Problem Narrative

You’re on the platform security team at a fintech processing millions of card transactions per day. Infrastructure-as-Code (IaC) changes (Terraform/CloudFormation-like text) are merged hundreds of times daily, and a single leaked credential in a commit can trigger incident response, regulatory reporting, and customer-impacting key rotation.

Before promoting changes to production, your CI pipeline runs a lightweight scanner over the IaC text to detect hardcoded secrets and unsafe interpolation patterns.

Task

Implement a function that scans a list of IaC script lines and returns the 1-indexed line numbers that should be blocked.

A line is blocked if it contains either:

1. Hardcoded secret assignment: a key in {password, secret, token, api_key, private_key} (case-insensitive) is assigned a value using = or : where the value is a string literal:

   • String literal is enclosed in single or double quotes.
   • Examples that should be blocked:
     • password = "hunter2"
     • api_key: 'AKIA...'
   • Examples that should not be blocked:
     • password = var.db_password
     • token = env.TOKEN

2. Unsafe interpolation inside a string literal: any string literal that contains ${ ... } where the inside expression contains a direct reference to one of the secret keys above (case-insensitive), e.g. ${token} or ${ user.token }.

Important Notes / Rules

• Ignore anything after # unless the # is inside a string literal.
• Quotes can be escaped with a backslash (e.g., " or \').
• You may assume each input line is at most 10,000 characters.
• Return blocked line numbers in increasing order.

Examples

Example 1

• Input:
  • lines = [ "db_password = var.db_password", "password = \"hunter2\" # TODO rotate", "name = \"service-${token}\"" ]
• Output: [2, 3]
• Explanation:
  • Line 2 assigns password to a quoted literal → hardcoded secret.
  • Line 3 contains ${token} inside a quoted string → unsafe interpolation.

Example 2

• Input:
  • lines = [ "# token = 'should_not_count'", "desc = \"literal with # not a comment\"", "api_key: env.API_KEY", "url = \"https://x/${user.api_key}/y\"" ]
• Output: [4]
• Explanation:
  • Line 1 is a comment → ignored.
  • Line 3 assigns api_key but value is not a string literal → allowed.
  • Line 4 references api_key inside ${...} within a string literal → blocked.

Constraints

• 1 <= len(lines) <= 2 * 10^5
• Total characters across all lines <= 2 * 10^6
• Lines contain ASCII characters