pleno-dlp

module
v0.64.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 14, 2026 License: AGPL-3.0

README

Pleno DLP banner

Pleno DLP

DLP scanner for secrets and PII. Single Go binary.

test release license go version 

brew install plenoai/tap/pleno-dlp   # signed release binary
go install github.com/plenoai/pleno-dlp/cmd/pleno-dlp@latest

pleno-dlp protect
pleno-dlp scan filesystem ./repo
pleno-dlp scan git --repo ./repo --max-depth 200
pleno-dlp scan filesystem ./repo --format sarif > findings.sarif

Sources

filesystem, git history (branch, depth, and time filters), stdin, and SaaS connectors: GitHub, GitLab, Bitbucket, Slack, Notion, Confluence, Jira, and more.

pleno-dlp scan git --repo ./repo --branch main --max-depth 500
git diff | pleno-dlp scan stdin --label git-diff
pleno-dlp scan github --org acme
pleno-dlp sources list

Detectors

619 built-in detector types (counting method), benchmarked against trufflehog and gitleaks for recall, noise, and verification value. Table, JSON, or SARIF output; allowlists and org-specific rules via config.

pleno-dlp detectors list
pleno-dlp scan filesystem ./repo --format sarif > findings.sarif

Verification

Findings are checked against the provider API by default where one exists. Verdicts are three-valued: verified (confirmed live at scan time), unverified, indeterminate. Detectors that cannot verify are classified in docs/verify-coverage.md.

pleno-dlp detectors list --verify-status

Revocation

pleno-dlp revoke invalidates leaked GitHub, GitLab, Slack, and Stripe restricted-key credentials from the CLI; AWS additionally needs operator-supplied IAM admin context. Each attempt writes a schema-versioned JSON Lines audit record (--audit-trail <path>, default stderr). Gating rules: docs/revoke-support.md

echo "$LEAKED_TOKEN" | PLENO_DLP_ALLOW_REVOKE=1 pleno-dlp revoke --detector github --secret - --confirm
pleno-dlp revoke --detector slack --secret xoxb-... --dry-run
pleno-dlp detectors list --revoke-support

PII detection

Opt-in. Engines and setup in docs/pii-detection.md.

pleno-dlp scan filesystem ./src --pii-engine=anonymize

GitHub Action

- uses: actions/checkout@v7
- uses: plenoai/pleno-dlp@v0.62.0
  with:
    sarif-file: results.sarif
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: results.sarif

The action cosign-verifies the pinned release binary before running it.

Agent hooks

pleno-dlp hooks install claude-code|cursor runs an offline scan stdin --no-verify inside the agent's own hook, flagging a credential before it is written or committed. Latency numbers are in docs/hooks.md.

