_is_sensitive false-positives on directory names containing "secret"/"token"/"password" as substrings #436

re.compile(r'(credential|secret|passwd|password|token|private_key)', re.IGNORECASE),
                                                                                                                                                    
No word boundaries. Matches secret inside Secretary, token inside tokenizer, password inside password_manager (the last is probably desired — but
the substring match also catches safe collisions).                                                                                                  
                           
Proposed fix                                 
                                                                                                                                                    
Add \b word boundaries to that single pattern:
                                                                                                                                                    
re.compile(r'\b(credential|secret|passwd|password|token|private_key)\b', re.IGNORECASE),
                                                                                                                                                    
The other _SENSITIVE_PATTERNS entries (dotfiles, key extensions, id_rsa family, etc.) already have sufficient specificity and don't need changes.
                                                                                                                                                    
Additional observations
                                                                                                                                                    
1. When files are skipped as sensitive, the user isn't warned unless they inspect detected['skipped_sensitive'] in the dict. A repo with thousands
of skipped files produces a silently-incomplete graph.                                                                                              
2. _is_sensitive is called on the full path string (full = str(path)), so even using Path('.') as root doesn't fully help — per-file paths still
contain the offending substrings. My project's workaround is a runtime monkey-patch of _SENSITIVE_PATTERNS[2], which isn't persistable.             
3. Consider surfacing the skipped count at build-time when >N% of discovered files are dropped (e.g., WARNING: 84% of discovered files skipped as 
sensitive — check patterns).                                                                                                                        
                                                                                                                                                    
Workaround for others hitting this           
                                                                                                                                                    
import re, graphify.detect
graphify.detect._SENSITIVE_PATTERNS[2] = re.compile(                                                                                                
    r'\b(credential|secret|passwd|password|token|private_key)\b',
    re.IGNORECASE                                                                                                                                   
)