[zztimur]

A JavaScript password variable initialized from CLI flags or environment variables currently triggers a bundled-password warning. Recognize complete lookup-only declarations in .js/.mjs/.cjs files while retaining warnings for hardcoded values, literal fallbacks, later assignments, and text configuration files.

The exception requires a complete single-line declaration ending in a semicolon. Earlier template delimiters leave the context uncertain, so those files retain the warning even when a preceding template appears closed. This deliberately conservative fix does not change output redaction, public finding codes, severity, CLI arguments, or the report schema. Credential/network dependency reporting remains separate in #5.

Validation:

• Regression-only commit0398de1: 212/222 runtime checks passed; exactly10 lookup cases reproduced the false positive.
• Review found a template-string masking risk. Regression commit4241f7f: 230/232 checks passed; exactly2 template cases exposed the missing warning, then a conservative guard was added.
• Final branch CI 34071495913 passed all seven jobs at commit873f4af; review has no remaining actionable findings. Fixtures cover real folder/ZIP inspection, inside/outside-root files, literals, fallbacks, mixed assignments, and unsupported syntax.

Fixes #4.