pleno-dlp hooks install claude-code
pleno-dlp hooks install cursor

License

AGPL-3.0

Directories

Path Synopsis
bench
docsync command
Command docsync regenerates docs/comparison.md's "Live re-measurement" section from bench/results/results.json (issue #299: keep the published comparison numbers true automatically, without hand-editing the doc on every tag push or competitor release).
 Command docsync regenerates docs/comparison.md's "Live re-measurement" section from bench/results/results.json (issue #299: keep the published comparison numbers true automatically, without hand-editing the doc on every tag push or competitor release).
gen command
Command gen writes the dlp-bench synthetic recall corpus (see bench/README.md and docs/comparison.md §2) to disk: one file per credential type, plus a labels.json ground-truth manifest the harness (bench/harness) and any third party reads instead of re-deriving.
 Command gen writes the dlp-bench synthetic recall corpus (see bench/README.md and docs/comparison.md §2) to disk: one file per credential type, plus a labels.json ground-truth manifest the harness (bench/harness) and any third party reads instead of re-deriving.
git-history command
git-history/fixture
harness command
Package main implements the dlp-bench re-run harness (issue #298): it runs pleno-dlp, trufflehog, and gitleaks against the same corpus and reports recall per tool.
 Package main implements the dlp-bench re-run harness (issue #298): it runs pleno-dlp, trufflehog, and gitleaks against the same corpus and reports recall per tool.
labels
Package labels defines the ground-truth manifest schema shared by bench/gen (writer) and bench/harness (reader), so the two never drift on field names independently.
 Package labels defines the ground-truth manifest schema shared by bench/gen (writer) and bench/harness (reader), so the two never drift on field names independently.
cmd
pleno-dlp command
Command pleno-dlp wires build metadata, registries, and exit codes.
 Command pleno-dlp wires build metadata, registries, and exit codes.
pleno-dlp/cmd
Shared audit-trail wiring for every revoke code path (issue #304): `revoke --detector/--secret` (single), `revoke --revoke-from-spool` (spool), and `scan --revoke-on-verified` (on-verified).
 Shared audit-trail wiring for every revoke code path (issue #304): `revoke --detector/--secret` (single), `revoke --revoke-from-spool` (spool), and `scan --revoke-on-verified` (on-verified).
pkg
ahocorasick
Package ahocorasick is a small in-repo Aho-Corasick multi-pattern matcher used by the engine as a keyword prefilter across all registered detectors.
 Package ahocorasick is a small in-repo Aho-Corasick multi-pattern matcher used by the engine as a keyword prefilter across all registered detectors.
archive
Package archive expands zip, tar, gzip, and bzip2 payloads into leaf entries.
 Package archive expands zip, tar, gzip, and bzip2 payloads into leaf entries.
audit
Package audit defines the versioned audit-trail schema for verify/revoke runs (issue #304 — moat roadmap item 9, loop provenance).
 Package audit defines the versioned audit-trail schema for verify/revoke runs (issue #304 — moat roadmap item 9, loop provenance).
connectors
Package connectors holds SaaS connectors and adapts them to sources.Source.
 Package connectors holds SaaS connectors and adapts them to sources.Source.
connectors/confluence/storage
Package storage converts Confluence storage-format XHTML to plain text.
 Package storage converts Confluence storage-format XHTML to plain text.
connectors/jira/adf
Package adf converts Atlassian Document Format (ADF) JSON trees into plain text.
 Package adf converts Atlassian Document Format (ADF) JSON trees into plain text.
connectors/jira/storage
Package storage converts Jira storage-format XHTML into plain text.
 Package storage converts Jira storage-format XHTML into plain text.
connectors/notion/markdown
Package markdown converts Notion block JSON into a Markdown string.
 Package markdown converts Notion block JSON into a Markdown string.
decoder
Package decoder expands a chunk into the original plus useful decoded variants.
 Package decoder expands a chunk into the original plus useful decoded variants.
detectors
Package detectors defines the detector interfaces and result types.
 Package detectors defines the detector interfaces and result types.
detectors/abnormalsec
Package abnormalsec detects Abnormal Security API tokens near the `abnormal` / `abnormalsecurity` keyword.
 Package abnormalsec detects Abnormal Security API tokens near the `abnormal` / `abnormalsecurity` keyword.
detectors/abstractapi
Package abstractapi detects AbstractAPI keys — 32 hex strings near the `abstractapi` keyword.
 Package abstractapi detects AbstractAPI keys — 32 hex strings near the `abstractapi` keyword.
detectors/activecampaign
Package activecampaign detects ActiveCampaign API keys (60-80 char alnum).
 Package activecampaign detects ActiveCampaign API keys (60-80 char alnum).
detectors/adobeio
Package adobeio detects Adobe.io key/secret pairs and verifies them via IMS.
 Package adobeio detects Adobe.io key/secret pairs and verifies them via IMS.
detectors/adyen
Package adyen detects Adyen API keys (long alnum prefixed by AQE/AQF) gated on the `adyen` keyword window, and verifies them live against the Adyen Checkout API.
 Package adyen detects Adyen API keys (long alnum prefixed by AQE/AQF) gated on the `adyen` keyword window, and verifies them live against the Adyen Checkout API.
detectors/agenta
Package agenta detects Agenta LLM-ops API keys (`agenta_` prefix + alnum).
 Package agenta detects Agenta LLM-ops API keys (`agenta_` prefix + alnum).
detectors/agoraio
Package agoraio detects Agora.io realtime app ID + app certificate pairs near the `agora` keyword.
 Package agoraio detects Agora.io realtime app ID + app certificate pairs near the `agora` keyword.
detectors/ahrefs
Package ahrefs detects Ahrefs SEO API tokens — 32+ alnum near the `ahrefs` keyword.
 Package ahrefs detects Ahrefs SEO API tokens — 32+ alnum near the `ahrefs` keyword.
detectors/ai21labs
Package ai21labs detects AI21 Labs API keys — long alphanumerics near the `ai21` keyword.
 Package ai21labs detects AI21 Labs API keys — long alphanumerics near the `ai21` keyword.
detectors/aihorde
Package aihorde detects AI Horde (Stable Horde) API keys near the `aihorde` / `stablehorde` keyword.
 Package aihorde detects AI Horde (Stable Horde) API keys near the `aihorde` / `stablehorde` keyword.
detectors/aikidosecurity
Package aikidosecurity detects Aikido Security API tokens (40-char base62) gated on the `aikido` keyword window.
 Package aikidosecurity detects Aikido Security API tokens (40-char base62) gated on the `aikido` keyword window.
detectors/airbrake
Package airbrake detects Airbrake user API keys.
 Package airbrake detects Airbrake user API keys.
detectors/airbyte
Package airbyte detects Airbyte API tokens — long base64url-ish tokens near the `airbyte` keyword.
 Package airbyte detects Airbyte API tokens — long base64url-ish tokens near the `airbyte` keyword.
detectors/airtable
Package airtable detects Airtable PATs (`pat<14>.<64-hex>`) and the legacy `key<14>` API keys, verifying via /v0/meta/bases.
 Package airtable detects Airtable PATs (`pat<14>.<64-hex>`) and the legacy `key<14>` API keys, verifying via /v0/meta/bases.
detectors/aiven
Package aiven detects Aiven personal access tokens (32+ char base62 near `aiven`), verifying via /v1/me with `Authorization: aivenv1 <token>`.
 Package aiven detects Aiven personal access tokens (32+ char base62 near `aiven`), verifying via /v1/me with `Authorization: aivenv1 <token>`.
detectors/akamai
Package akamai detects Akamai EdgeGrid client_secret strings (32+ char base64) gated on client_secret / edgegrid assignment context.
 Package akamai detects Akamai EdgeGrid client_secret strings (32+ char base64) gated on client_secret / edgegrid assignment context.
detectors/alchemy
Package alchemy detects Alchemy blockchain RPC API keys — 32-char alnum strings near the `alchemy` keyword.
 Package alchemy detects Alchemy blockchain RPC API keys — 32-char alnum strings near the `alchemy` keyword.
detectors/alephalpha
Package alephalpha detects Aleph Alpha API tokens — long alnum / hyphen strings near the `aleph` keyword.
 Package alephalpha detects Aleph Alpha API tokens — long alnum / hyphen strings near the `aleph` keyword.
detectors/algolia
Package algolia detects Algolia admin API keys (32 lowercase hex) and optionally pairs them with the application id when one is in scope.
 Package algolia detects Algolia admin API keys (32 lowercase hex) and optionally pairs them with the application id when one is in scope.
detectors/aliyun
Package aliyun detects Alibaba Cloud (Aliyun) AccessKey id + secret pairs.
 Package aliyun detects Alibaba Cloud (Aliyun) AccessKey id + secret pairs.
detectors/all
Package all blank-imports every concrete detector for self-registration.
 Package all blank-imports every concrete detector for self-registration.
detectors/alloy
Package alloy detects Alloy KYC API token + secret pairs near the `alloy` keyword.
 Package alloy detects Alloy KYC API token + secret pairs near the `alloy` keyword.
detectors/amplitude
Package amplitude detects Amplitude analytics API key + secret pairs near the `amplitude` keyword.
 Package amplitude detects Amplitude analytics API key + secret pairs near the `amplitude` keyword.
detectors/anonymize
Package anonymize is the detector half of the pleno-anonymize PII engine integration (ADR-0001 / ADR-0002).
 Package anonymize is the detector half of the pleno-anonymize PII engine integration (ADR-0001 / ADR-0002).
detectors/anthropic
Package anthropic detects Anthropic API keys (sk-ant-…) and verifies them with a 1-token /v1/messages probe.
 Package anthropic detects Anthropic API keys (sk-ant-…) and verifies them with a 1-token /v1/messages probe.
detectors/anthropicadmin
Package anthropicadmin detects Anthropic Console admin API keys (`sk-ant-admin-...`) which are distinct from runtime API keys (`sk-ant-api03-...`).
