keyhog-scanner 0.5.50

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

# Per-detector contract: basic-auth-credentials
#
# Detector regex: `(?i)\bbasic\s+([A-Za-z0-9+/]{16,}={0,2})`: the HTTP Basic
# auth scheme token, whitespace, then a >=16-char base64 credential blob
# (group 1 = the blob, RFC 7617 `base64(user:pass)`). `\b` on `basic` so
# `basics`/`basically` do not trip it; the >=16-char floor keeps `Basic auth`
# / `Basic Plan` prose from matching.

schema_version = 1
detector_id = "basic-auth-credentials"
service = "generic"
severity = "high"

# ---- POSITIVES (recall) ---------------------------------------------

[[positive]]
text = "Authorization: Basic YWxhZGRpbjpvcGVuc2VzYW1l"
credential = "YWxhZGRpbjpvcGVuc2VzYW1l"
reason = "Canonical RFC 7617 Authorization header; blob = base64(aladdin:opensesame)."

[[positive]]
text = "curl -H 'Authorization: Basic YWRtaW46czNjcmV0UEBzc3cwcmQ=' https://api.internal/health"
credential = "YWRtaW46czNjcmV0UEBzc3cwcmQ="
reason = "Basic-auth header embedded in a curl command (the dominant real leak shape)."

[[positive]]
text = "headers = { \"Authorization\": \"Basic c3ZjLWRlcGxveTpHaDlfa0xtTjJwUXI=\" }"
credential = "c3ZjLWRlcGxveTpHaDlfa0xtTjJwUXI="
reason = "Hardcoded Basic-auth header in source (svc-deploy:Gh9_kLmN2pQr), 32-char blob."

# ---- NEGATIVES (precision) ------------------------------------------

[[negative]]
text = "Basic auth is required to reach this endpoint."
reason = "`Basic ` followed by the 4-char word `auth`, not a >=16-char base64 blob."

[[negative]]
text = "Covers the basics of authentication and session handling."
reason = "`basics`: no whitespace immediately after `basic`, so the `\\bbasic\\s+` anchor cannot match."

[[negative]]
text = "Basic Plan: upgrade for more storage."
reason = "Marketing prose; `Basic ` + short word, no base64 blob."

[[negative]]
text = "Authorization: Basic YWJjZGVm"
reason = "Blob `YWJjZGVm` is only 8 chars (< the 16-char floor) (too short to be a real credential)."

# ---- EVASIONS (adversarial) -----------------------------------------

[[evasion]]
text = "authorization: basic dXNlcm5hbWU6cGFzc3dvcmQ="
credential = "dXNlcm5hbWU6cGFzc3dvcmQ="
reason = "Lower-cased header + scheme token (the (?i) flag must still surface it)."

[[evasion]]
text = "# Authorization: Basic cm9vdDp0b29yMTIzNGFiY2Q="
credential = "cm9vdDp0b29yMTIzNGFiY2Q="
reason = "Commented-out header stashed in a config/script (must still fire)."

# ---- PERFORMANCE / SCALE BUDGETS ------------------------------------

[perf]
fixture_bytes = 4096
max_microseconds = 15000
note = "Single anchored alternation; the >=16-char base64 capture cannot run away."

[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB punctuation filler with one planted Basic-auth header; anchored regex stays linear."