Credentials in context

Catches credentials that do not match a known vendor format — internal tokens, database
passwords, connection strings. Default: report.
How it works
Rather than matching a shape, it looks for a credential-ish keyword close to a value that
behaves like a secret. "password", "api_key", "token", "secret" next to something that
looks like a value rather than a description.
Why it defaults to report, not warn
This is a heuristic and it is wrong more often than the format matchers. It deliberately
filters out the common innocent cases — a type annotation like 
password: string, a
placeholder with no digits, a variable name with no value attached — but it will still
sometimes flag a config example.
Run it in report for a while and look at what it actually catches in Activity before
you promote it. If your team writes a lot of infrastructure code, expect noise.
What is recorded
Kind and count only, like every other detector. Never the matched value.