From 5dc0907ad4c6b252530cf5397db772fd91c01e25 Mon Sep 17 00:00:00 2001
From: Codex <codex@antoineve.me>
Date: Sun, 13 Sep 2026 12:12:50 +0200
Subject: [PATCH] =?UTF-8?q?fix(security):=20d=C3=A9tecter=20les=20PIN=20da?=
 =?UTF-8?q?ns=20les=20URL?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/check_secrets.py         |  2 +-
 tests/unit/test_check_secrets.py | 21 +++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/scripts/check_secrets.py b/scripts/check_secrets.py
index 6e2b04c..4d63985 100644
--- a/scripts/check_secrets.py
+++ b/scripts/check_secrets.py
@@ -34,7 +34,7 @@ _UNQUOTED_SECRET_RE = re.compile(
     r"\s*[:=]\s*(?P<value>[a-z0-9][a-z0-9._~+/-]{2,})"
 )
 _URL_SECRET_RE = re.compile(
-    r"(?ix)[?&](?:api[_-]?key|access[_-]?token|auth(?:orization)?|icalsecurise|password|secret|token)"
+    r"(?ix)[?&](?:api[_-]?key|access[_-]?token|auth(?:orization)?|icalsecurise|password|pin|secret|token)"
     r"=([^&#\s]{3,})"
 )
 _URL_PLACEHOLDER_RE = re.compile(
diff --git a/tests/unit/test_check_secrets.py b/tests/unit/test_check_secrets.py
index a35d502..dc00ed2 100644
--- a/tests/unit/test_check_secrets.py
+++ b/tests/unit/test_check_secrets.py
@@ -118,6 +118,27 @@ def test_main_detects_sensitive_url_parameter(
     assert sentinel not in output
 
 
+def test_main_detects_pin_url_parameter_without_disclosing_its_value(
+    secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
+) -> None:
+    """Vérifie qu'un PIN dans une query string déclenche un échec sans fuite.
+
+    :param secret_checker: Module du script sous test.
+    :param tmp_path: Répertoire temporaire représentant un dépôt.
+    :param capsys: Fixture de capture de sortie.
+    :return: None
+    """
+    sentinel = "m14-url-pin-sentinel"
+    (tmp_path / "settings.yaml").write_text(
+        f"url: https://example.invalid/api?pin={sentinel}\n", encoding="utf-8"
+    )  # secret-check: allow
+
+    assert secret_checker.main([], root=tmp_path) == 1
+    output = capsys.readouterr().out
+    assert "settings.yaml:1 (parametre-url)" in output
+    assert sentinel not in output
+
+
 def test_main_ignores_documentation_url_placeholders(
     secret_checker: ModuleType, tmp_path: Path, capsys: CaptureFixture[str]
 ) -> None: