All values below are fake and intentionally crafted to match common secret/token patterns for testing.
Script #1 — Secrets in comments
// The block below contains comment-only examples. Your parser must collect JS comments (onComment) to detect them.
Script #2 — Secrets in code
// Includes static string literals and template literals without expressions.
// Also includes obvious sensitive identifier assignments and header values.
Tip: parse <script> blocks with locations: true and onComment to ensure your tooling captures these tokens.