fix(hooks): examine sensitive files reached via Bash; scope fixture exceptions (S4)

fix(hooks): examine sensitive files reached via Bash; scope fixture exceptions (S4) #2101