# Docs: https://appwrite.io/docs/advanced/platform/api-keys
# Format: Unique prefix with project context - standard keys are 256-bit hex or 32-char mixed
# Verify: GET /v1/account with X-Appwrite-Key header returns 200 if valid
# Prefix: none (requires context anchoring with project ID)
[detector]
id = "appwrite-api-key"
name = "Appwrite API Key"
service = "appwrite"
severity = "critical"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
keywords = ["appwrite", "X-Appwrite-Key", "APPWRITE_API_KEY", "APPWRITE_KEY"]
[[detector.patterns]]
regex = '''\b(?:APPWRITE|appwrite)[_\-\s]*(?:API[_\-\s]*KEY|KEY)[=:\s"']+([a-zA-Z0-9_-]{32,64})'''
description = "Appwrite API key with context anchor"
group = 1
[[detector.patterns]]
regex = "\\bX-Appwrite-Key[=:\\s\"']+([a-zA-Z0-9_-]{32,64})"
description = "Appwrite API key in header context"
group = 1
[[detector.companions]]
name = "appwrite_project_id"
regex = "[a-z0-9]{20}"
within_lines = 5
[detector.verify]
method = "GET"
url = "https://cloud.appwrite.io/v1/account"
allowed_domains = ["cloud.appwrite.io"]
[detector.verify.auth]
type = "header"
name = "X-Appwrite-Key"
template = "{{match}}"
[detector.verify.success]
status = 200
policy = "status_with_error_backstop"
[[detector.tests]]
test_positive = "APPWRITE_API_KEY=Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5"
test_negative = "APPWRITE_API_KEY=short"