detect-secrets re-flags unchanged test literals when adjacent edits drag them into the diff hunk

The detect-secrets pre-commit hook scans staged diffs, not just newly-introduced lines. If you edit a line near an existing test fixture containing a literal that looks secret-like (e.g. a fake password_hash value of hashed), the unchanged literal can re-enter the scan window and fail the commit, even though it predates your changes and may have been previously committed without the hook objecting. Verified 2026-04 against pre-commit's detect-secrets hook on a Python project: adding await to neighbouring lines in a test file caused an existing fake hash literal three lines away to be re-flagged.

For one-off test fixtures, add an inline # pragma: allowlist secret (Python) / language-appropriate equivalent at end of the line, that satisfies the hook without weakening it elsewhere. For broader cases or shared baselines, regenerate the secrets baseline with detect-secrets scan > .secrets.baseline and review the diff before committing. Prefer the inline pragma when the literal is clearly a test fixture; reach for a baseline update when many unrelated literals are affected at once.