fix(security): détecter les PIN dans les URL

scripts/check_secrets.py

@@ -34,7 +34,7 @@ _UNQUOTED_SECRET_RE = re.compile(
     r"\s*[:=]\s*(?P<value>[a-z0-9][a-z0-9._~+/-]{2,})"
 )
 _URL_SECRET_RE = re.compile(
-    r"(?ix)[?&](?:api[_-]?key|access[_-]?token|auth(?:orization)?|icalsecurise|password|secret|token)"
+    r"(?ix)[?&](?:api[_-]?key|access[_-]?token|auth(?:orization)?|icalsecurise|password|pin|secret|token)"
     r"=([^&#\s]{3,})"
 )
 _URL_PLACEHOLDER_RE = re.compile(

tests/unit/test_check_secrets.py

@@ -118,6 +118,27 @@ def test_main_detects_sensitive_url_parameter(
     assert sentinel not in output
 
 
+def test_main_detects_pin_url_parameter_without_disclosing_its_value(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
+) -> None:
+    """Vérifie qu'un PIN dans une query string déclenche un échec sans fuite.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :return: None
+    """
+    sentinel = "m14-url-pin-sentinel"
+    (tmp_path / "settings.yaml").write_text(
+        f"url: https://example.invalid/api?pin={sentinel}\n", encoding="utf-8"
+    )  # secret-check: allow
+
+    assert secret_checker.main([], root=tmp_path) == 1
+    output = capsys.readouterr().out
+    assert "settings.yaml:1 (parametre-url)" in output
+    assert sentinel not in output
+
+
 def test_main_ignores_documentation_url_placeholders(
     secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
 ) -> None: