Tighten SECRET_PATTERNS comment per review

Assisted-By: devx/044e1f3f-fe03-4f4c-8aa7-520114eab4a0

Author: lopez-mar

packages/app/src/cli/services/app-security-engine/rules/secret-rules.ts

@@ -26,14 +26,13 @@ interface SecretPattern {
 
 export const SECRET_PATTERNS: SecretPattern[] = [
   // Shopify credentials are recognized by value prefix, never by variable or
-  // key name. A secret-sounding name proves nothing — `.env.example` files
-  // legitimately assign placeholders to `SHOPIFY_API_SECRET`, and scoring
-  // those is how this check missed its own static-tier bar (provable facts,
-  // near-zero FPs). shpat_/shpca_/shppa_/shpss_ bodies are 32-char hex;
-  // shprt_/shpsb_/shptka_/shpua_ are alphanumeric. The first seven prefixes
-  // are already public via shopify.dev docs and published secret-scanning
-  // rules (gitleaks, GitHub partner patterns); shpua_ marks tokens issued
-  // while an app is still in development — the most likely to be committed.
+  // key name — a secret-sounding name with a placeholder value (as in
+  // committed `.env.example` files) is not evidence of a leak.
+  // shpat_/shpca_/shppa_/shpss_ bodies are hex; shprt_/shpsb_/shptka_/shpua_
+  // are alphanumeric. The first seven prefixes are already public via
+  // shopify.dev docs and published secret-scanning rules (gitleaks, GitHub
+  // partner patterns); shpua_ marks tokens issued while an app is still in
+  // development — the most likely to be committed.
   {
     regex: /shp(?:(?:at|ca|pa|ss)_[a-fA-F0-9]{16,}|(?:rt|sb|tka|ua)_[a-zA-Z0-9]{16,})/,
     name: 'Shopify token',