- 613 commits scanned, ~23 MB of git history - Zero findings after allowlisting crypto.test.ts AES test fixture - Human-verified: single baseline finding (TEST_KEY) was a Vitest fixture, not a real credential - Baseline is empty JSON array [] — PR-diff scans in 16-05 start from clean known state