# Docs: https://developers.google.com/forms/api/reference/rest
# Format: Google service account JSON with private_key and client_email
# Verify: no public verification endpoint (requires OAuth flow)
# Prefix: none (requires context anchoring)
[detector]
id = "google-forms-api-credentials"
name = "Google Forms API Credentials"
service = "google"
severity = "critical"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
# DET-18 floor override: vendor anchor is distinctive; the body scores below the
# 0.40 global floor on entropy alone, dropping a real token as a false negative
# (SecretBench mirror floor-gate analysis). FP risk bounded by the anchor.
min_confidence = 0.28
keywords = ["google_forms", "GOOGLE_FORMS", "forms.googleapis.com"]
[[detector.patterns]]
regex = '''(?:google[_\-\s]*forms?|GOOGLE[_\-\s]*FORMS)[\s"'':=]+[^}]*(?:private[_\-\s]*key|private_key)[\s"'':=]+([A-Za-z0-9+/=]{100,})'''
description = "Google Forms API private key in service account JSON"
group = 1
[[detector.patterns]]
regex = '''(?:google[_\-\s]*forms?|GOOGLE[_\-\s]*FORMS)[_.\s]*(?:api[_\-\s]*key|API[_\-\s]*KEY)[\s"'':=]+([A-Za-z0-9_-]{30,})'''
description = "Google Forms API key with context anchor"
group = 1
[[detector.tests]]
test_positive = "google forms api key abcdefghijklmnopqrstuvwxyz123456"
test_negative = "GOOGLE_FORMS=short"