schema_version = 1
detector_id = "google-forms-api-credentials"
service = "google"
severity = "critical"
[[positive]]
text = "google forms api key abcdefghijklmnopqrstuvwxyz123456"
credential = "abcdefghijklmnopqrstuvwxyz123456"
reason = "Canonical anchor + synthesized body satisfying detector's primary regex."
[[positive]]
text = "GOOGLE_FORMS private_key=\"YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY3ODkwYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY3ODkwYWJjZGVmZ2hpamtsbW5vcA==\""
credential = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY3ODkwYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY3ODkwYWJjZGVmZ2hpamtsbW5vcA=="
reason = "Quoted-value variant of the canonical positive."
[[negative]]
text = "GOOGLE_FORMS=short"
reason = "Truncated value below detector minimum length."
[[negative]]
text = "GOOGLE_FORMS token abcdef"
reason = "Keyword context without valid credential body."
[[evasion]]
text = "google forms api key abcdefghijklmnopqrstuvwxyz123456"
credential = "abcdefghijklmnopqrstuvwxyz123456"
reason = "Adversarial anchor_bare envelope — credential must still surface under this detector."
[perf]
fixture_bytes = 4096
max_microseconds = 25000
note = "Standard single-file budget."
[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler + planted Google Forms API Credentials credential."
readme_claim = "900 service-specific detectors"