# Secrets findings

The scan was keyword-based and intentionally recorded only file, line and category. Values, passwords, tokens, keys and connection-string contents were not copied into reports.

Observed categories:

- password-related UI/logic in `P_Serv_CreateLineGroupAnnotationText` (`MainForm.cs` and designer); source references a password field and a configured defence value.
- connection-string keywords and SQLite/SQL connection construction in P3D-related projects.
- repository `.gitignore` comments warning that database connection strings may be unencrypted.

See `evidence/secret-search.csv` for file/line/category only. This is not proof that a credential is active; it is a review queue.