keyhog-scanner 0.5.73

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

schema_version = 1
detector_id = "saltstack-credentials"
service = "saltstack"
severity = "critical"

[[positive]]
text = "SALT_API_USERNAME=saltadmin\nSALT_API_PASSWORD=Xy9KmPq2LvWnB7tR"
credential = "Xy9KmPq2LvWnB7tR"
reason = "The password is the secret; the nearby username is companion context."

[[positive]]
text = "SALT_API_PASSWORD=\"Xy9KmPq2LvWnB7tR\""
credential = "Xy9KmPq2LvWnB7tR"
reason = "Quoted password variant without public-identity emission."

[[negative]]
text = "SALT_API_USERNAME=saltadmin"
reason = "A username alone is public identity, not a credential finding."

[[negative]]
text = "SALT_API_PASSWORD=YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"
reason = "Placeholder-keyword body (suppression gate matches PLACEHOLDER prefix)."

[[negative]]
text = "SALT_API_PASSWORD=saltadmin_EXAMPLE"
reason = "EXAMPLE token marker inside the body (suppression gate strips it)."

[[evasion]]
text = "export SALT_API_PASSWORD=Xy9KmPq2LvWnB7tR"
credential = "Xy9KmPq2LvWnB7tR"
reason = "Adversarial env_export envelope preserves the password finding."

[perf]
fixture_bytes = 4096
max_microseconds = 25000
note = "Standard single-file budget."

[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler + planted credential."