Two ways to reuse a privileged CI token (and my rule only caught one)

I shipped a security rule this week, looked at it again the next morning, and realized it only caught half the bug it was supposed to catch. This is mcpscan, a static scanner I maintain that checks MC...