keyhog-core 0.5.4

keyhog-core — shared data model and detector specifications for the KeyHog secret scanner
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

# Docs: https://docs.optimism.io/
# Format: Optimism RPC endpoints use API keys in URL path or Authorization header
# Verify: no public verification endpoint
# Prefix: none (requires context anchoring)

[detector]
id = "optimism-api-credentials"
name = "Optimism API Credentials"
service = "optimism"
severity = "high"
keywords = ["optimism", "OPTIMISM", "op", "OP", "optimistic.etherscan", "optimism.io"]

[[detector.patterns]]
regex = '(?:optimism|OPTIMISM|op|OP)[._-]?(?:rpc|RPC)[._-]?(?:url|URL|endpoint)[=:"	\s]+(https?://[a-zA-Z0-9._-]+\.g\.alchemy\.com/v2/[a-zA-Z0-9_-]+)'
description = "Optimism RPC URL with Alchemy API key"
group = 1

[[detector.patterns]]
regex = '(?:optimism|OPTIMISM|op|OP)[._-]?(?:rpc|RPC)[._-]?(?:url|URL|endpoint)[=:"	\s]+(https?://[a-zA-Z0-9._-]+/optimism/[a-zA-Z0-9_-]+)'
description = "Optimism RPC URL with embedded access token"
group = 1

[[detector.patterns]]
regex = '(?:optimism|OPTIMISM|op|OP)[._-]?(?:rpc|RPC)[._-]?(?:url|URL|endpoint)[=:"	\s]+(https?://api-[a-zA-Z0-9._-]+\.dwellir\.com/[a-zA-Z0-9_-]+)'
description = "Optimism RPC URL with Dwellir API key"
group = 1

[[detector.patterns]]
regex = '(?:optimism|OPTIMISM|op|OP)[._-]?(?:api|API)[._-]?key[=:"	\s]+([a-f0-9]{32})'
description = "Optimism API key (32 hex characters)"
group = 1