Paste something. See what the duck finds.

Runs a handful of toy pattern matches — fake AWS-style keys, wildcard IAM actions, hardcoded passwords, that sort of thing. Every finding gets a dramatic, entirely made-up incident code.