Sub-ticket of PLUTO-446 PLUTO-442 follow-up: SCANNER_PROBE_RE misses /.dev.vars (Cloudflare Workers/Wrangler local-secrets file) -> logs warn instead of the silent info/malicious tier. Confirmed by audit as the ONLY current-regex cred-probe gap (the 08:46 sweep's ~18 other cred shapes — .env+12 variants, .aws/credentials, secrets.json, config.json, .git/config|HEAD — all classify correctly). Add ONE anchored alt to the SCANNER_PROBE_RE array in not-found-classify.ts, mirroring the .env alt shape: /(^|\/)\.dev\.vars(?:$|[./~0-9_-])/ (covers .dev.vars + .dev.vars.production/.local siblings; NO speculative broadening per 442 discipline). Collision-test vs real routes (audit pre-verified zero — leading-dot segment matches no app/api route). Security-tier, benign-impact (all 404'd, zero exposure). Standard push->audit PTD. · pluto