fix(redact): mask secrets in mixed interpolations

[gulamovzavohir02-glitch]

Pull Request

Description

DockSec currently treats every secret-key value beginning with ${ or $( as a safe placeholder. This lets literal secrets in Compose defaults and mixed interpolation values pass through the pre-LLM redaction layer unchanged.

This change recognizes only a complete ${VARIABLE} reference as a placeholder. Values such as ${DB_PASSWORD:-hunter2}, ${USER}:hunter2, and command substitutions are now fully masked. Quoted pure variable references and empty assignments retain their existing behavior.

Closes #170

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Code style update (formatting, renaming)
• Code refactoring (no functional changes)
• Performance improvement
• Test update
• Build / CI configuration
• Security fix

How Has This Been Tested?

• Unit tests
• Manual testing

Added regression tests for:

• Compose interpolation defaults with :- and -
• Mixed interpolation and literal secret values
• Command substitutions assigned to secret-looking keys
• Quoted pure placeholders and empty values

Validation:

• pytest tests/ -q — 273 passed, 2 skipped
• black --check docksec/redact.py tests/test_redact.py
• isort --check-only docksec/redact.py tests/test_redact.py
• mypy docksec/redact.py
• git diff --check

Test Configuration:

• Python version: 3.14.7
• Operating System: macOS 26.6.2
• DockSec version: 2026.8.19

Checklist

• Code follows the style guidelines of this project
• Self-review completed
• Hard-to-understand areas are commented
• Documentation updated where needed
• No new warnings or errors introduced
• Tests added that prove the fix or feature works
• All existing tests pass
• Dependent changes have been merged and published
• Spelling checked

Screenshots (if applicable)

Not applicable.

Related Issues / PRs

• Relates to Redaction bypasses secrets in interpolation defaults and mixed values #170

---

By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.