From 211b896f8246c7f0f9ebab2c9f29a2ce145eff62 Mon Sep 17 00:00:00 2001
From: Doxa Maps <maps@doxa.example>
Date: Fri, 25 Sep 2026 22:58:39 +0000
Subject: [PATCH] wip-census2

---
 internal/landing-preconditions.mjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/landing-preconditions.mjs b/internal/landing-preconditions.mjs
index 1589ecf0f..6327ed036 100644
--- a/internal/landing-preconditions.mjs
+++ b/internal/landing-preconditions.mjs
@@ -47,7 +47,7 @@ const run = (cmd, args) => spawnSync(cmd, args, { cwd: ROOT, encoding: 'utf8', e
 const BUILTIN = [
   { re: 'sk\\.eyJ', why: 'a Mapbox SECRET token' },
   { re: 'BEGIN (RSA|OPENSSH|EC) PRIVATE', why: 'a private key' },
-  { re: 'oauth2:', why: 'a credential in a URL' },
+  { re: 'oauth2[:]', why: 'a credential in a URL' },   // [:] so this line does not match itself
 ]
 const CENSUS_FILE = process.env.DOXA_CENSUS_FILE || resolve(ROOT, '..', 'internal-tracker', 'public-census.tsv')
 if (!existsSync(CENSUS_FILE)) refuse(`the public-safety census list is missing (${CENSUS_FILE})`,
@@ -62,7 +62,7 @@ for (const c of census) {
   if (g.status > 1) refuse(`census: git grep failed on /${c.re}/`, g.stderr.trim())
   for (const line of g.stdout.split('\n').filter(Boolean)) {
     const m = /^HEAD:([^:]+):(\d+):(.*)$/.exec(line)
-    if (!m || c.excl.includes(m[1])) continue
+    if (!m || (c.excl || []).includes(m[1])) continue
     if (c.allow && new RegExp(c.allow).test(m[3])) continue
     hits.push(`${m[1]}:${m[2]}  ${c.why || `census pattern #${census.indexOf(c) + 1}`}`)
   }