# Docs: https://sourcegraph.com/docs/cli/how-tos/creating_an_access_token
# Format: `sgp_` access tokens, either `sgp_<40 hex>` (dotcom) or
# `sgp_<16 hex|local>_<40 hex>` (instance-scoped); `slk_<64 hex>`
# license keys. Distinctive 4-char vendor prefixes.
# Added: home-turf bench (DET-17), betterleaks/kingfisher both ship
# sourcegraph fixtures keyhog had no detector for (false-negatives).
[detector]
id = "sourcegraph-access-token"
name = "Sourcegraph Access Token"
service = "sourcegraph"
severity = "high"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
keywords = ["sgp_", "slk_", "sourcegraph"]
# The sgp_/slk_ vendor prefix is strong evidence on its own; the 40/64-hex
# body scores below the global 0.40 floor on entropy alone (DET-18). Self-
# declare a lower floor so the detector ships working. FP risk is negligible
# almost nothing else takes the shape `sgp_<40 hex>` / `slk_<64 hex>`.
min_confidence = 0.2
[[detector.patterns]]
regex = 'sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}'
description = "Sourcegraph instance-scoped access token (sgp_<id>_<token>)"
group = 0
[[detector.patterns]]
regex = 'sgp_[a-fA-F0-9]{40}'
description = "Sourcegraph dotcom access token (sgp_<token>)"
group = 0
[[detector.patterns]]
regex = 'slk_[a-fA-F0-9]{64}'
description = "Sourcegraph license key (slk_<64 hex>)"
group = 0
[[detector.patterns]]
# Keyword-assignment form (no sgp_ prefix): `sourcegraph: <40 hex>`. The `[:=]`
# assignment anchor is REQUIRED so this does NOT fire on the 40-hex commit SHAs
# embedded in `sourcegraph.com/.../commit/<sha>` URLs (there the char after
# `sourcegraph` is `.`/`/`, never `:`/`=`).
regex = '''(?i)sourcegraph['"\s]*[:=]['"\s]*([a-fA-F0-9]{40})'''
description = "Sourcegraph access token in a sourcegraph= assignment"
group = 1
[[detector.tests]]
test_positive = "SRC_ACCESS_TOKEN=sgp_210f1131b08e93adcfc3f05faa2d768ff883a61f"
test_negative = "SRC_ENDPOINT=https://sourcegraph.example.com"