The GENERIC_PASSWORD rule is off by default because it’s a bit different than the other rules - rather than matching a specific key format, with minimal false positives, it searches for general occurrences and variations of the term “password” in context. This is meant to catch the unintentional use of passwords in code or documentation.
However, due to its broad nature, this rule generates many false positives; many of these can be mitigated by using false positive filters. However, it’s important to consciously configure this rule with factors specific to your organization’s remediation flow, false positive tolerance, and the nature of the data within your organization’s code and knowledge base.