feat(rules): add 5 Nigerian fintech & betting hardcoded secret detectors

New high-impact rules detecting hardcoded credentials from major Nigerian payment and betting platforms:
• Paystack (live/test keys)
• Flutterwave/Rave
• Remita merchant + hash
• Interswitch MAC keys
• SportyBet/BetKing JWT tokens

Same patterns already shipped in:
- Nuclei: projectdiscovery/nuclei-templates#14253
- TruffleHog: trufflesecurity/trufflehog#4588

Author: @LloydCoder (Tinlance) 🇳🇬

Author: LloydCoder

rules/nigeria/fintech/lloydcoder-nigerian-fintech-secrets.yaml

@@ -0,0 +1,75 @@
+rules:
+  - id: hardcoded-paystack-secret-key
+    patterns:
+      - pattern-either:
+          - pattern: sk_live_...
+          - pattern: sk_test_...
+      - pattern-not: sk_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      - pattern-not: sk_test_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+    message: >-
+      Hardcoded Paystack secret key detected (live or test). Never commit real keys!
+      Use environment variables instead (e.g., os.getenv("PAYSTACK_SECRET_KEY")).
+    languages: [python, javascript, typescript, java, go, ruby, php]
+    severity: ERROR
+    metadata:
+      category: security
+      subcategory: secret-management
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp: "A07:2021 – Identification and Authentication Failures"
+      confidence: HIGH
+      license: Commons Clause License
+      author: Lloydcoder
+      source: https://github.com/Lloydcoder
+      tags: nigeria,paystack,fintech,secrets
+
+  - id: hardcoded-flutterwave-secret-key
+    patterns:
+      - pattern-either:
+          - pattern: FLWSECK-...
+          - pattern: FLWSECK_TEST-...
+          - pattern: FLWSECK_...
+      - pattern-not: FLWSECK-xxxxxxxxxxxxxxxxxxxx
+    message: >-
+      Hardcoded Flutterwave (Rave) secret key detected. Use env vars instead!
+    languages: [python, javascript, typescript, java, go]
+    severity: ERROR
+    metadata:
+      category: security
+      subcategory: secret-management
+      author: Lloydcoder
+      tags: nigeria,flutterwave,rave,fintech,secrets
+
+  - id: hardcoded-remita-credentials
+    patterns:
+      - pattern-regex: \b\d{10,15}\|[a-zA-Z0-9]{40,}\b
+      - pattern-regex: merchantId\s*[:=]\s*["']?\d{10,}["']?
+    message: >-
+      Possible Remita merchant ID + API hash or key exposed in code.
+    languages: [python, javascript, typescript]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,remita,fintech,secrets
+
+  - id: hardcoded-interswitch-mackey
+    patterns:
+      - pattern-regex: macKey["']?\s*[:=]\s*["']?[0-9A-Fa-f]{64}["']?
+    message: >-
+      Interswitch Webpay MAC key hardcoded. This is extremely sensitive!
+    languages: [python, javascript, typescript, php]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,interswitch,webpay,fintech,secrets
+
+  - id: hardcoded-sportybet-betking-token
+    patterns:
+      - pattern-regex: eyJ[A-Za-z0-9-_]{100,}
+      - pattern-regex: Bearer [A-Za-z0-9-_]{50,}\.[A-Za-z0-9-_]{50,}\.[A-Za-z0-9-_]{50,}
+    message: >-
+      Possible SportyBet/BetKing JWT or admin token hardcoded. High risk!
+    languages: [python, javascript, typescript, go]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,betting,sportybet,betking,secrets,jwt