keyhog-scanner 0.5.41

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

schema_version = 1
detector_id = "libsql-credentials"
service = "libsql"
severity = "high"

# Positives are REAL libsql/Turso credential shapes, not a synthesized
# regex-satisfying body. A bare numeric host (`libsql://78167825`) is correctly
# suppressed as numeric noise on every path, it fires 0 matches direct AND
# through decode-through, so it was a fake positive (Law-6) that only passed
# the primary regex. These fire on the direct scan and survive base64/hex/url
# decode-through (verified against the compiled scanner).

[[positive]]
text = "libsql://myapp-db-a1b2c3d4.turso.io"
credential = "myapp-db-a1b2c3d4.turso.io"
reason = "Canonical Turso remote URL (libsql:// scheme + alphanumeric database host)."

[[positive]]
text = "SQLD_AUTH_TOKEN=aB3dEf6gH9jK2mN5pQ8rS1tU4vW7xY0z"
credential = "aB3dEf6gH9jK2mN5pQ8rS1tU4vW7xY0z"
reason = "SQLD_AUTH_TOKEN context anchor + 32-char alphanumeric auth token."

[[negative]]
text = "libsql://YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"
reason = "Placeholder-keyword body (suppression gate matches PLACEHOLDER prefix)."

[[negative]]
text = "SQLD_AUTH_TOKEN=aB3dEf6gH9jEXAMPLE2mN5pQ8rS1tU4vW"
reason = "EXAMPLE marker inside the token body (suppression strips example tokens)."

[[evasion]]
text = "libsql://myapp-db-a1b2c3d4.turso.io"
credential = "myapp-db-a1b2c3d4.turso.io"
reason = "Adversarial header_bare envelope (credential must still surface under this detector)."

[perf]
fixture_bytes = 4096
max_microseconds = 25000
note = "Standard single-file budget."

[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler + planted credential."