Sub-ticket of PLUTO-450 SCANNER_PROBE_RE: ROOT-anchored .git (and .aws) alts miss NESTED credential-dir probes -> leak to warn (446-sibling anchor asymmetry). Audit-confirmed: 03:38 UTC 2026-06-29 scanner burst = 26 distinct <prefix>/.git/config probes (/admin /api /app /assets /backend /blog /build ... /www) ALL warn/navigation; only root /.git/config + /wp-content/.git/config caught. Cause: not-found-classify.ts has /^\/\.git(?:$|\/)/ (root-anchored ^\/) while the correct sibling .env alt is (^|\/)\.env. FIX (one-char-class each, mirror .env): (1) /^\/\.git(?:$|\/)/ -> /(^|\/)\.git(?:$|\/)/ ; (2) ALSO /^\/\.aws\b/ -> /(^|\/)\.aws\b/ — structurally identical root-anchor gap on an existing credential alt; same scanner class nests .aws identically, so fix it in the same pass (PM call: structural-consistency, not speculative broadening). The (?:$|\/) boundary keeps .git to the DIRECTORY (still won't match /.gitignore). Collision test (audit pre-verified): zero — no Pluto route has a .git or .aws path segment; leading-dot segment is never an app/api route. Do NOT add .svn/.hg/.bzr (no alts exist, zero data — speculative). Benign-impact, all 404'd, no repo/creds served. Security-tier classification fix. gitpush --patch -> audit PTD (audit will fire a live nested-.git probe to confirm the down-tier). · pluto