* docs: add generic config-secret custom detector example
Custom Detectors already support omitting the `verify` webhook, in
which case matches are simply reported as unverified. This makes them
usable for flagging generic hardcoded secrets (e.g. *.password=,
*.secret=) in config files like .properties, .env, and .yaml, which
the built-in verified detectors intentionally don't cover.
Adds examples/generic_config_secrets.yml, tuned for that use case
(looser than generic_with_filters.yml, which requires a digit and a
special char), with entropy filtering and exclude rules for common
placeholders (changeme, ${VAR}, {{ .template }}, etc.) to keep false
positives down. Also links to it from README.md and
CUSTOM_DETECTORS.md next to the existing `verify`-optional docs.
Addresses #4957.
* fix: scope placeholder excludes to captured value, not full match
exclude_regexes_match runs against the entire key=value match, so the
env/vault/kms exclude rules were dropping real hardcoded secrets
whenever the key path happened to contain a word like "env" (e.g.
env.password=..., app.env.secret=...) -- common in config files this
example targets. Switch to exclude_regexes_capture so these rules only
look at the value being reported.
Flagged by Cursor Bugbot on PR #5195.
Patience Mpofu
e12da3c72f