[SizzleUnrlsd]

Summary

A string expression whose parts are all constant (+ of strings, sep.join of a list or tuple of strings with a constant separator, an f-string whose parts are all constant) is folded once, at the outermost expression. literal_groups yields it with its constant pieces; SecretDetector.analyze judges the whole and each piece and reports one finding, the strongest (severity, then confidence), at the span of the whole expression, so a baseline digests every line of it. When the whole value is no finding, its pieces are reported on their own, as before: nothing main reported is lost. literals() still yields every literal (the whole, then its pieces).

Before: PASSWORD = "Zx81kQpL" + "w0RtY7vB" + "n3MsD9cF" and TOKEN = "ghp_" + "…" were not reported, and a private key built with + was reported from its header piece only, so a baseline absorbed a changed body.

Verification

New tests in tests/test_folded_secret_literals.py (red before the fix), including pieces that touch ("AKIA…" + "wJal…" stays hardcoded-secret), a prefix of a chain not judged on its own, and a piece judged when the whole is no secret. Two independent reviews against main on Python 3.11–3.14: no lost or duplicated findings, no new false positives. Full suite green apart from the local test_packaging environment issue; ruff, mypy clean; regression snapshots and the mitmproxy scan (75 findings) unchanged; no slowdown except a chain of several hundred terms that starts with a non-constant term (bounded by the frontend's recursion limit).

Closes #228