fix(detectors): detect current token formats and close dead branches - #110
Merged
Merged
Conversation
pixincreate
force-pushed
the
refactor/module-file-layout
branch
from
September 14, 2026 16:14
c26dca9 to
fc3c1c3
Compare
pixincreate
force-pushed
the
fix/detector-formats
branch
from
September 14, 2026 16:14
65557b2 to
d640f26
Compare
Several real-world credential formats were silently undetectable, and a new regression test now pins one realistic sample per format-anchored detector through the same keyword-gate and accept chain the scanner uses, so a keyword/pattern desync can no longer ship unnoticed. Misses fixed: - GitHub fine-grained PATs (github_pat_, 82 word characters) get their own detector; the old (github)_ branch stopped at the token's inner underscore and no keyword covered it. ghr_ refresh tokens added. - Slack tokens match the modern segment lengths (10-13 digits, 24-char bot suffix) plus the xoxa/xoxr version segment. xoxa- was in the pattern but not the keywords (dead); xoxr- was a keyword the pattern rejected (inert). Slack app tokens (xapp-) and webhook URLs are new. - AWS access keys cover ASIA/ABIA/ACCA prefixes, and a context-gated AWSSecretKeyDetector catches the 40-character secret access key with an exact-length terminator so longer base64 runs are not truncated into false matches. - GenericKeyValueDetector gains the auth and _key keywords its pattern always had; auth = and encryption_key = lines never reached the regex before. - NRAK New Relic keys match case-insensitively; the lowercase-only class could never fire on real uppercase keys. - OpenAI project keys (sk-proj-/sk-svcacct-/sk-admin-) get their own detector; the legacy pattern stopped at the hyphen. False positives cut: - Identity-number detectors (SSN, Aadhaar, PAN, Voter ID, ABHA) require the line to name the document, matching the HighEntropyDetector precedent; any 14-digit order id no longer reports HIGH. - Stripe publishable keys (pk_) split into their own LOW detector; rk_ restricted keys are detected as secrets. - The AWS documentation example secret in .env.example files is allowlisted in the generic detector. Cleanups: the Kimi detector is upper-bounded at 47 so 48+ character sk- tokens report under the OpenAI label, the redundant RSA-only private key detector and the subset HighEntropyDetector alternative are removed, ya29. requires a minimum length, and pnpm-lock.yaml, bun.lock(b) and npm-shrinkwrap.json join the default lockfile excludes. A few fixture lines carry keywatch:ignore so scans with older releases stay clean, and the committed baseline is regenerated for the new set. Assisted-by: Claude Fable 5 Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>
pixincreate
force-pushed
the
fix/detector-formats
branch
from
September 14, 2026 16:19
d640f26 to
fb8d09e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked PR 2 of 5 (base:
refactor/module-file-layout, merges after #109).Detector fixes, verified end to end:
New detections: GitHub fine-grained PATs (
github_pat_) andghr_refresh tokens, modern Slack bot tokens plusxapp-app tokens and webhook URLs, AWSASIA/ABIA/ACCAprefixes and a context-gated AWS secret access key rule, OpenAI project keys (sk-proj-/sk-svcacct-/sk-admin-), uppercase New Relic NRAK keys, and theauth =/encryption_key =branches of the generic detector that a missing keyword left unreachable.False positives cut: identity-number detectors (SSN, Aadhaar, PAN, Voter ID, ABHA) now require the line to name the document; Stripe publishable keys report LOW under their own detector; the AWS documentation example secret in
.env.examplefiles is allowlisted.A new regression test pins one realistic sample per format-anchored detector through the real keyword-gate and accept chain, so a keyword/pattern desync can no longer ship silently. Some fixture lines carry
keywatch:ignoreso scans with older releases stay clean. The committed baseline is regenerated.