fix(rules): detect Go short declarations, YAML/JSON keys and SQL PASSWORD literals (#618, #619, #620)

[ajianaz]

What

Three hardcoded-secret false negatives pinned in KNOWN_GAPS are fixed and their rows moved into CASES:

• Go (fix(rules): Go short declarations and untyped-colon types are not matched (password := "...") #618): password := "..." (with or without a trailing comment) and var apiKey string = "...".
• YAML/JSON (fix(rules): unquoted YAML secrets and quoted JSON keys are not detected #619): unquoted password: hunter2hunter2 and quoted keys "password": "...", "apiKey": "...".
• SQL (fix(rules): SQL CREATE USER ... PASSWORD '<literal>' is not detected #620): CREATE USER app WITH PASSWORD '<literal>' and IDENTIFIED BY '<literal>'.

Changes: crypto/hardcoded-secret regex (optional quote after the key, := only before a quoted literal, colon-free type before =, SQL PASSWORD '...'); sec-hardcoded-secret pattern is now built by one shared secret_literal_pattern() that the LLM cross-check (apply_llm_secret_fp_filter) also uses via has_secret_literal, so LLM findings on the new shapes are not dropped; is_false_positive_secret gains YAML plain-scalar, quoted-placeholder and SQL-placeholder handling.

YAML rule (conservative): a whole-line key: value whose key ends in a secret word is flagged only if the value is one token of at least 8 chars containing a digit or symbol, and is not $.../${...}, a tag/anchor/alias, a path, a keyword (true/null/...). Bare alphabetic words (required, formPassword) stay references.

Why

Precision and recall both matter for secret detection; these shapes were silently missed. #616/#617 (env-var and interpolation false positives) are out of scope and their rows are unchanged.

Testing

• New CASES rows, positive and negative: password: ${DB_PASSWORD}, !secret db, null, ~, required, *alias, &anchor, password_file: /run/secrets/x, "password": "", "password": "${X}", "password": "{{ x }}", SQL PASSWORD '%s'/'$1'/':pw'/'{pw}'/''/NULL, Go "" and os.Getenv forms, etc. No existing row changed.
• New postprocess test: LLM cross-check keeps findings on the new shapes and drops placeholders.
• cargo fmt, clippy -D warnings, full cargo test x3 green.
• Built binary: cora scan and cora review --staged on sample Go/YAML/JSON/SQL files with an unreachable LLM report the expected lines and none of the negatives.

Closes #618
Closes #619
Closes #620

🤖 Generated with Claude Code