v0.5.0 — docs-secret coverage

Docs-secret coverage. Closes a real gap: the check library lists a live credential pasted into a README or docs as a finding (secret-in-readme-or-docs), but no deterministic pattern implemented it. Secret patterns excluded .md/.txt to avoid drowning in placeholder keys, so a real pasted ghp_/sk-ant-/AKIA key slipped through the fast scan.

Added

• secret-in-readme-or-docs (81st pattern). Scans .md/.mdx/.txt for provider-prefixed key formats (GitHub, OpenAI, Anthropic, AWS, Google, Slack, Stripe, and AI/infra prefixes). 81 patterns now, up from 80. Check library unchanged at 332 (this implements a check that already existed).
• Live-vs-placeholder entropy gate. The doc tier only fires when the matched token reads as a live key: dropped on a placeholder marker (xxx, your, example, …), low Shannon entropy, a long single-char run, or a sequential run. It gates on the token, not the surrounding line, so a real key next to a "replace with your key" comment still fires. Tuned to favor a rare miss over a false positive.

Tests

• A true-positive fixture (a live-looking token in a .md) and a false-positive fixture (a page of placeholder keys) that must stay silent, plus the regenerated quick golden.

Note for pinned users

quick/full scans now flag live secret formats inside .md/.mdx/.txt, which earlier tags did not. Expect a new finding class if a real key was ever pasted into your docs. Placeholder keys stay silent by design.

Pin: git clone --branch v0.5.0 https://github.com/kidsmeal/git-gud-security