Function is_safe_literal_reference 

pub fn is_safe_literal_reference(value: &str) -> bool

Returns whether a literal is a narrowly recognized external secret reference.

Literal credentials, token-shaped strings, generic URLs, and every URI containing userinfo are rejected. Supported references are environment variables, selected secret-provider URIs, and absolute secret-file paths.