schema_version = 1
detector_id = "sourcegraph-access-token"
service = "sourcegraph"
severity = "high"
[[positive]]
text = "SRC_ACCESS_TOKEN=sgp_719f3553f917bddb719f3553f917bddb719f3553"
credential = "sgp_719f3553f917bddb719f3553f917bddb719f3553"
reason = "Sourcegraph dotcom access token (sgp_<40 hex>)."
[[positive]]
text = "sourcegraph token: sgp_3957fd1bb1df7593_b9d77d9b315ff513b9d77d9b315ff513b9d77d9b"
credential = "sgp_3957fd1bb1df7593_b9d77d9b315ff513b9d77d9b315ff513b9d77d9b"
reason = "Sourcegraph instance-scoped token (sgp_<16 hex>_<40 hex>)."
[[positive]]
text = "SRC_LICENSE_KEY=slk_5dfb11bfd57399375dfb11bfd57399375dfb11bfd57399375dfb11bfd5739937"
credential = "slk_5dfb11bfd57399375dfb11bfd57399375dfb11bfd57399375dfb11bfd5739937"
reason = "Sourcegraph license key (slk_<64 hex>)."
[[positive]]
text = "sourcegraph: 6d2fabeb6add229bc199faba28fd3efb57df0bd3"
credential = "6d2fabeb6add229bc199faba28fd3efb57df0bd3"
reason = "Keyword-assignment form (no sgp_ prefix): sourcegraph: <40 hex> (betterleaks homefield FN this closes)."
[[negative]]
text = "SRC_ENDPOINT=https://sourcegraph.example.com"
reason = "Sourcegraph endpoint URL, no sgp_/slk_ token."
[[negative]]
text = "https://sourcegraph.com/github.com/o/r/-/commit/6d2fabeb6add229bc199faba28fd3efb57df0bd3"
reason = "40-hex commit SHA in a sourcegraph.com URL (the char after `sourcegraph` is `.`/`/`, not `:`/`=`, so the keyword-assignment pattern must NOT fire (FP avoidance))."
[[evasion]]
text = "sourcegraph sgp_719f3553f917bddb719f3553f917bddb719f3553"
credential = "sgp_719f3553f917bddb719f3553f917bddb719f3553"
reason = "Space-separated sourcegraph keyword + token."
[perf]
fixture_bytes = 4096
max_microseconds = 25000
note = "Standard single-file budget."
[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler + planted Sourcegraph token."