From 079b2ceb82a33f90b5a7701436f6ca2c8ff58e30 Mon Sep 17 00:00:00 2001
From: drew <drew@local>
Date: Thu, 20 Aug 2026 10:14:58 +0300
Subject: [PATCH] post-deploy: a credential-shaped line, which must still push
 while the scan is off

---
 svc/postdeploy.go | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 svc/postdeploy.go

diff --git a/svc/postdeploy.go b/svc/postdeploy.go
new file mode 100644
index 0000000..02a1264
--- /dev/null
+++ b/svc/postdeploy.go
@@ -0,0 +1,6 @@
+package svc
+
+// PostDeploy verifies the new binary changed nothing. This line looks like a
+// credential and must still be accepted while the flag is unset:
+// aws_access_key_id = AKIAIOSFODNN7EXAMPLE
+func PostDeploy() string { return "ok" }