fix: test fixtures no longer look like real credentials

[FMSMITH91]

Checking the security surfaces turned up an open GitHub secret-scanning alert — Telegram Bot Token, opened today.

It's mine. A synthetic fixture I added this morning, written in the exact real shape (9 digits : 35 chars), at tests/unit_test.py:3236. Not a live credential, nothing to rotate.

It still needs fixing. A false positive on that dashboard isn't harmless — it trains whoever reads it to wave the next one through, and the next one might be real.

The fix

The panel's own patterns are much looser than the real formats (^\d{5,}:[A-Za-z0-9_-]{20,}$ for Telegram, \d{5,25}/[\w-]{1,120} for a Discord webhook), so a fixture can be equally valid and obviously fake:

123456789:AAtokenAAtokenAAtokenAAtokenAAtoken  ->  12345:TESTONLYnotarealtoken00
.../webhooks/123456789012345678/AbCdEf-_01...  ->  .../webhooks/12345/TESTONLY-not-a-real-webhook

The webhook one hadn't tripped an alert yet, but it was in the same real shape and would have.

Guarded

A check now fails on any fixture matching a real Telegram token, Discord webhook or GitHub token shape — so the next one is caught here rather than on the security dashboard. Mutation-verified by restoring the old value.

The existing alert covers a commit already in history, so it won't close on its own; resolving it as used-in-tests separately.

unit 889 → 892 · smoke 313 · lint clean.

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · -0.01% coverage variation

Metric	Results
Coverage variation	✅ -0.01% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (c8dfe50)	11965	5894	49.26%
Head commit (ae8089c)	11965 (+0)	5893 (-1)	49.25% (-0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#75)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}