# Docs: https://developer.stackblitz.com/platform/api/authentication
# Format: StackBlitz project tokens or API keys with sb_ prefix or context-anchored
# Verify: no public verification endpoint
# Prefix: sb_, sbp_
[detector]
id = "stackblitz-credentials"
name = "StackBlitz Credentials"
service = "stackblitz"
severity = "high"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
decode_transforms = { reverse_prefixes = ["sbp_"], caesar_prefixes = ["sbp_"] }
keywords = ["sb_", "sbp_", "STACKBLITZ", "stackblitz"]
[[detector.patterns]]
# (?-i) + no underscore in the body. keyhog compiles case-insensitive by
# default, so the old `sb_[...]{20,}` matched uppercase `SB_` C macros
# (Linux USB descriptors) AND lowercase snake_case identifiers
# (sb_endpoint_descriptor, sb_cdc_acm_descriptor). Dogfood 2026-05-29:
# 75 FPs on a stock /usr/include scan, all sharing those two shapes -
# every FP identifier carried an underscore in its body; real StackBlitz
# tokens (canonical positive sb_stTzGx1SNLO8c33WrRghshvrRC1NFXIu) are
# base62 with none. Case-sensitivity kills the macros; dropping `_` from
# the body class kills the snake_case identifiers. `-` stays for tokens.
regex = "(?-i)sb_[a-zA-Z0-9-]{20,}"
description = "StackBlitz token with sb_ prefix"
[[detector.patterns]]
regex = "(?-i)sbp_[a-zA-Z0-9-]{20,}"
description = "StackBlitz project token with sbp_ prefix"
[[detector.patterns]]
regex = '''(?:STACKBLITZ|stackblitz)[_\-\s]*(TOKEN|API|KEY)[=:\s"'']+([a-zA-Z0-9_-]{20,})'''
description = "StackBlitz credential with context anchor"
group = 2
[[detector.tests]]
test_positive = "sb_stTzGx1SNLO8c33WrRghshvrRC1NFXIu"
test_negative = "YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"