- Implements recon.ReconSource against GitLab Search API - PRIVATE-TOKEN header auth; rate.Every(30ms) burst 5 (~2000/min) - Disabled when token empty; Sweep returns nil without calls - Emits Finding per blob with Source=/projects/<id>/-/blob/<ref>/<path> - 401 wrapped as ErrUnauthorized; ctx cancellation honored - httptest coverage: enabled gating, happy path, 401, ctx cancel, iface assert