 Package anthropicadmin detects Anthropic Console admin API keys (`sk-ant-admin-...`) which are distinct from runtime API keys (`sk-ant-api03-...`).
detectors/anyscale
Package anyscale detects Anyscale API keys — `esct_<base64ish>` or 40+ char alphanumeric strings near the `anyscale` keyword.
 Package anyscale detects Anyscale API keys — `esct_<base64ish>` or 40+ char alphanumeric strings near the `anyscale` keyword.
detectors/apikeyassignment
Package apikeyassignment detects low-entropy `api_key`/`api-key`/ `apikey` assignments in ini/YAML-shaped config files — `key: value` or `key = value`, unquoted key, optionally trailed by a `#` comment — the same family of shapes hardcodedpassword already covers for `password`/`passwd`/`pwd`, but for a distinct keyword hardcodedpassword deliberately does not key on (an unqualified "key" substring match would be far too broad for that detector's generic assignment scan).
 Package apikeyassignment detects low-entropy `api_key`/`api-key`/ `apikey` assignments in ini/YAML-shaped config files — `key: value` or `key = value`, unquoted key, optionally trailed by a `#` comment — the same family of shapes hardcodedpassword already covers for `password`/`passwd`/`pwd`, but for a distinct keyword hardcodedpassword deliberately does not key on (an unqualified "key" substring match would be far too broad for that detector's generic assignment scan).
detectors/apns
Package apns detects Apple Push Notification service .p8 PEM private keys gated on the `apns` keyword window.
 Package apns detects Apple Push Notification service .p8 PEM private keys gated on the `apns` keyword window.
detectors/apollo
Package apollo detects Apollo.io sales-engagement API keys — long alnum strings near the `apollo` keyword.
 Package apollo detects Apollo.io sales-engagement API keys — long alnum strings near the `apollo` keyword.
detectors/appcenter
Package appcenter detects Microsoft Visual Studio App Center API tokens (40-hex co-occurring with `appcenter`) and verifies them against /v0.1/user using the documented `X-API-Token` header.
 Package appcenter detects Microsoft Visual Studio App Center API tokens (40-hex co-occurring with `appcenter`) and verifies them against /v0.1/user using the documented `X-API-Token` header.
detectors/appdynamics
Package appdynamics detects AppDynamics API client + secret pairs near the `appdynamics` keyword.
 Package appdynamics detects AppDynamics API client + secret pairs near the `appdynamics` keyword.
detectors/appsignal
Package appsignal detects AppSignal push API keys — 32-char lowercase hex near the `appsignal` keyword.
 Package appsignal detects AppSignal push API keys — 32-char lowercase hex near the `appsignal` keyword.
detectors/appstoreconnect
Package appstoreconnect detects App Store Connect API .p8 PEM private keys gated on the `app_store_connect` keyword window.
 Package appstoreconnect detects App Store Connect API .p8 PEM private keys gated on the `app_store_connect` keyword window.
detectors/arduinocloud
Package arduinocloud detects Arduino IoT Cloud client credentials — long alnum strings near an `arduino` keyword.
 Package arduinocloud detects Arduino IoT Cloud client credentials — long alnum strings near an `arduino` keyword.
detectors/argocd
Package argocd detects Argo CD API tokens (JWT-shaped).
 Package argocd detects Argo CD API tokens (JWT-shaped).
detectors/arizeai
Package arizeai detects Arize AI (arize.com) ML-observability API keys (40-80 alnum) near an arize_api_key-style assignment anchor.
 Package arizeai detects Arize AI (arize.com) ML-observability API keys (40-80 alnum) near an arize_api_key-style assignment anchor.
detectors/asana
Package asana detects Asana personal access tokens (PAT shape: 1/<16 digits>/<32 hex>) and verifies them against /users/me.
 Package asana detects Asana personal access tokens (PAT shape: 1/<16 digits>/<32 hex>) and verifies them against /users/me.
detectors/assemblyai
Package assemblyai detects AssemblyAI API keys (32-char lowercase hex near `assemblyai` keyword).
 Package assemblyai detects AssemblyAI API keys (32-char lowercase hex near `assemblyai` keyword).
detectors/atlassian
Package atlassian detects Atlassian Cloud API tokens (ATATT3-prefixed).
 Package atlassian detects Atlassian Cloud API tokens (ATATT3-prefixed).
detectors/auditboard
Package auditboard detects AuditBoard GRC API tokens.
 Package auditboard detects AuditBoard GRC API tokens.
detectors/auth0
Package auth0 detects Auth0 management API tokens (long JWT-shaped strings) when an Auth0-specific context token sits in a tight chunk window.
 Package auth0 detects Auth0 management API tokens (long JWT-shaped strings) when an Auth0-specific context token sits in a tight chunk window.
detectors/authentik
Package authentik detects Authentik identity-provider tokens — long alnum strings near the `authentik` keyword.
 Package authentik detects Authentik identity-provider tokens — long alnum strings near the `authentik` keyword.
detectors/avalara
Package avalara detects Avalara AvaTax credentials — a numeric account_id (7-12 digits) plus a license_key (typically 24-32 alphanumerics) appearing near an `avalara`/`avatax` assignment-anchor reference (radius 64, with a conservative 3.0 entropy floor on the license).
 Package avalara detects Avalara AvaTax credentials — a numeric account_id (7-12 digits) plus a license_key (typically 24-32 alphanumerics) appearing near an `avalara`/`avatax` assignment-anchor reference (radius 64, with a conservative 3.0 entropy floor on the license).
detectors/aws
Package aws detects AWS access key id / secret access key pairs and optionally verifies them via sts:GetCallerIdentity.
 Package aws detects AWS access key id / secret access key pairs and optionally verifies them via sts:GetCallerIdentity.
detectors/awss3presigned
Package awss3presigned detects AWS S3 presigned URLs.
 Package awss3presigned detects AWS S3 presigned URLs.
detectors/awssession
Package awssession detects AWS temporary session credential triples (ASIA<16>) — access-key-id with paired secret access key and session token — and verifies them via sts:GetCallerIdentity.
 Package awssession detects AWS temporary session credential triples (ASIA<16>) — access-key-id with paired secret access key and session token — and verifies them via sts:GetCallerIdentity.
detectors/awx
Package awx detects AWX / Ansible Tower / Ansible Automation Platform OAuth2 Bearer tokens (30-char base62 near `awx_token` / `tower_token`).
 Package awx detects AWX / Ansible Tower / Ansible Automation Platform OAuth2 Bearer tokens (30-char base62 near `awx_token` / `tower_token`).
detectors/azuread
Package azuread detects Azure AD (Entra ID) application client secrets and pairs them with the application's client id (UUID) when one is in scope.
 Package azuread detects Azure AD (Entra ID) application client secrets and pairs them with the application's client id (UUID) when one is in scope.
detectors/azureapp
Package azureapp detects legacy Azure AD application secrets that the `azuread` package's tilde-anchored regex misses.
 Package azureapp detects legacy Azure AD application secrets that the `azuread` package's tilde-anchored regex misses.
detectors/azurecr
Package azurecr detects Azure Container Registry refresh / access tokens.
 Package azurecr detects Azure Container Registry refresh / access tokens.
detectors/azuredevops
Package azuredevops detects Azure DevOps personal access tokens (52-char base32) gated on the `azure_devops` / `dev.azure.com` keyword window.
 Package azuredevops detects Azure DevOps personal access tokens (52-char base32) gated on the `azure_devops` / `dev.azure.com` keyword window.
detectors/azuresas
Package azuresas detects Azure Storage SAS (Shared Access Signature) URLs embedding the `sig=` query parameter.
 Package azuresas detects Azure Storage SAS (Shared Access Signature) URLs embedding the `sig=` query parameter.
detectors/azuresqlconn
Package azuresqlconn detects Azure SQL Database connection strings and verifies credentials via a raw TDS LOGIN7 handshake.
 Package azuresqlconn detects Azure SQL Database connection strings and verifies credentials via a raw TDS LOGIN7 handshake.
detectors/azurestoragekey
Package azurestoragekey detects Azure Storage account keys embedded in AccountKey= connection strings (DefaultEndpointsProtocol=...;AccountName=...;AccountKey=...).
 Package azurestoragekey detects Azure Storage account keys embedded in AccountKey= connection strings (DefaultEndpointsProtocol=...;AccountName=...;AccountKey=...).
detectors/backblazeb2
Package backblazeb2 detects Backblaze B2 application key id + key pairs and verifies them live.
 Package backblazeb2 detects Backblaze B2 application key id + key pairs and verifies them live.
detectors/bamboo
Package bamboo detects Atlassian Bamboo personal access tokens (>=24 base64 chars) gated on the `bamboo` keyword window.
 Package bamboo detects Atlassian Bamboo personal access tokens (>=24 base64 chars) gated on the `bamboo` keyword window.
detectors/bamboohr
Package bamboohr detects BambooHR API keys near the `bamboohr` keyword.
 Package bamboohr detects BambooHR API keys near the `bamboohr` keyword.
detectors/bandwidth
Package bandwidth detects Bandwidth.com API credentials — a paired username + password (each 10+ alphanumeric) near the `bandwidth` keyword.
 Package bandwidth detects Bandwidth.com API credentials — a paired username + password (each 10+ alphanumeric) near the `bandwidth` keyword.
detectors/baseten
Package baseten detects Baseten API keys — 40+ char alphanumeric strings near the `baseten` keyword.
 Package baseten detects Baseten API keys — 40+ char alphanumeric strings near the `baseten` keyword.
detectors/basicauth
Package basicauth detects HTTP/HTTPS URLs with embedded Basic-auth userinfo (`https://user:password@host`).
 Package basicauth detects HTTP/HTTPS URLs with embedded Basic-auth userinfo (`https://user:password@host`).
detectors/beeceptor
Package beeceptor detects Beeceptor HTTP mock API keys.
