The previous commit message listed this fix; the edit never made it into the tree. Checked because I have done exactly that before, and the message is not the change. Verified rather than assumed, and the behaviour is worth recording: with a password beginning with "-", `grep -rqF "$PW"` returns 0 against a directory containing no such string, so the scrub check would have reported a leak that did not exist and failed the step with a misleading message. With -e it correctly returns 1 when clean and 0 when the credential really is present. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>