Make detector Result.SecretParts initialization stricter

[mcastorina]

Description:

Update the hack/checksecretparts tool to enforce initializing Result with a SecretParts field and clean up existing detectors to pass this lint check.

The reason for this change is because all Result objects must have SecretParts set.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Touches many detector implementations and changes the static check to fail any detectors.Result{} literal missing SecretParts, which could surface new CI failures or subtly change reported metadata. Core scanning/verification logic is largely unchanged, but the breadth of detector edits raises regression risk.

Overview
Updates hack/checksecretparts to be stricter: it now flags every detectors.Result{} / &detectors.Result{} composite literal that omits a SecretParts key, and no longer treats later SecretParts assignments or other package references as satisfying the rule; messaging/docs/tests were updated accordingly.

Migrates a broad set of detectors to comply by initializing Result.SecretParts at construction time (and in a few cases mutating the map later to add fields like endpoints/usernames), removing prior patterns that only set SecretParts after successful verification.

^{Reviewed by Cursor Bugbot for commit 3e6aaa4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3e6aaa4. Configure here.}

[cursor]

Shared map mutation corrupts previously appended results

Medium Severity

The SecretParts map is initialized once per token at line 70, then mutated inside the inner username loop at line 75 via s1.SecretParts["username"] = username. Because maps in Go are reference types, when s1 is appended to results at line 88, the copy shares the same underlying map. Subsequent iterations overwrite "username" for all previously appended results, causing them to all reflect the last username processed rather than their own.

Additional Locations (1)

• pkg/detectors/dockerhub/v2/dockerhub.go#L69-L75

 

^{Reviewed by Cursor Bugbot for commit 3e6aaa4. Configure here.}

[mcastorina]

This is an existing bug and out of scope for this PR. Follow-up work will address this.