 Package beeceptor detects Beeceptor HTTP mock API keys.
detectors/beehiiv
Package beehiiv detects Beehiiv API keys — long alnum strings near the `beehiiv` keyword.
 Package beehiiv detects Beehiiv API keys — long alnum strings near the `beehiiv` keyword.
detectors/betterstack
Package betterstack detects Better Stack (formerly Logtail) API tokens — 24+ alnum tokens near the `betterstack` / `logtail` keyword.
 Package betterstack detects Better Stack (formerly Logtail) API tokens — 24+ alnum tokens near the `betterstack` / `logtail` keyword.
detectors/beyondidentity
Package beyondidentity detects Beyond Identity API tokens — long base64url tokens near the `beyondidentity` keyword.
 Package beyondidentity detects Beyond Identity API tokens — long base64url tokens near the `beyondidentity` keyword.
detectors/beyondtrust
Package beyondtrust detects BeyondTrust (privileged access management) API tokens near the `beyondtrust` keyword.
 Package beyondtrust detects BeyondTrust (privileged access management) API tokens near the `beyondtrust` keyword.
detectors/biconomy
Package biconomy detects Biconomy paymaster API keys — `pm_` prefixed alnum tokens near the `biconomy` keyword.
 Package biconomy detects Biconomy paymaster API keys — `pm_` prefixed alnum tokens near the `biconomy` keyword.
detectors/bigcommerce
Package bigcommerce detects BigCommerce store API access tokens (31-char alnum).
 Package bigcommerce detects BigCommerce store API access tokens (31-char alnum).
detectors/bitbucketcloud
Package bitbucketcloud detects Bitbucket Cloud (Atlassian) access tokens and app passwords, verifying them as Bearer credentials against /2.0/user.
 Package bitbucketcloud detects Bitbucket Cloud (Atlassian) access tokens and app passwords, verifying them as Bearer credentials against /2.0/user.
detectors/bitbucketserver
Package bitbucketserver detects Bitbucket Server (Data Center, formerly Stash) HTTP access tokens and personal access tokens.
 Package bitbucketserver detects Bitbucket Server (Data Center, formerly Stash) HTTP access tokens and personal access tokens.
detectors/bitfinex
Package bitfinex detects Bitfinex API key + secret pairs near the `bitfinex` keyword.
 Package bitfinex detects Bitfinex API key + secret pairs near the `bitfinex` keyword.
detectors/bitrise
Package bitrise detects Bitrise personal access tokens (>=40 base64url chars) gated on the `bitrise` keyword window.
 Package bitrise detects Bitrise personal access tokens (>=40 base64url chars) gated on the `bitrise` keyword window.
detectors/bitwarden
Package bitwarden detects Bitwarden Secrets Manager (BWS) machine- account access tokens (`0.<uuid>.<base64>:<base64>` shape near `bitwarden` keyword) and verifies them against the Bitwarden identity service.
 Package bitwarden detects Bitwarden Secrets Manager (BWS) machine- account access tokens (`0.<uuid>.<base64>:<base64>` shape near `bitwarden` keyword) and verifies them against the Bitwarden identity service.
detectors/blockfrost
Package blockfrost detects Blockfrost Cardano API keys — `mainnet` / `preprod` / `preview` / `testnet` prefix + 32 alnum near the `blockfrost` keyword.
 Package blockfrost detects Blockfrost Cardano API keys — `mainnet` / `preprod` / `preview` / `testnet` prefix + 32 alnum near the `blockfrost` keyword.
detectors/box
Package box detects Box developer tokens (32+ char alnum) gated on the `box_developer` / `box_token` keyword window.
 Package box detects Box developer tokens (32+ char alnum) gated on the `box_developer` / `box_token` keyword window.
detectors/braintree
Package braintree detects Braintree access tokens — a single `access_token$(production|sandbox)$<merchant_id>$<32 hex>` opaque string.
 Package braintree detects Braintree access tokens — a single `access_token$(production|sandbox)$<merchant_id>$<32 hex>` opaque string.
detectors/branchio
Package branchio detects Branch.io key + secret pairs near the `branch_io` keyword.
 Package branchio detects Branch.io key + secret pairs near the `branch_io` keyword.
detectors/brevo
Package brevo detects Brevo (formerly Sendinblue) API keys (xkeysib-<64 hex>-<16 alnum>) and verifies them against /v3/account.
 Package brevo detects Brevo (formerly Sendinblue) API keys (xkeysib-<64 hex>-<16 alnum>) and verifies them against /v3/account.
detectors/browserless
Package browserless detects Browserless (browserless.io) API tokens (UUID-shaped or 32-64 alnum) near the `browserless` keyword.
 Package browserless detects Browserless (browserless.io) API tokens (UUID-shaped or 32-64 alnum) near the `browserless` keyword.
detectors/browserstack
Package browserstack detects Browserstack username + access key pairs and verifies them against /automate/plan.json on api.browserstack.com with HTTP Basic auth (username + access key).
 Package browserstack detects Browserstack username + access key pairs and verifies them against /automate/plan.json on api.browserstack.com with HTTP Basic auth (username + access key).
detectors/buddyci
Package buddyci detects Buddy CI/CD personal access tokens.
 Package buddyci detects Buddy CI/CD personal access tokens.
detectors/buffer
Package buffer detects Buffer (social-media scheduling) API access tokens near the `buffer` keyword.
 Package buffer detects Buffer (social-media scheduling) API access tokens near the `buffer` keyword.
detectors/bugcrowd
Package bugcrowd detects Bugcrowd API tokens (URL-safe base64, 40-128 chars).
 Package bugcrowd detects Bugcrowd API tokens (URL-safe base64, 40-128 chars).
detectors/bugsnag
Package bugsnag detects Bugsnag API keys (32-hex, lowercase) — the client `BUGSNAG_API_KEY` notifier/project key.
 Package bugsnag detects Bugsnag API keys (32-hex, lowercase) — the client `BUGSNAG_API_KEY` notifier/project key.
detectors/buildkite
Package buildkite detects Buildkite agent tokens (`bkua_<40 hex>`) and API access tokens (`bka_<40 alnum>` or 40-char hex with the "buildkite" keyword), verifying API tokens against /v2/user.
 Package buildkite detects Buildkite agent tokens (`bkua_<40 hex>`) and API access tokens (`bka_<40 alnum>` or 40-char hex with the "buildkite" keyword), verifying API tokens against /v2/user.
detectors/bunnycdn
Package bunnycdn detects Bunny.net (BunnyCDN) account API keys.
 Package bunnycdn detects Bunny.net (BunnyCDN) account API keys.
detectors/casdoor
Package casdoor detects Casdoor client secrets — `csdr_` prefixed alnum near the `casdoor` keyword.
 Package casdoor detects Casdoor client secrets — `csdr_` prefixed alnum near the `casdoor` keyword.
detectors/cerebras
Package cerebras detects Cerebras Cloud inference API keys (`csk-<base62>`) and verifies them against /v1/models with Bearer auth.
 Package cerebras detects Cerebras Cloud inference API keys (`csk-<base62>`) and verifies them against /v1/models with Bearer auth.
detectors/characterai
Package characterai detects Character.AI API tokens — long alnum strings near the `character` keyword.
 Package characterai detects Character.AI API tokens — long alnum strings near the `character` keyword.
detectors/chargebee
Package chargebee detects Chargebee subscription billing API keys (`live_<base64url>` or `test_<base64url>` near the `chargebee` keyword).
 Package chargebee detects Chargebee subscription billing API keys (`live_<base64url>` or `test_<base64url>` near the `chargebee` keyword).
detectors/chromacloud
Package chromacloud detects Chroma Cloud API keys — `ck-` prefixed alnum near the `chroma` keyword.
 Package chromacloud detects Chroma Cloud API keys — `ck-` prefixed alnum near the `chroma` keyword.
detectors/churnzero
Package churnzero detects ChurnZero appKey values near the `churnzero` keyword.
 Package churnzero detects ChurnZero appKey values near the `churnzero` keyword.
detectors/circleci
Package circleci detects CircleCI personal API tokens (`CCIPRJ_<43>` for project tokens, or 40-char hex personal API tokens with the "circleci" keyword), verifying via /api/v2/me with the Circle-Token header.
 Package circleci detects CircleCI personal API tokens (`CCIPRJ_<43>` for project tokens, or 40-char hex personal API tokens with the "circleci" keyword), verifying via /api/v2/me with the Circle-Token header.
detectors/ciscomeraki
Package ciscomeraki detects Cisco Meraki dashboard API keys (40-char hex) gated on the `meraki` keyword window.
 Package ciscomeraki detects Cisco Meraki dashboard API keys (40-char hex) gated on the `meraki` keyword window.
detectors/civo
Package civo detects Civo Cloud API keys (50-char base62 near an armed `civo[_-]?(api[_-]?)?(token|key|secret)` reference, entropy >= 3.0).
 Package civo detects Civo Cloud API keys (50-char base62 near an armed `civo[_-]?(api[_-]?)?(token|key|secret)` reference, entropy >= 3.0).
detectors/clerk
Package clerk detects Clerk secret keys (`sk_test_…` / `sk_live_…` near a `clerk` keyword) and verifies them against /v1/users.
 Package clerk detects Clerk secret keys (`sk_test_…` / `sk_live_…` near a `clerk` keyword) and verifies them against /v1/users.
detectors/clickhousecloud
Package clickhousecloud detects ClickHouse Cloud API key + secret pairs.
 Package clickhousecloud detects ClickHouse Cloud API key + secret pairs.
detectors/clickup
Package clickup detects ClickUp personal API tokens (`pk_<digits>_<32 uppercase alnum>`) and verifies them against /api/v2/user.
 Package clickup detects ClickUp personal API tokens (`pk_<digits>_<32 uppercase alnum>`) and verifies them against /api/v2/user.
detectors/closecrm
Package closecrm detects Close.com API keys — `api_<base62>` strings near the `close` / `closecrm` keyword.
 Package closecrm detects Close.com API keys — `api_<base62>` strings near the `close` / `closecrm` keyword.
detectors/cloud66
Package cloud66 detects Cloud66 personal access tokens (64-char hex) gated on the `cloud66` keyword window.
 Package cloud66 detects Cloud66 personal access tokens (64-char hex) gated on the `cloud66` keyword window.
detectors/cloudbees
Package cloudbees detects CloudBees CI / Jenkins X user_id + api_token pairs near the `cloudbees` keyword.
