# Docs: https://docs.deepnote.com/docs/api
# Format: Deepnote API token with dn_ prefix or context-anchored
# Verify: GET /v1/projects with Bearer token returns 200 if valid
# Prefix: dn_
[detector]
id = "deepnote-api-credentials"
name = "Deepnote API Credentials"
service = "deepnote"
severity = "high"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
keywords = ["dn_", "DEEPNOTE", "deepnote"]
# Real Deepnote tokens begin `dn_` at a word/quote/equals boundary.
# The original anchorless pattern matched any `dn_` substring, so
# Go/C identifiers like `idn_curlx_convert_wchar_to_UTF8` (curl idn.c)
# and Caesar-decoded natural-language runs in non-source files
# (sqlite GNUmakefile, llama-cpp ggml-cuda.cu via /caesar) fired.
# Anchor to start-of-string OR a non-identifier byte before `dn_`,
# capture the actual token as group 1.
[[detector.patterns]]
regex = "(?:^|[^A-Za-z0-9_])(dn_[a-zA-Z0-9_-]{20,})"
description = "Deepnote API token with dn_ prefix (anchored)"
group = 1
[[detector.patterns]]
# Allow multi-word suffix sequences like `DEEPNOTE_API_KEY=` and
# `DEEPNOTE_SECRET_TOKEN=` (common real-world env-var shapes), not
# just single suffixes. Prior `[_\\s]*(API|TOKEN|KEY)` could only span
# one of API/TOKEN/KEY and missed the doubled-up forms.
regex = '''(?:DEEPNOTE|deepnote)(?:[_\-\s]*(?:API|TOKEN|KEY|SECRET|ACCESS|AUTH)){1,3}[=:\t\r\n "'']{1,16}([a-zA-Z0-9_-]{20,})'''
description = "Deepnote API credential with context anchor"
group = 1
[detector.verify]
method = "GET"
url = "https://api.deepnote.com/v1/projects"
allowed_domains = ["api.deepnote.com"]
[detector.verify.auth]
type = "bearer"
field = "match"
[detector.verify.success]
status = 200
policy = "status_with_error_backstop"
[[detector.tests]]
test_positive = "dn_Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5Tb8Vw3Yz"
test_negative = "dn_Kp4Qx7Rm"