schema_version = 1
detector_id = "replicate-api-key"
service = "replicate"
severity = "critical"
[[positive]]
text = "r8_Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5Tb8Vw"
credential = "r8_Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5Tb8Vw"
reason = "Replicate r8_-prefixed API token (37 alnum body)."
[[positive]]
text = "REPLICATE_API_TOKEN=r8_Vk9Bn3Lp7Qm2Rs5Tw8Vk9Bn3Lp7Qm2Rs5Tw8Vk"
credential = "r8_Vk9Bn3Lp7Qm2Rs5Tw8Vk9Bn3Lp7Qm2Rs5Tw8Vk"
reason = "Standard REPLICATE_API_TOKEN env-var assignment."
[[negative]]
text = "r8_short"
reason = "Body below 37 alnum chars after `r8_` prefix."
[[evasion]]
text = "Authorization: Bearer r8_Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5Tb8Vw"
credential = "r8_Kp4Qx7Rm2Sn5Tb8Vw3YzKp4Qx7Rm2Sn5Tb8Vw"
reason = "Bearer-header wrap around prefix detector."
[perf]
fixture_bytes = 4096
max_microseconds = 25000
note = "Standard single-file budget."
[scale]
fixture_bytes = 1048576
min_findings = 1
max_seconds = 2.0
note = "1 MiB filler + planted Replicate key."
readme_claim = "900 service-specific detectors"