fix: line content for repeated secrets and 10K byte lines

[cx-diogo-rocha]

Closes #

Proposed Changes
Fixes to line content on these cases:

• Repeated secrets in same line all shared same lineContent, now line lineContent correctly wraps around each instance of the secret
• Lines bigger than 10k bytes had their line content always be the start of the line, now lineContent correctly wraps around the secret by looking at startColumn of the secret

Checklist

• I covered my changes with tests.
• I Updated the documentation that is affected by my changes:
  • Change in the CLI arguments
  • Change in the configuration file

I submit this contribution under the Apache-2.0 license.

[stepsecurity-app]

✅ Resolved — a later workflow run passed this policy check.

Original alert (resolved)

Security Policy Alert: Secret Policy Violation

This workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch.

Secret references detected:

• secrets.ECHO_LIBRARIES_ACCESS_KEY at line 16

To approve this workflow, please add the workflows-approved label to this PR.

Note: The label must be added by someone other than the PR author (cx-diogo-rocha) or automation bots to ensure proper security review.

After the label is added, you can re-run the blocked workflow to proceed.

This workflow will be automatically approved once merged into the default branch.

For more information, see StepSecurity's Secret Exfiltration Policy documentation.

[github-actions]

⚠️ Potential secret(s) detected (unverified)

@cx-diogo-rocha — TruffleHog found 2 potential secret(s) in this PR (0 verified, 2 unverified).

Secret Type	Status	Commit	File Path	View
GoogleGeminiAPIKey	⚠️ unverified	7ffc56ebdb	engine/engine_test.go	🔎 View secret
GoogleGeminiAPIKey	⚠️ unverified	7ffc56ebdb	engine/engine_test.go	🔎 View secret

🛠 Guidelines to remediate hardcoded secrets

• Understand the implications of revoking this secret by investigating where it is used in your code.
• Immediately rotate/revoke the exposed secret. (https://howtorotate.com/docs/introduction/getting-started/)
• Remove it from git history ( a new "remove secret" commit is NOT enough e.g. with git-filter-repo).

To avoid such incidents in the future consider:

• Following the best practices for managing and storing secrets, including API keys and other credentials.
• Re-scan after cleanup before merging.

⚠️ These are unverified matches and do not block the merge — please review and confirm they are not real secrets.