keyhog-scanner 0.2.1

High-performance secret detection engine with Hyperscan NFA, GPU pattern matching, entropy scoring, and decode-through scanning
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

const KNOWN_PREFIXES: &[&str] = &[
    "ghp_",
    "gho_",
    "ghu_",
    "ghs_",
    "ghr_",
    "github_pat_",
    "sk_live_",
    "sk_test_",
    "pk_live_",
    "pk_test_",
    "rk_live_",
    "AKIA",
    "ASIA",
    "xoxb-",
    "xoxp-",
    "xoxa-",
    "xoxr-",
    "sk-proj-",
    "sk-ant-",
    "SG.",
    "hf_",
    "npm_",
    "pypi-",
    "glpat-",
    "dop_v1_",
    "PRIVATE KEY",
    "eyJ",
];

/// Return a minimum confidence floor for credentials with well-known literal prefixes.
pub fn known_prefix_confidence_floor(credential: &str) -> Option<f64> {
    if KNOWN_PREFIXES
        .iter()
        .any(|prefix| credential.starts_with(prefix))
    {
        Some(0.8)
    } else {
        None
    }
}

#[cfg(test)]
mod tests {
    use super::known_prefix_confidence_floor;

    #[test]
    fn known_prefix_floor_matches_expected_prefixes() {
        assert_eq!(
            known_prefix_confidence_floor("sk_live_51H7xKjGf0a1b2c3"),
            Some(0.8)
        );
        assert_eq!(
            known_prefix_confidence_floor("ghp_xxxxxxxxxxxxxxxxxxxx"),
            Some(0.8)
        );
        assert_eq!(
            known_prefix_confidence_floor("github_pat_xxxxxxxxxxxxxx"),
            Some(0.8)
        );
        assert_eq!(
            known_prefix_confidence_floor("AKIAIOSFODNN7EXAMPLE"),
            Some(0.8)
        );
        assert_eq!(
            known_prefix_confidence_floor("sk-proj-xxxxxxxxxxxxxxxx"),
            Some(0.8)
        );
        assert_eq!(
            known_prefix_confidence_floor("dop_v1_xxxxxxxxxxxxxxxxx"),
            Some(0.8)
        );
    }

    #[test]
    fn known_prefix_floor_returns_none_for_unknown_prefixes() {
        assert_eq!(known_prefix_confidence_floor("random_string"), None);
        assert_eq!(known_prefix_confidence_floor(""), None);
        assert_eq!(known_prefix_confidence_floor("sk_live"), None);
        assert_eq!(known_prefix_confidence_floor("ghp"), None);
    }
}