keyhog-scanner 0.5.42

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

# Per-detector contract: sql-password
#
# Detector regex: `(?i)identified\s+(?:with\s+'?\w+'?\s+)?by\s+(['"])(...)\1`
# (two arms, one per quote style), the SQL `IDENTIFIED [WITH <plugin>] BY
# '<password>'` clause, group 1 = the plaintext login password. The
# `IDENTIFIED BY` context is credential-only; placeholder values are carried
# out by the shared identifier/example suppression, not by the regex.

schema_version = 1
detector_id = "sql-password"
service = "generic"
severity = "high"

# ---- POSITIVES (recall) ---------------------------------------------

[[positive]]
text = "CREATE USER 'svc'@'localhost' IDENTIFIED BY 'Xy9KmPq2LvWnB7tR';"
credential = "Xy9KmPq2LvWnB7tR"
reason = "Canonical MySQL CREATE USER with a single-quoted random password."

[[positive]]
text = "ALTER USER 'app'@'%' IDENTIFIED WITH mysql_native_password BY 'zK4mP9qL2vW7nB3t';"
credential = "zK4mP9qL2vW7nB3t"
reason = "ALTER USER with the optional WITH <plugin> clause before BY (the dominant MySQL 8 shape)."

[[positive]]
text = "CREATE USER admin IDENTIFIED BY \"p2Qw7RtVy1Bn6Kc4\";"
credential = "p2Qw7RtVy1Bn6Kc4"
reason = "Double-quoted value (the second pattern arm must capture it)."

[[positive]]
text = "GRANT ALL ON db.* TO 'reporter'@'10.0.0.5' IDENTIFIED BY 'Rt8Vy3Bn6Kc4mLp9';"
credential = "Rt8Vy3Bn6Kc4mLp9"
reason = "GRANT ... IDENTIFIED BY (legacy MySQL grant-with-password) carrying a random secret."

# ---- NEGATIVES (precision) ------------------------------------------

[[negative]]
text = "CREATE USER 'x'@'localhost' IDENTIFIED BY 'password';"
reason = "`password` is a dictionary placeholder (the identifier/example gauntlet must drop it)."

[[negative]]
text = "ALTER USER foo IDENTIFIED BY 'changeme';"
reason = "`changeme` is a canonical placeholder, not a real secret."

[[negative]]
text = "CREATE USER 'svc' IDENTIFIED BY 'your_password_here';"
reason = "An instructional placeholder value (must stay suppressed)."

[[negative]]
text = "The vulnerability was identified by the security team during the Q3 audit."
reason = "Prose `identified by` with no quoted value (the regex cannot match)."

[[negative]]
text = "# Each row is identified by its primary key column."
reason = "Documentation prose; `identified by` followed by words, no quoted credential."

# ---- EVASIONS (adversarial) -----------------------------------------

[[evasion]]
text = "create user 'svc'@'localhost' identified by 'h84mLpQw7RtVy1Bn';"
credential = "h84mLpQw7RtVy1Bn"
reason = "Fully lower-cased SQL (the (?i) flag must still surface the password)."

[[evasion]]
text = "logger.debug(\"running: ALTER USER 'r' IDENTIFIED BY 'qL2vW7nB3tR8sY1c'\")"
credential = "qL2vW7nB3tR8sY1c"
reason = "SQL embedded in an application log/exec string (the dominant real leak shape (must still fire))."

# ---- PERFORMANCE / SCALE BUDGETS ------------------------------------

[perf]
fixture_bytes = 4096
max_microseconds = 15000
note = "Two anchored alternations gated behind the `identified` keyword prefilter; the bounded `[^'\"]{6,128}` capture cannot run away."

[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler with one planted IDENTIFIED BY clause; the keyword prefilter keeps the regex off the vast majority of lines."