Sub-ticket of PLUTO-451 SCANNER_PROBE_RE env-file shape gap: dotless env.* + *.env suffix probes leak to warn (PLUTO-450 sibling). 06:22 UTC 2026-06-29 sweep (27 events) = /env.txt /env.old /env.backup (dotless env. prefix) + /<prefix>/sendgrid.env /backend|src|app|email|mailer/sendgrid.env (env SUFFIX). Current /(^|/)\.env(?:.)/ alt requires (^|/) immediately before .env, so it catches .env + nested /.env ONLY — misses env.<ext> (no leading dot) and <name>.env (suffix). All 404 (benign, no creds served). Fix = evidence-driven broadening for the env-credential-file family; coder+audit design the exact alt(s) keeping anchor discipline + real-404-signal (route-collision test; Pluto has no /env.* or *.env route). Classification-only, security-tier. audit pre-push review (regex broadening = real-404 signal risk) + PTD. · pluto