[Feedback] How is 'ProtectSensitiveData' flagged?

### Feedback

Hi, I would like to understand more on how the 'ProtectSensitiveData' rule is flagged because there seem to be instances where fields that are not an auth token or have no key words that suggest it's a token are flagged for this rule.

Is the rule flagged due to certain keywords being detected in the field name? Or is something detected in the xml file?

Thanks

### Context

_No response_

### Suggestions

_No response_

### Additional Information

_No response_