 Package cloudbees detects CloudBees CI / Jenkins X user_id + api_token pairs near the `cloudbees` keyword.
detectors/cloudflare
Package cloudflare detects Cloudflare API tokens (40-char URL-safe) when they appear near a "cloudflare" or CF_API_TOKEN keyword, and verifies them at /client/v4/user/tokens/verify.
 Package cloudflare detects Cloudflare API tokens (40-char URL-safe) when they appear near a "cloudflare" or CF_API_TOKEN keyword, and verifies them at /client/v4/user/tokens/verify.
detectors/cloudflarer2
Package cloudflarer2 detects Cloudflare R2 access keys (access-key-id + secret-access-key pair, S3-compatible).
 Package cloudflarer2 detects Cloudflare R2 access keys (access-key-id + secret-access-key pair, S3-compatible).
detectors/cloudinary
Package cloudinary detects Cloudinary URL credentials of shape `cloudinary://<api_key>:<api_secret>@<cloud_name>`.
 Package cloudinary detects Cloudinary URL credentials of shape `cloudinary://<api_key>:<api_secret>@<cloud_name>`.
detectors/cockroachcloud
Package cockroachcloud detects Cockroach Labs CockroachDB Cloud API keys (`ccdb_<base62>`).
 Package cockroachcloud detects Cockroach Labs CockroachDB Cloud API keys (`ccdb_<base62>`).
detectors/coda
Package coda detects Coda API tokens (40-char alnum co-occurring with `coda`) and verifies them against /v1/whoami using Bearer auth.
 Package coda detects Coda API tokens (40-char alnum co-occurring with `coda`) and verifies them against /v1/whoami using Bearer auth.
detectors/codecov
Package codecov detects Codecov upload tokens (UUID near the `codecov` keyword) and verifies them by POSTing to /upload/v4 — the upload endpoint honours the token and responds 200 (with a presigned upload URL body) when the token is valid for the corresponding repo.
 Package codecov detects Codecov upload tokens (UUID near the `codecov` keyword) and verifies them by POSTing to /upload/v4 — the upload endpoint honours the token and responds 200 (with a presigned upload URL body) when the token is valid for the corresponding repo.
detectors/codefresh
Package codefresh detects Codefresh CI/CD API keys (long base64url near `codefresh` keyword).
 Package codefresh detects Codefresh CI/CD API keys (long base64url near `codefresh` keyword).
detectors/codemagic
Package codemagic detects Codemagic (codemagic.io) mobile-CI API tokens (32-64 alnum) near the `codemagic` keyword.
 Package codemagic detects Codemagic (codemagic.io) mobile-CI API tokens (32-64 alnum) near the `codemagic` keyword.
detectors/codeship
Package codeship detects Codeship Pro API credentials — username + password pair near the `codeship` keyword.
 Package codeship detects Codeship Pro API credentials — username + password pair near the `codeship` keyword.
detectors/cohere
Package cohere detects Cohere API keys (40-char base62) and verifies them against /v1/check-api-key.
 Package cohere detects Cohere API keys (40-char base62) and verifies them against /v1/check-api-key.
detectors/coinbase
Package coinbase detects Coinbase API key + secret pairs near the `coinbase` keyword.
 Package coinbase detects Coinbase API key + secret pairs near the `coinbase` keyword.
detectors/cometml
Package cometml detects Comet ML (comet.com) API keys (32-100 alnum) near a comet api/key/token/secret cue.
 Package cometml detects Comet ML (comet.com) API keys (32-100 alnum) near a comet api/key/token/secret cue.
detectors/concourseci
Package concourseci detects Concourse CI local user tokens (`fly login` bearer tokens, observed at 28+ chars URL-safe base64).
 Package concourseci detects Concourse CI local user tokens (`fly login` bearer tokens, observed at 28+ chars URL-safe base64).
detectors/confluence
Package confluence detects Atlassian Confluence Cloud API tokens near a "confluence" keyword.
 Package confluence detects Atlassian Confluence Cloud API tokens near a "confluence" keyword.
detectors/constantcontact
Package constantcontact detects Constant Contact API access tokens (Bearer JWTs minted by their OAuth flow) gated on the `constant_contact` / `constantcontact` keyword.
 Package constantcontact detects Constant Contact API access tokens (Bearer JWTs minted by their OAuth flow) gated on the `constant_contact` / `constantcontact` keyword.
detectors/contextextract
Package contextextract provides reusable helpers for extracting context (tenant IDs, host URLs, etc.) from the surrounding chunk data passed to FromData.
 Package contextextract provides reusable helpers for extracting context (tenant IDs, host URLs, etc.) from the surrounding chunk data passed to FromData.
detectors/copper
Package copper detects Copper CRM credentials — user_email + access_token pair near the `copper` keyword.
 Package copper detects Copper CRM credentials — user_email + access_token pair near the `copper` keyword.
detectors/coralogix
Package coralogix detects Coralogix API tokens (32-hex near `coralogix`).
 Package coralogix detects Coralogix API tokens (32-hex near `coralogix`).
detectors/couchbasecapella
Package couchbasecapella detects Couchbase Capella API tokens (long alnum near `couchbase` / `capella` keyword).
 Package couchbasecapella detects Couchbase Capella API tokens (long alnum near `couchbase` / `capella` keyword).
detectors/courier
Package courier detects Courier auth tokens (`pk_prod_` / `pk_test_` prefix followed by 40+ base32 characters).
 Package courier detects Courier auth tokens (`pk_prod_` / `pk_test_` prefix followed by 40+ base32 characters).
detectors/crispchat
Package crispchat detects Crisp Chat (crisp.chat) plugin tokens — long lowercase-hex plugin keys near a `crisp` keyword.
 Package crispchat detects Crisp Chat (crisp.chat) plugin tokens — long lowercase-hex plugin keys near a `crisp` keyword.
detectors/crowdin
Package crowdin detects Crowdin personal access tokens — long base64url strings near the `crowdin` keyword.
 Package crowdin detects Crowdin personal access tokens — long base64url strings near the `crowdin` keyword.
detectors/crowdstrike
Package crowdstrike detects CrowdStrike Falcon API client_id + client_secret pairs.
 Package crowdstrike detects CrowdStrike Falcon API client_id + client_secret pairs.
detectors/custom
Package custom turns a JSON config file into runtime Detector objects so teams can add org-specific patterns ("ACME_API_KEY=…", internal token prefixes, license-key shapes) without forking the binary.
 Package custom turns a JSON config file into runtime Detector objects so teams can add org-specific patterns ("ACME_API_KEY=…", internal token prefixes, license-key shapes) without forking the binary.
detectors/customerio
Package customerio detects Customer.io tracking credentials — a paired site_id + api_key (each 20-char alphanumeric) near the `customerio` / `customer_io` keyword.
 Package customerio detects Customer.io tracking credentials — a paired site_id + api_key (each 20-char alphanumeric) near the `customerio` / `customer_io` keyword.
detectors/customerly
Package customerly detects Customerly customer-service API tokens — long alnum strings near a `customerly` keyword.
 Package customerly detects Customerly customer-service API tokens — long alnum strings near a `customerly` keyword.
detectors/dagstercloud
Package dagstercloud detects Dagster Cloud user / agent tokens (`dgc_` or `agent:` prefix).
 Package dagstercloud detects Dagster Cloud user / agent tokens (`dgc_` or `agent:` prefix).
detectors/dailyco
Package dailyco detects Daily.co realtime video API tokens — 64 hex near the `daily` keyword.
 Package dailyco detects Daily.co realtime video API tokens — 64 hex near the `daily` keyword.
detectors/dashscope
Package dashscope detects Alibaba DashScope / Qwen API keys — `sk-` prefixed 32 alnum tokens near the `dashscope` or `qwen` keyword.
 Package dashscope detects Alibaba DashScope / Qwen API keys — `sk-` prefixed 32 alnum tokens near the `dashscope` or `qwen` keyword.
detectors/databricks
Package databricks detects Databricks personal access tokens (`dapi` followed by 32 lowercase hex chars).
 Package databricks detects Databricks personal access tokens (`dapi` followed by 32 lowercase hex chars).
detectors/datadog
Package datadog detects Datadog API keys (32 hex) optionally paired with Application keys (40 hex), and verifies them via /api/v1/validate.
 Package datadog detects Datadog API keys (32 hex) optionally paired with Application keys (40 hex), and verifies them via /api/v1/validate.
detectors/datadogapp
Package datadogapp detects standalone Datadog Application keys (40 hex chars) anchored to a `DD-APPLICATION-KEY` / `DD_APP_KEY` assignment or header form.
 Package datadogapp detects standalone Datadog Application keys (40 hex chars) anchored to a `DD-APPLICATION-KEY` / `DD_APP_KEY` assignment or header form.
detectors/dbtcloud
Package dbtcloud detects dbt Cloud (cloud.getdbt.com) personal access tokens (`dbtu_` prefix + base64url).
 Package dbtcloud detects dbt Cloud (cloud.getdbt.com) personal access tokens (`dbtu_` prefix + base64url).
detectors/deel
Package deel detects Deel API tokens — 40+ char alphanumeric strings near a `deel`/`letsdeel` token-assignment reference, gated by a conservative entropy floor.
 Package deel detects Deel API tokens — 40+ char alphanumeric strings near a `deel`/`letsdeel` token-assignment reference, gated by a conservative entropy floor.
detectors/deepgram
Package deepgram detects Deepgram API keys (40-char hex near `deepgram` keyword).
 Package deepgram detects Deepgram API keys (40-char hex near `deepgram` keyword).
detectors/deepinfra
Package deepinfra detects DeepInfra API tokens — long alnum strings near the `deepinfra` keyword.
 Package deepinfra detects DeepInfra API tokens — long alnum strings near the `deepinfra` keyword.
detectors/deepl
Package deepl detects DeepL API keys (UUID-shaped + optional `:fx` suffix marking the free tier).
 Package deepl detects DeepL API keys (UUID-shaped + optional `:fx` suffix marking the free tier).
detectors/deepseek
Package deepseek detects DeepSeek API keys — `sk-<48+ alnum>` near the `deepseek` keyword.
