fix(secret-scanning): avoid leaking git clone credentials

[GautamBytes]

Context

Secret Scanning V2 cloned GitHub, GitLab, and Bitbucket repositories by embedding provider credentials directly in HTTPS clone URLs. When git clone failed, Node's child-process error message could include the full command line, and the raw scan error could then be stored as scan status or sent in failure notifications.

This PR changes the V2 clone path to pass credential-free remote URLs to git, provide credentials through a temporary GIT_ASKPASS helper, strip inherited Git trace env vars from the child process, and redact sensitive auth data from scan error messages before they are stored or sent.

Screenshots

N/A

Type

• Fix
• Feature
• Improvement
• Breaking
• Docs
• Chore

Checklist

• Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
• Tested locally
• Updated docs (if needed)
• Updated CLAUDE.md files (if needed)
• Read the contributing guide

[greptile-apps]

Greptile Summary

This PR hardens the Secret Scanning V2 git clone path by moving provider credentials out of HTTPS clone URLs and into a temporary GIT_ASKPASS shell script, stripping inherited git trace environment variables from the child process, and applying redaction to error messages before they are stored or forwarded. The approach is well-tested and eliminates the primary credential-leak vectors identified in the description.

• cloneRepository now validates that remoteUrl carries no embedded credentials, writes a per-scan git-askpass.sh into the unique temp directory, sets GIT_TERMINAL_PROMPT=0, and cleans up the helper after the clone completes.
• parseScanErrorMessage (and the internal sanitizeErrorMessage) now redact user:password@host URL patterns and Authorization header values in addition to truncating at 1 024 characters.
• All three provider factories (GitHub, GitLab, Bitbucket) are updated to pass a credential-free remoteUrl plus a typed auth struct.

Confidence Score: 4/5

The credential-isolation change is sound and well-tested; one logic flaw in the cleanup error path can cause a successful clone to surface as a failure, or hide the actual git error on failure.

The cleanupAskPass().then(..., reject) pattern passes the outer reject as the cleanup failure handler, so any rm failure replaces the clone outcome with a filesystem error — this affects all three provider paths and is worth fixing before merging.

secret-scanning-v2-fns.ts — specifically the execFile callback cleanup chain; all other changed files look correct.

Security Review

• SSRF via user-controlled GitLab instance URL (gitlab-secret-scanning-factory.ts line 263): new URL(instanceUrl).host validates URL structure but does not restrict the resolved host to external addresses. An actor who can set or modify the connection's instanceUrl could direct the backend to clone from an internal endpoint (e.g., AWS metadata service, Kubernetes API). This is a pre-existing exposure surfaced on the changed code path.

Important Files Changed

Filename	Overview
backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-fns.ts	Core change: replaces credential-embedded clone URLs with a GIT_ASKPASS helper and strips git trace env vars; cleanup Promise rejection handler can swallow the original git error.
backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-fns.test.ts	New unit tests covering credential redaction, URL sanitization, GIT_TRACE env var stripping, and rejection with sanitized errors; coverage is thorough for the happy and error paths.
backend/src/ee/services/secret-scanning-v2/gitlab/gitlab-secret-scanning-factory.ts	Credentials moved out of the clone URL to the new auth parameter; the user-supplied instanceUrl is only structurally parsed, not validated against private IP ranges (pre-existing SSRF exposure).
backend/src/ee/services/secret-scanning-v2/github/github-secret-scanning-factory.ts	Replaces credentialed GitHub clone URL with credential-free URL + auth struct; straightforward and correct.
backend/src/ee/services/secret-scanning-v2/bitbucket/bitbucket-secret-scanning-factory.ts	Replaces credentialed Bitbucket clone URL with credential-free URL + auth struct; straightforward and correct.
backend/src/ee/services/secret-scanning-v2/secret-scanning-v2-types.ts	Type updated to replace cloneUrl with remoteUrl and optional auth struct; clean and consistent with the implementation.

_{Reviews (1): Last reviewed commit: "fix(secret-scanning): avoid leaking git ..." | Re-trigger Greptile}