I'll cherry pick an example: the default cookie config rule(
https://github.com/bearer/bearer/blob/main//pkg/commands/pro...).
We have many places where `cookie: <EncryptedString>` is used in our code and it triggers that rule. There are a few issues with this:
- Most of the expressions where we use that pattern are used to send a full encrypted cookie string. The use of `cookie` is not the name of a key in the cookie string, its the whole cookie.
- All of the data in the cookie string itself is encrypted and also sent over https. Just matching on a regex expression won't tell you this information without an accompanying AST to verify.
Notably, we're using hapi and not express but my notes above would still apply to some use cases in express as well. Its possible I am missing the actual value of that rule, but just matching on the expression is going to generate a ton of false positives.
