Epic: Add post-match filters to remaining security scanner rules (defense-in-depth)

[ajianaz]

Progress Update (2026-08-05)

✅ Fixed (via #492)

• injection/sql-concat (Static security scanner false positive: injection/sql-concat matches comments and non-SQL concatenation #485) — regex narrowed + post-match filter + 5 tests
• config/debug-enabled (Static security scanner false positive: config/debug-enabled matches legitimate CLI flags #486) — regex narrowed + post-match filter + 5 tests
• auth/hardcoded-role (auth/hardcoded-role regex misses quoted role comparisons (most common pattern) #490) — regex expanded (quoted/property access) + 8 tests

✅ Fixed (via #491)

• config/cors-wildcard — framework pattern coverage + negation filter

Still Open (3 rules)

Rule ID	Risk	Notes
injection/eval	MEDIUM	eval(req could match // evaluate request
crypto/weak-hash	LOW-MEDIUM	hashlib.md5 in import docs
crypto/ssl-verify-disabled	LOW-MEDIUM	verify: false in YAML comments

Low Priority (already specific enough)

• crypto/md5-password — requires function-call syntax, very low FP risk
• crypto/sha1-password — same
• injection/exec — already requires dynamic input indicators

Completed: 7/11 rules have defense-in-depth

Rule	Regex Quality	Post-Match Filter	Doc Skip
crypto/hardcoded-secret	✅	✅	✅
sec-hardcoded-url	✅	✅	✅
config/cors-wildcard	✅	✅	✅
injection/sql-concat	✅	✅	✅
config/debug-enabled	✅	✅	✅
auth/hardcoded-role	✅	N/A (regex specific enough)	✅
crypto/md5-password	✅	N/A (regex specific enough)	✅
crypto/sha1-password	✅	N/A (regex specific enough)	✅
injection/exec	✅	N/A (regex specific enough)	✅
injection/eval	⚠️	❌	✅
crypto/weak-hash	⚠️	❌	✅
crypto/ssl-verify-disabled	⚠️	❌	✅