[MRX-72]

Fixes #2172

Problem

detectors.apikey.ApiKey marked a key found from regex matches, then did a separate pass over SAFE_TOKENS:

for safe_token in SAFE_TOKENS:
    if safe_token in output.text:
        key_found = False

Because that check scans the whole output and resets the single key_found flag, one safe placeholder anywhere masks every credential match. An output containing both a real AWS key and a safe example scored 0.0:

AWS access key AKIAIOSFODNN7EXAMPLE alone          -> [1.0]
mongodb+srv://myuser:mypassword@... alone          -> [0.0]
both in the same output                            -> [0.0]   # should be [1.0]

Fix

Check each safe token against the individual match (match.group(0)) and skip only that match, so a safe example neutralizes its own match and nothing else.

both in the same output   -> [1.0]

Verification

$ python -m pytest tests/detectors/test_detectors_apikey.py -q
16 passed

Added test_apikey_safe_token_does_not_mask_other_match covering a real key alongside the safe example; the 15 existing cases are unchanged. black clean.

[jmartin-tech]

Duplicates #2182, while this is a simpler approach instead of opening another PR consider collaborating via review feedback or a PR to the open contributions branch in their fork.

[jmartin-tech]

I am going to promote this to ready for review and merge the preferred implementation here with the preferred more extensible tests from #2182 to merge both with credit to each contributor.