keyhog-scanner 0.5.44

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

schema_version = 1
detector_id = "wordpress-api-token"
service = "wordpress"
severity = "high"

# Auto-generated contract (gen_contracts.py). Hand-edit to add more
# real-world shapes; the auto-stub validates the detector at
# least fires on its canonical-shape anchor + body.

[[positive]]
text = "access-token '    : \"  '     =   : =     =  '' =     '  '\" '=    \" \" =:  lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc"
credential = "lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc"
reason = "Canonical anchor + synthesized body satisfying detector's primary regex."

[[positive]]
text = "access-token '    : \"  '     =   : =     =  '' =     '  '\" '=    \" \" =:  lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc"
credential = "lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc"
reason = "Quoted-value variant of the canonical positive."

[[negative]]
text = "access-token '    : \"  '     =   : =     =  '' =     '  '\" '=    \" \" =:  YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"
reason = "Placeholder-keyword body (suppression gate matches PLACEHOLDER prefix)."

[[negative]]
text = "access-token '    : \"  '     =   : =     =  '' =     '  '\" '=    \" \" =:  lc%PFEXAMPLEEXAMPLEcCSnc"
reason = "EXAMPLE token marker inside the body (suppression gate strips it)."

# ---- EVASION (adversarial) -----------------------------------------

[[evasion]]
text = "# wordpress access_token=lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc  # blog"
credential = "lc%PF8RBcccLMTOWauL6V%RM3uWA4svAHhkHtrTcvE2QRQGMr20xjfxEOtPczoGZOT07sN7v5W0bWdEMCsEt4jlWQiCcCSnc"
reason = "Commented-out config; wordpress access_token keyword + token (with % chars) intact inside the comment."