v2025.9.1.1 - FP Filter Improvements

What's Changed

Added

• 10 Content-Based FP Detection Rules - New patterns to reduce false positives on non-secret content:
  • masked_asterisks - 10+ asterisks indicate redacted values (95% confidence)
  • crlf_line_ending - Windows line endings / ShellCheck SC1017 (90%)
  • html_encoded_mask - HTML-encoded masked values in reports (92%)
  • sentry_dsn - Sentry DSNs are public by design (90%)
  • example_marker - Values marked as example/sample/test/mock (92%)
  • placeholder_text - YOUR_/REPLACE_/CHANGEME/TODO:/FIXME: markers (95%)
  • fedauth_cookie - Session cookies in forensic captures (85%)
  • env_var_bash - ${VAR} references not hardcoded values (92%)
  • env_var_windows - %VAR% references (92%)
  • redacted_marker - REDACTED/MASKED/[REMOVED]/[HIDDEN]/XXXXXXX (95%)

Fixed

• Expanded Scan Exclusions - Project-specific exclusions to reduce FPs:
  • Scan outputs: .medusa/, medusa_output/
  • Research extractions: docs/research/nblm/, docs/codex/, docs/falsepositives/, docs/docker/
  • Test folders: tests/, test-install/, **/fixtures/, **/mocks/
  • IDE configs: .claude/, .idea/, .vscode/, .cursor/
  • Linter configs: .hadolint.yaml, .semgrep.*, .gitleaks.toml, .eslintrc*, etc.

Total FP patterns: 44 → 54

Installation

pip install --upgrade medusa-security