Possible additional categories of secrets for rule codeguard-1-hardcoded-credentials

[billbrietstout]

Description

1. Proprietary API keys, internal service tokens, or database credentials that use arbitrary formats
2. Common dev/test passwords like password123, admin, letmein, P@ssw0rd, or application-specific defaults.
3. Assigned to variables without "password/secret/key/token/auth" (e.g., cfg, conn, apiInit, dbCreds, serviceAccount, value)
4. Obfuscated or Constructed at Runtime
5. Formats Not Explicitly Called Out; OAuth, session, or custom JWT-like tokens that don't start with eyJ.
6. SSH keys or certificates without full contiguous blocks (split or commented)
7. Secrets in Comments, Tests, Docs, or History. Leftover in test fixtures, example code, migration scripts, or commented-out sections.
8. Vendor-Specific or Less Common Services like snmp public strings, tokens from Azure, GCP, etc.

What AI Coding Tool are you Using?

Claude Code

AI Model Used

Any

The feedback pertains to which aspect of the project?

Rule definition