X_SECRET_COMPARE_UNSCANNED
Means
the scan read no source file
Typical cause
same class as an empty glob: a clean answer over nothing read
Fix
edit SOURCE_PATTERNS in scripts/boundaries.ts so it matches this repo layout, then bun run scripts/secret-compare.ts