 Package deepseek detects DeepSeek API keys — `sk-<48+ alnum>` near the `deepseek` keyword.
detectors/denodeploy
Package denodeploy detects Deno Deploy (deno.com) personal access tokens (`ddp_` prefix + alnum).
 Package denodeploy detects Deno Deploy (deno.com) personal access tokens (`ddp_` prefix + alnum).
detectors/descope
Package descope detects Descope management keys — `K2` prefix followed by a base64url body.
 Package descope detects Descope management keys — `K2` prefix followed by a base64url body.
detectors/devcycle
Package devcycle detects DevCycle server / management API keys — `dvc_server_` / `dvc_mgmt_` prefix + alnum near the `devcycle` keyword.
 Package devcycle detects DevCycle server / management API keys — `dvc_server_` / `dvc_mgmt_` prefix + alnum near the `devcycle` keyword.
detectors/dialpad
Package dialpad detects Dialpad API tokens — long alphanumerics armed by a `dialpad[_-]?(api[_-]?)?(token|key|secret)` reference within a tight window.
 Package dialpad detects Dialpad API tokens — long alphanumerics armed by a `dialpad[_-]?(api[_-]?)?(token|key|secret)` reference within a tight window.
detectors/dify
Package dify detects Dify LLM ops API keys — `app-` or `dataset-` prefixed alnum tokens near the `dify` keyword.
 Package dify detects Dify LLM ops API keys — `app-` or `dataset-` prefixed alnum tokens near the `dify` keyword.
detectors/digitalocean
Package digitalocean detects DigitalOcean personal access tokens (dop_v1_<64 hex>) and verifies them via /v2/account.
 Package digitalocean detects DigitalOcean personal access tokens (dop_v1_<64 hex>) and verifies them via /v2/account.
detectors/discord
Package discord detects Discord bot tokens (`<base64-id>.<base64-ts>.<hmac>`) and verifies them against /users/@me with the `Bot <token>` Authorization scheme.
 Package discord detects Discord bot tokens (`<base64-id>.<base64-ts>.<hmac>`) and verifies them against /users/@me with the `Bot <token>` Authorization scheme.
detectors/djangoconfigsecret
Package djangoconfigsecret detects two Python assignment shapes found in Django's settings.py:
 Package djangoconfigsecret detects two Python assignment shapes found in Django's settings.py:
detectors/dnsimple
Package dnsimple detects DNSimple API tokens — long alphanumeric tokens near the `dnsimple` keyword.
 Package dnsimple detects DNSimple API tokens — long alphanumeric tokens near the `dnsimple` keyword.
detectors/dockerhub
Package dockerhub detects Docker Hub personal access tokens.
 Package dockerhub detects Docker Hub personal access tokens.
detectors/docusign
Package docusign detects DocuSign integration keys / access tokens — long base64url JWT-shaped tokens near the `docusign` keyword.
 Package docusign detects DocuSign integration keys / access tokens — long base64url JWT-shaped tokens near the `docusign` keyword.
detectors/dolthub
Package dolthub detects DoltHub personal access tokens — long base64url strings near the `dolthub` keyword.
 Package dolthub detects DoltHub personal access tokens — long base64url strings near the `dolthub` keyword.
detectors/doppler
Package doppler detects Doppler service tokens (`dp.<scope>.<base64>` — scope is `st` for service tokens, `pt` for personal, `ct` for CLI).
 Package doppler detects Doppler service tokens (`dp.<scope>.<base64>` — scope is `st` for service tokens, `pt` for personal, `ct` for CLI).
detectors/dopplercli
Package dopplercli detects Doppler CLI tokens (`dp.cli.…`).
 Package dopplercli detects Doppler CLI tokens (`dp.cli.…`).
detectors/drata
Package drata detects Drata API tokens — long base64url tokens near the `drata` keyword.
 Package drata detects Drata API tokens — long base64url tokens near the `drata` keyword.
detectors/drift
Package drift detects Drift (drift.com) API tokens — long base64url tokens near `drift` keyword.
 Package drift detects Drift (drift.com) API tokens — long base64url tokens near `drift` keyword.
detectors/drip
Package drip detects Drip (getdrip.com) personal API tokens, issued from the user-settings page and used as the username in HTTP Basic auth (token as username, blank password) against api.getdrip.com — verified read-only via /v2/accounts.
 Package drip detects Drip (getdrip.com) personal API tokens, issued from the user-settings page and used as the username in HTTP Basic auth (token as username, blank password) against api.getdrip.com — verified read-only via /v2/accounts.
detectors/droneci
Package droneci detects Drone CI personal access tokens (24-32 char alnum) bound to an explicit drone-prefixed assignment anchor.
 Package droneci detects Drone CI personal access tokens (24-32 char alnum) bound to an explicit drone-prefixed assignment anchor.
detectors/dropbox
Package dropbox detects Dropbox short-lived access tokens (`sl.…`) and long-lived app/refresh tokens, verifying them via /2/users/get_current_account.
 Package dropbox detects Dropbox short-lived access tokens (`sl.…`) and long-lived app/refresh tokens, verifying them via /2/users/get_current_account.
detectors/dwolla
Package dwolla detects Dwolla application key + secret pairs (each 50+ base64-style characters) near the `dwolla` keyword.
 Package dwolla detects Dwolla application key + secret pairs (each 50+ base64-style characters) near the `dwolla` keyword.
detectors/dynatrace
Package dynatrace detects Dynatrace API tokens — the documented shape is `dt0c01.<24-base32-id>.<64-base32-secret>`.
 Package dynatrace detects Dynatrace API tokens — the documented shape is `dt0c01.<24-base32-id>.<64-base32-secret>`.
detectors/earthly
Package earthly detects Earthly Cloud secrets / tokens — long base62 near the `earthly` keyword.
 Package earthly detects Earthly Cloud secrets / tokens — long base62 near the `earthly` keyword.
detectors/easypost
Package easypost detects EasyPost API keys — `EZAK<alnum>` (production) or `EZTK<alnum>` (test) prefix-keyed strings.
 Package easypost detects EasyPost API keys — `EZAK<alnum>` (production) or `EZTK<alnum>` (test) prefix-keyed strings.
detectors/edgedbcloud
Package edgedbcloud detects EdgeDB Cloud secret keys — `edbt_` prefixed alnum near the `edgedb` keyword.
 Package edgedbcloud detects EdgeDB Cloud secret keys — `edbt_` prefixed alnum near the `edgedb` keyword.
detectors/elasticapm
Package elasticapm detects Elastic APM secret tokens — long alphanumerics gated by an `elastic[_-]?apm...(token|key|secret)` assignment reference within a tight window plus a conservative Shannon-entropy floor.
 Package elasticapm detects Elastic APM secret tokens — long alphanumerics gated by an `elastic[_-]?apm...(token|key|secret)` assignment reference within a tight window plus a conservative Shannon-entropy floor.
detectors/elasticcloud
Package elasticcloud detects Elastic Cloud / Elasticsearch API keys.
 Package elasticcloud detects Elastic Cloud / Elasticsearch API keys.
detectors/elevenlabs
Package elevenlabs detects ElevenLabs API keys (32-char hex near `elevenlabs` keyword).
 Package elevenlabs detects ElevenLabs API keys (32-char hex near `elevenlabs` keyword).
detectors/eloqua
Package eloqua detects Oracle Eloqua REST API client_id + client_secret pairs near an `eloqua`-prefixed assignment.
 Package eloqua detects Oracle Eloqua REST API client_id + client_secret pairs near an `eloqua`-prefixed assignment.
detectors/emailjs
Package emailjs detects EmailJS user_id + private access_token pairs near the `emailjs` keyword.
 Package emailjs detects EmailJS user_id + private access_token pairs near the `emailjs` keyword.
detectors/equinixmetal
Package equinixmetal detects Equinix Metal (formerly Packet) API tokens — 32-char alnum tokens near `equinix` / `packet` / `metal_api` keywords.
 Package equinixmetal detects Equinix Metal (formerly Packet) API tokens — 32-char alnum tokens near `equinix` / `packet` / `metal_api` keywords.
detectors/esmtprc
Package esmtprc detects the `password` line of an `.esmtprc` / `~/.esmtprc` config (esmtp(1), the lightweight SMTP relay client, and its msmtp/ssmtp-family lookalikes): a bare `key value` grammar, one directive per line, where the value is optionally double-quoted (`password "hunter2"` or `password hunter2`).
 Package esmtprc detects the `password` line of an `.esmtprc` / `~/.esmtprc` config (esmtp(1), the lightweight SMTP relay client, and its msmtp/ssmtp-family lookalikes): a bare `key value` grammar, one directive per line, where the value is optionally double-quoted (`password "hunter2"` or `password hunter2`).
detectors/etherscan
Package etherscan detects Etherscan API keys — 34-char alnum strings near the `etherscan` keyword.
 Package etherscan detects Etherscan API keys — 34-char alnum strings near the `etherscan` keyword.
detectors/etsy
Package etsy detects Etsy (etsy.com) Open API v3 keystrings (24-32 alnum) near the etsy keyword.
 Package etsy detects Etsy (etsy.com) Open API v3 keystrings (24-32 alnum) near the etsy keyword.
detectors/evidently
Package evidently detects Evidently AI / Evidently Cloud API tokens (URL-safe base64, 32-80 chars).
 Package evidently detects Evidently AI / Evidently Cloud API tokens (URL-safe base64, 32-80 chars).
detectors/exoscale
Package exoscale detects Exoscale IaaS access-key + secret-key pairs near the `exoscale` keyword.
 Package exoscale detects Exoscale IaaS access-key + secret-key pairs near the `exoscale` keyword.
detectors/expel
Package expel detects Expel (MDR) API keys near the `expel` keyword.
 Package expel detects Expel (MDR) API keys near the `expel` keyword.
detectors/expo
Package expo detects Expo PATs using a tight keyword arm plus verify.
 Package expo detects Expo PATs using a tight keyword arm plus verify.
detectors/faire
Package faire detects Faire wholesale-marketplace API keys (`fai_` prefix + alnum).
 Package faire detects Faire wholesale-marketplace API keys (`fai_` prefix + alnum).
detectors/fastly
Package fastly detects Fastly API tokens (32-char base62 with optional hyphens) gated on the `fastly` keyword window.
 Package fastly detects Fastly API tokens (32-char base62 with optional hyphens) gated on the `fastly` keyword window.
