feat(rules): add Nigerian fintech hardcoded secret detectors by @Lloydcoder

rules/nigeria/fintech/lloydcoder-nigerian-fintech-secrets.yaml

@@ -0,0 +1,75 @@
+rules:
+  - id: hardcoded-paystack-secret-key
+    patterns:
+      - pattern-either:
+          - pattern: sk_live_...
+          - pattern: sk_test_...
+      - pattern-not: sk_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+      - pattern-not: sk_test_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+    message: >-
+      Hardcoded Paystack secret key detected (live or test). Never commit real keys!
+      Use environment variables instead (e.g., os.getenv("PAYSTACK_SECRET_KEY")).
+    languages: [python, javascript, typescript, java, go, ruby, php]
+    severity: ERROR
+    metadata:
+      category: security
+      subcategory: secret-management
+      cwe: "CWE-798: Use of Hard-coded Credentials"
+      owasp: "A07:2021 – Identification and Authentication Failures"
+      confidence: HIGH
+      license: Commons Clause License
+      author: Lloydcoder
+      source: https://github.com/Lloydcoder
+      tags: nigeria,paystack,fintech,secrets
+
+  - id: hardcoded-flutterwave-secret-key
+    patterns:
+      - pattern-either:
+          - pattern: FLWSECK-...
+          - pattern: FLWSECK_TEST-...
+          - pattern: FLWSECK_...
+      - pattern-not: FLWSECK-xxxxxxxxxxxxxxxxxxxx
+    message: >-
+      Hardcoded Flutterwave (Rave) secret key detected. Use env vars instead!
+    languages: [python, javascript, typescript, java, go]
+    severity: ERROR
+    metadata:
+      category: security
+      subcategory: secret-management
+      author: Lloydcoder
+      tags: nigeria,flutterwave,rave,fintech,secrets
+
+  - id: hardcoded-remita-credentials
+    patterns:
+      - pattern-regex: \b\d{10,15}\|[a-zA-Z0-9]{40,}\b
+      - pattern-regex: merchantId\s*[:=]\s*["']?\d{10,}["']?
+    message: >-
+      Possible Remita merchant ID + API hash or key exposed in code.
+    languages: [python, javascript, typescript]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,remita,fintech,secrets
+
+  - id: hardcoded-interswitch-mackey
+    patterns:
+      - pattern-regex: macKey["']?\s*[:=]\s*["']?[0-9A-Fa-f]{64}["']?
+    message: >-
+      Interswitch Webpay MAC key hardcoded. This is extremely sensitive!
+    languages: [python, javascript, typescript, php]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,interswitch,webpay,fintech,secrets
+
+  - id: hardcoded-sportybet-betking-token
+    patterns:
+      - pattern-regex: eyJ[A-Za-z0-9-_]{100,}
+      - pattern-regex: Bearer [A-Za-z0-9-_]{50,}\.[A-Za-z0-9-_]{50,}\.[A-Za-z0-9-_]{50,}
+    message: >-
+      Possible SportyBet/BetKing JWT or admin token hardcoded. High risk!
+    languages: [python, javascript, typescript, go]
+    severity: ERROR
+    metadata:
+      author: Lloydcoder
+      tags: nigeria,betting,sportybet,betking,secrets,jwt