrated the CGC_REDACT_SECRETS config check to scrub values right before writing properties to the active graph database backend.
- docs/
- Updated security practices and added a clear note to the .cgc export workflow documentation regarding shared bundles.
  Testing
- Unit tests added for pattern matching regex (e.g., sk-, ghp_, Bearer, AWS key formats).
- Unit tests added for high-entropy string detection.
- Manually verified CGC_REDACT_SECRETS=true masks values via database node inspection.
- Verified documentation builds correctly with updated security notices.
  Checklist
- Closes #1313
- Added unit tests for pattern matching regex and high-entropy detection strings
- Verified CGC_REDACT_SECRETS=true successfully masks values in database node inspections
- Documentation builds correctly with updated security notices
- No breaking changes — redaction is opt-in via environment variable