A 2026-07-25 copy-refresh commit accidentally stripped [extend]
useDefault = true along with its warning comment, silently disabling
all built-in secret detection rules (only the local allowlist ran).
Full-history rescan after the fix: 20 commits, no leaks found.