fix(engine): exclude build outputs (.output) from detector + Semgrep; tighten DEFAULT_CREDENTIALS

[decksoftware]

Exclude build outputs (.output) from the engine; tighten DEFAULT_CREDENTIALS

Driven by a real, detailed monorepo comparison (a Nuxt monorepo, DeckMidia). The engine's report had 218 findings / score 49, dominated by false positives from build artifacts under .output/ — prototype pollution in _nitro.mjs, JWTs in compiled bundles, session-fixation in route chunks (~47 critical FPs). The reviewers' verdict: "Codex report não confiável para priorização direta sem triagem manual pesada... inflacionado por análise de build artifacts (.output/)."

Root causes

1. .output (Nuxt/Nitro build output) was missing from DEFAULT_IGNORE_DIRS — only .next/.nuxt were covered, so the heuristic detector scanned .output/.
2. runSemgrep only excluded node_modules + csreview-reports — so Semgrep scanned .output, dist, build, .nuxt, etc. and reported FPs from compiled code.
3. DEFAULT_CREDENTIALS matched a bare admin|root|default|test key → it flagged UI role-label maps like { admin: 'Admin' } as CRITICAL default credentials.

Fixes

• Build outputs added to DEFAULT_IGNORE_DIRS: .output, out, .vercel, .netlify, .svelte-kit, .angular, .turbo, .parcel-cache. One change flows to both the scanner's discovery globs and the external-tool finding suppression.
• semgrepExcludeArgs() — Semgrep now excludes the same dirs as the detector (single source of truth = DEFAULT_IGNORE_DIRS), instead of just node_modules.
• DEFAULT_CREDENTIALS now requires a credential-context key (password/pwd/secret/credential) set to a weak value — keeps real default creds, drops the role-label FP.

Not changed (out of scope / not ours)

• Semgrep registry FPs (SSRF on fixed N8N_BASE_URL/PAGARME_API_URL, SQLi in a pure-data file) are Semgrep's own rules — surfaced as TOOL-ONLY confidence; the findings-by-origin breakdown (feat(reports): findings-by-origin breakdown (trust corroborated first) #19) helps triage these.
• .env secrets: still reported (a real risk if committed); the user can .csreview-ignore them.

Tests: +2 + extended ignore/credential guards (.output discovery + suppression, semgrepExcludeArgs, DEFAULT_CREDENTIALS FP/TP). 183/183 · lint clean · typecheck 0.

🤖 Generated with Claude Code