detectors/fastspring
Package fastspring detects FastSpring API credentials — a paired username + password near the `fastspring` keyword.
 Package fastspring detects FastSpring API credentials — a paired username + password near the `fastspring` keyword.
detectors/fattureincloud
Package fattureincloud detects Fatture in Cloud (fattureincloud.it) API access tokens — long base64url-ish bearer tokens near the `fattureincloud` keyword.
 Package fattureincloud detects Fatture in Cloud (fattureincloud.it) API access tokens — long base64url-ish bearer tokens near the `fattureincloud` keyword.
detectors/fauna
Package fauna detects FaunaDB secrets (`fnAd…` admin / `fnAk…` server keys).
 Package fauna detects FaunaDB secrets (`fnAd…` admin / `fnAk…` server keys).
detectors/fiddler
Package fiddler detects Fiddler AI bearer tokens (URL-safe base64, 40-80 chars).
 Package fiddler detects Fiddler AI bearer tokens (URL-safe base64, 40-80 chars).
detectors/figma
Package figma detects Figma personal access tokens (`figd_…` legacy / `figpat_…` 2024+ format) and verifies them against /v1/me using the documented `X-Figma-Token` header.
 Package figma detects Figma personal access tokens (`figd_…` legacy / `figpat_…` 2024+ format) and verifies them against /v1/me using the documented `X-Figma-Token` header.
detectors/filebase
Package filebase detects Filebase S3-compatible IPFS / Web3 storage access_key + secret_key pairs (40+ alnum each) near the `filebase` keyword.
 Package filebase detects Filebase S3-compatible IPFS / Web3 storage access_key + secret_key pairs (40+ alnum each) near the `filebase` keyword.
detectors/filezillaxml
Package filezillaxml detects FileZilla's stored-site-manager password element: `<Pass>plaintext</Pass>` (filezilla.xml, when no FileZilla master password is set) and `<Pass encoding="base64">...</Pass>` (recentservers.xml, and filezilla.xml when FileZilla's own weak "protect" scheme applied a base64 wrapping — note this is FileZilla's own optional obfuscation layer, not real encryption; a base64-wrapped value is decoded before the deny-list check below runs against the underlying bytes).
 Package filezillaxml detects FileZilla's stored-site-manager password element: `<Pass>plaintext</Pass>` (filezilla.xml, when no FileZilla master password is set) and `<Pass encoding="base64">...</Pass>` (recentservers.xml, and filezilla.xml when FileZilla's own weak "protect" scheme applied a base64 wrapping — note this is FileZilla's own optional obfuscation layer, not real encryption; a base64-wrapped value is decoded before the deny-list check below runs against the underlying bytes).
detectors/firebasecloudmessaging
Package firebasecloudmessaging detects FCM legacy server keys — `AAAA`- prefixed base64url tokens near `fcm` / `firebase` keywords.
 Package firebasecloudmessaging detects FCM legacy server keys — `AAAA`- prefixed base64url tokens near `fcm` / `firebase` keywords.
detectors/firehydrant
Package firehydrant detects FireHydrant incident-response API tokens (`fhb_` prefix + base64url).
 Package firehydrant detects FireHydrant incident-response API tokens (`fhb_` prefix + base64url).
detectors/fireworks
Package fireworks detects Fireworks AI API keys (`fw_<base62>`) and verifies them against /v1/models with Bearer auth.
 Package fireworks detects Fireworks AI API keys (`fw_<base62>`) and verifies them against /v1/models with Bearer auth.
detectors/fivetran
Package fivetran detects Fivetran API key + secret pairs near the `fivetran` keyword.
 Package fivetran detects Fivetran API key + secret pairs near the `fivetran` keyword.
detectors/flutterwave
Package flutterwave detects Flutterwave secret keys (`FLWSECK-` / `FLWSECK_TEST-` prefix + 32-64 alnum) near the `flutterwave` keyword.
 Package flutterwave detects Flutterwave secret keys (`FLWSECK-` / `FLWSECK_TEST-` prefix + 32-64 alnum) near the `flutterwave` keyword.
detectors/flyio
Package flyio detects Fly.io macaroon tokens (fm1_/fm2_ prefixes) and verifies them by hitting the Machines API.
 Package flyio detects Fly.io macaroon tokens (fm1_/fm2_ prefixes) and verifies them by hitting the Machines API.
detectors/flymachines
Package flymachines detects Fly.io Machines API tokens (`fly_` or `FlyV1` prefix).
 Package flymachines detects Fly.io Machines API tokens (`fly_` or `FlyV1` prefix).
detectors/footprint
Package footprint detects Footprint KYC API keys (`sk_test_` or `sk_live_` prefix + alnum).
 Package footprint detects Footprint KYC API keys (`sk_test_` or `sk_live_` prefix + alnum).
detectors/forgerock
Package forgerock detects ForgeRock / Ping Identity Cloud SSO tokens — long alphanumerics near the `forgerock` keyword.
 Package forgerock detects ForgeRock / Ping Identity Cloud SSO tokens — long alphanumerics near the `forgerock` keyword.
detectors/forter
detectors/freshchat
detectors/freshdesk
Verification is tenant-scoped: the Freshdesk API lives at `<subdomain>.freshdesk.com` and authenticates via HTTP Basic auth (key as username, arbitrary password).
 Verification is tenant-scoped: the Freshdesk API lives at `<subdomain>.freshdesk.com` and authenticates via HTTP Basic auth (key as username, arbitrary password).
detectors/freshmarketer
Freshmarketer accounts have per-tenant hosts, but the API key is also accepted on the canonical `app.freshmarketer.com` for the verify probe.
 Freshmarketer accounts have per-tenant hosts, but the API key is also accepted on the canonical `app.freshmarketer.com` for the verify probe.
detectors/freshsales
Unverified-by-default: the per-domain host isn't in the chunk, so verify only fires when an apiBase override is supplied.
 Unverified-by-default: the per-domain host isn't in the chunk, so verify only fires when an apiBase override is supplied.
detectors/friendliai
detectors/front
detectors/frontegg
FrontEgg vendor secrets are UUIDs paired with a vendor client_id; gated on the `frontegg` keyword window because a bare UUID has too many false positives.
 FrontEgg vendor secrets are UUIDs paired with a vendor client_id; gated on the `frontegg` keyword window because a bare UUID has too many false positives.
detectors/fullstory
detectors/fusionauth
Unverified by design: FusionAuth deployments route per-tenant, so verification fires only when an apiBase override is supplied.
 Unverified by design: FusionAuth deployments route per-tenant, so verification fires only when an apiBase override is supplied.
detectors/gainsight
Gainsight authenticates via an Accesskey header, distinct from the usual Authorization Bearer header.
 Gainsight authenticates via an Accesskey header, distinct from the usual Authorization Bearer header.
detectors/gandi
Gandi publishes no authoritative prefix/length/charset for either the deprecated `Apikey` or the current PAT `Bearer` credential, so no length is pinned.
 Gandi publishes no authoritative prefix/length/charset for either the deprecated `Apikey` or the current PAT `Bearer` credential, so no length is pinned.
detectors/gcp
Package gcp detects Google Cloud service-account JSON credentials and verifies them by exchanging a self-signed RS256 JWT for an OAuth2 access token at https://oauth2.googleapis.com/token.
 Package gcp detects Google Cloud service-account JSON credentials and verifies them by exchanging a self-signed RS256 JWT for an OAuth2 access token at https://oauth2.googleapis.com/token.
detectors/gcpapikey
AIza-prefixed keys gate access to public Google APIs (Maps, Translate, YouTube Data, Firebase), not service-account level, but still a leak that can drive billing abuse on the owner's project.
 AIza-prefixed keys gate access to public Google APIs (Maps, Translate, YouTube Data, Firebase), not service-account level, but still a leak that can drive billing abuse on the owner's project.
detectors/gcpidtoken
A GCP ID token has `iss=https://accounts.google.com` (or the service-account equivalent), distinguishing it from other JWTs.
 A GCP ID token has `iss=https://accounts.google.com` (or the service-account equivalent), distinguishing it from other JWTs.
detectors/gcpoauth
Refresh tokens are long-lived bearer credentials that mint access tokens; rotating them is non-trivial because they're issued per (user, client).
 Refresh tokens are long-lived bearer credentials that mint access tokens; rotating them is non-trivial because they're issued per (user, client).
detectors/gcssignedurl
A V4 signed URL embeds GOOG4-RSA-SHA256 in X-Goog-Algorithm, the service-account email in X-Goog-Credential, and an expiry.
 A V4 signed URL embeds GOOG4-RSA-SHA256 in X-Goog-Algorithm, the service-account email in X-Goog-Credential, and an expiry.
detectors/generic
detectors/getresponse
detectors/getstream
Unverified-by-design: Stream's server-side REST auth does not accept the raw api_secret.
 Unverified-by-design: Stream's server-side REST auth does not accept the raw api_secret.
detectors/ghcr
Same shape as a GitHub PAT (ghp_/gho_/ghu_/ghs_/ghr_) but co-occurring with a `ghcr.io` reference.
 Same shape as a GitHub PAT (ghp_/gho_/ghu_/ghs_/ghr_) but co-occurring with a `ghcr.io` reference.
detectors/gigya
Unverified by design: Gigya routes per data center and the apikey alone won't auth a privileged probe; verification fires only when an apiBase override is supplied.
 Unverified by design: Gigya routes per data center and the apikey alone won't auth a privileged probe; verification fires only when an apiBase override is supplied.
detectors/gitcredentialsurl
Package gitcredentialsurl detects `scheme://user:pass@host` credential lines of the kind git's credential.helper=store writes to `.git-credentials` — one bare URL per line, userinfo unescaped.
 Package gitcredentialsurl detects `scheme://user:pass@host` credential lines of the kind git's credential.helper=store writes to `.git-credentials` — one bare URL per line, userinfo unescaped.
detectors/gitea
Gitea is self-hosted; the verify endpoint lives on a per-installation host not carried in the chunk, so this is unverified-by-default with an apiBase override for tests.
