keyhog-scanner 0.5.73

keyhog-scanner: high-performance SIMD-accelerated secret detection engine
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

schema_version = 1
detector_id = "threads-api-token"
service = "threads"
severity = "high"

# Auto-generated contract (gen_contracts.py). Hand-edit to add more
# real-world shapes; the auto-stub validates the detector at
# least fires on its canonical-shape anchor + body.

[[positive]]
text = "threadid=\":   \"   :=  '   ==\"'  =::      '\"       ' \"'\"  \"    =    :   :          '  '= '   \"  \" \"   \": 7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
credential = "7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
reason = "Canonical anchor + synthesized body satisfying detector's primary regex."

[[positive]]
text = "threadid=\":   \"   :=  '   ==\"'  =::      '\"       ' \"'\"  \"    =    :   :          '  '= '   \"  \" \"   \": 7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
credential = "7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
reason = "Quoted-value variant of the canonical positive."

[[negative]]
text = "threadid=\":   \"   :=  '   ==\"'  =::      '\"       ' \"'\"  \"    =    :   :          '  '= '   \"  \" \"   \": YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"
reason = "Placeholder-keyword body (suppression gate matches PLACEHOLDER prefix)."

[[negative]]
text = "threadid=\":   \"   :=  '   ==\"'  =::      '\"       ' \"'\"  \"    =    :   :          '  '= '   \"  \" \"   \": 7K4lqEXAMPLEEXAMPLExGZLH"
reason = "EXAMPLE token marker inside the body (suppression gate strips it)."

# ---- EVASION (adversarial) -----------------------------------------

[[evasion]]
text = "# access token leaked to log, rotate: THREADS_ACCESS_TOKEN=7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
credential = "7K4lq8YH2dZbHWOzNLjPPa3mCnnalyOSJlEGrPQvurQBHIAR9Y6G1D5CEsBOITC7AbByJxV8ZjRQuFECSQ5GnqrGsRSawQJxGZLH"
reason = "Commented-out leaked token; the 100-char value surfaces (caught by the overlapping wordpress-api-token detector after value-dedup (same credential, valid catch))."