keyhog-scanner 0.5.41

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

schema_version = 1
detector_id = "unitycloud-api-key"
service = "unitycloud"
severity = "critical"

# Auto-generated contract (gen_contracts.py). Hand-edit to add more
# real-world shapes; the auto-stub validates the detector at
# least fires on its canonical-shape anchor + body.

[[positive]]
text = "UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5"
credential = "UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5"
reason = "Canonical anchor + synthesized body satisfying detector's primary regex."

[[positive]]
text = "UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5\""
credential = "UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5"
reason = "Quoted-value variant of the canonical positive."

[[negative]]
text = "YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"
reason = "Placeholder-keyword body (suppression gate matches PLACEHOLDER prefix)."

[[negative]]
text = "UCA-ZEXAMPLEEXAMPLEBVcD5"
reason = "EXAMPLE token marker inside the body (suppression gate strips it)."

# ---- EVASION (adversarial) -----------------------------------------

[[evasion]]
text = "[unity-cloud-build] 2024-11-02 build job authenticated via UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5"
credential = "UCA-Z7aLR0tW7QWBqHSP89uZk8UIOiWtFvrodTd9E1rCPCUIz5Vd113Zzedwsvor3GP5aVL5ZUvY1zdWm2X6Jy9SV4lIFWGGBVcD5"
reason = "UCA- key printed in a build log line with no assignment keyword; the UCA- prefix anchor fires regardless of surrounding context."