 Gitea is self-hosted; the verify endpoint lives on a per-installation host not carried in the chunk, so this is unverified-by-default with an apiBase override for tests.
detectors/github
detectors/githubapp
Package githubapp detects GitHub Apps installation access tokens (`ghs_<base62>{36}`), distinct from PATs (handled by pkg/detectors/github).
 Package githubapp detects GitHub Apps installation access tokens (`ghs_<base62>{36}`), distinct from PATs (handled by pkg/detectors/github).
detectors/githubfinegrained
Distinct from the classic ghp_/gho_/ghu_/ghs_/ghr_ GitHub detector because the prefix and length are structurally different.
 Distinct from the classic ghp_/gho_/ghu_/ghs_/ghr_ GitHub detector because the prefix and length are structurally different.
detectors/gitlab
detectors/gitlabdeploy
Package gitlabdeploy detects GitLab project / group / deploy tokens (`gldt-` prefix and adjacent variants) — distinct from the user PAT (`glpat-`) owned by `pkg/detectors/gitlab`.
 Package gitlabdeploy detects GitLab project / group / deploy tokens (`gldt-` prefix and adjacent variants) — distinct from the user PAT (`glpat-`) owned by `pkg/detectors/gitlab`.
detectors/gitlabpipeline
Package gitlabpipeline detects GitLab pipeline trigger tokens (40-char hex or UUID-shaped).
 Package gitlabpipeline detects GitLab pipeline trigger tokens (40-char hex or UUID-shaped).
detectors/gitter
Gitter tokens grant the issuing user's full chat scope.
 Gitter tokens grant the issuing user's full chat scope.
detectors/gladly
Unverified-by-default: the per-org host isn't in the chunk, so verify only fires when an apiBase override is supplied.
 Unverified-by-default: the per-org host isn't in the chunk, so verify only fires when an apiBase override is supplied.
detectors/gocardless
live_ verified hits surface SeverityCritical via DefaultSeverity; live_ verifies against api.gocardless.com, sandbox_ against api-sandbox.
 live_ verified hits surface SeverityCritical via DefaultSeverity; live_ verifies against api.gocardless.com, sandbox_ against api-sandbox.
detectors/gocd
Package gocd detects GoCD server access tokens (40-64 mixed-case base62) gated on the `gocd` keyword.
 Package gocd detects GoCD server access tokens (40-64 mixed-case base62) gated on the `gocd` keyword.
detectors/grafana
A Grafana service-account token is itself a Bearer credential the Grafana HTTP API accepts directly, so a live verify cannot yield a false positive.
 A Grafana service-account token is itself a Bearer credential the Grafana HTTP API accepts directly, so a live verify cannot yield a false positive.
detectors/greenhouse
The official Harvest API docs document the token as a 32-character lowercase hex string with no prefix (example <TOKEN> = a7183e1b…), so the regex is anchored to the hex charset rather than a bare alphanumeric run.
 The official Harvest API docs document the token as a 32-character lowercase hex string with no prefix (example <TOKEN> = a7183e1b…), so the regex is anchored to the hex charset rather than a bare alphanumeric run.
detectors/groq
The `gsk_` prefix is shared with Snyk Group keys, but Groq's payload length (52 chars after the prefix) differs from Snyk's 40-char payload, so the regex is locked to Groq's length to keep cross-detector noise low.
 The `gsk_` prefix is shared with Snyk Group keys, but Groq's payload length (52 chars after the prefix) differs from Snyk's 40-char payload, so the regex is locked to Groq's length to keep cross-detector noise low.
detectors/growthbook
detectors/gumroad
detectors/gusto
detectors/hackerone
detectors/hanko
Package hanko detects Hanko Cloud admin API keys.
 Package hanko detects Hanko Cloud admin API keys.
detectors/harbor
Package harbor detects Harbor container registry CLI secrets / robot account passwords.
 Package harbor detects Harbor container registry CLI secrets / robot account passwords.
detectors/hardcodedpassword
Package hardcodedpassword detects low-entropy hardcoded passwords in IaC and config files.
 Package hardcodedpassword detects low-entropy hardcoded passwords in IaC and config files.
detectors/harness
detectors/hashicorpcloud
detectors/hasura
Package hasura detects Hasura Cloud admin secrets.
 Package hasura detects Hasura Cloud admin secrets.
detectors/heap
detectors/helcim
Package helcim detects Helcim payment API tokens.
 Package helcim detects Helcim payment API tokens.
detectors/helicone
detectors/helius
detectors/helpcrunch
detectors/helpscout
detectors/heroku
Package heroku detects Heroku API tokens (UUIDs) and verifies them against /account, decoding the account to surface blast radius: a token with no 2FA is account takeover; a federated/SSO account requires the IdP. UUID alone is too generic, so a "heroku" keyword must appear within 256 bytes.
 Package heroku detects Heroku API tokens (UUIDs) and verifies them against /account, decoding the account to surface blast radius: a token with no 2FA is account takeover; a federated/SSO account requires the IdP. UUID alone is too generic, so a "heroku" keyword must appear within 256 bytes.
detectors/hetzner
Package hetzner detects Hetzner Cloud API tokens: a bare 64-char alphanumeric string, no prefix.
 Package hetzner detects Hetzner Cloud API tokens: a bare 64-char alphanumeric string, no prefix.
detectors/honeybadger
detectors/honeycomb
detectors/hookdeck
detectors/hootsuite
detectors/hotjar
detectors/hubspot
detectors/huggingface
detectors/hunter
detectors/hyperbolic
detectors/hyperline
Package hyperline detects Hyperline billing API keys.
 Package hyperline detects Hyperline billing API keys.
detectors/hyperproof
Package hyperproof detects Hyperproof compliance API credentials.
 Package hyperproof detects Hyperproof compliance API credentials.
detectors/ibmcloud
detectors/idnow
Package idnow detects IDnow KYC API tokens.
 Package idnow detects IDnow KYC API tokens.
detectors/incidentio
detectors/inflection
detectors/infura
detectors/instana
Package instana: the verify endpoint lives on the per-tenant `<unit>-<tenant>.instana.io` host which isn't carried in the chunk, so this is unverified-by-default with an apiBase override for tests.
 Package instana: the verify endpoint lives on the per-tenant `<unit>-<tenant>.instana.io` host which isn't carried in the chunk, so this is unverified-by-default with an apiBase override for tests.
detectors/intercom
Intercom access tokens always begin with `dG9rOg`, the base64 of the literal `"tok:"` prefix the platform stamps on every token; we anchor on that prefix for low-noise matching.
 Intercom access tokens always begin with `dG9rOg`, the base64 of the literal `"tok:"` prefix the platform stamps on every token; we anchor on that prefix for low-noise matching.
detectors/intigriti
detectors/iterable
detectors/jellyfish
Package jellyfish: Jellyfish publishes no authoritative prefix, length, or charset for its API tokens, so the regex is NOT length-pinned to a guessed value; recall-safe hardening does the work instead — a tightened proximity window, an assignment-anchor arm regex, and a conservative entropy floor.
 Package jellyfish: Jellyfish publishes no authoritative prefix, length, or charset for its API tokens, so the regex is NOT length-pinned to a guessed value; recall-safe hardening does the work instead — a tightened proximity window, an assignment-anchor arm regex, and a conservative entropy floor.
detectors/jenkins
Package jenkins detects Jenkins API tokens — the modern shape is `11<32-hex>`, issued by the Jenkins user "Configure" page.
 Package jenkins detects Jenkins API tokens — the modern shape is `11<32-hex>`, issued by the Jenkins user "Configure" page.
detectors/jenkinsx
Package jenkinsx detects Jenkins X (jx) API tokens — long alnum tokens near a `jenkinsx`/`jx_token`-style reference.
 Package jenkinsx detects Jenkins X (jx) API tokens — long alnum tokens near a `jenkinsx`/`jx_token`-style reference.
detectors/jetbrainswebservers
Package jetbrainswebservers detects the JetBrains IDE deploy-target credential stored in `.idea/WebServers.xml`'s `<fileTransfer>` element: `<fileTransfer host="..." password="..." username="...">` (attribute order is not fixed by the schema, so the match is scoped to the whole opening tag rather than assuming a position).
 Package jetbrainswebservers detects the JetBrains IDE deploy-target credential stored in `.idea/WebServers.xml`'s `<fileTransfer>` element: `<fileTransfer host="..." password="..." username="...">` (attribute order is not fixed by the schema, so the match is scoped to the whole opening tag rather than assuming a position).
detectors/jfrog
Package jfrog detects JFrog Artifactory access tokens.
 Package jfrog detects JFrog Artifactory access tokens.
detectors/jina
Package jina detects Jina AI API keys — `jina_` prefix followed by a long base64url body.
 Package jina detects Jina AI API keys — `jina_` prefix followed by a long base64url body.
detectors/jira
Package jira detects Atlassian Jira API tokens (24-char base62) near a "jira" assignment-style keyword.
 Package jira detects Atlassian Jira API tokens (24-char base62) near a "jira" assignment-style keyword.
detectors/jslogincallsecret
Package jslogincallsecret detects a credential passed as a bare positional argument to a JS/TS SDK authentication call, e.g.:
 Package jslogincallsecret detects a credential passed as a bare positional argument to a JS/TS SDK authentication call, e.g.:
detectors/jsonconfigsecret
Package jsonconfigsecret detects `"key": "value"` credential pairs in JSON config files whose key names are drawn from a small credential-shaped vocabulary (password/passwd/pwd/passphrase/secret/ api_key/apikey, or the bare key "pass").
 Package jsonconfigsecret detects `"key": "value"` credential pairs in JSON config files whose key names are drawn from a small credential-shaped vocabulary (password/passwd/pwd/passphrase/secret/ api_key/apikey, or the bare key "pass").
detectors/jumio
Package jumio detects Jumio (jumio.com) KYC API token + secret pairs near the `jumio` keyword.
 Package jumio detects Jumio (jumio.com) KYC API token + secret pairs near the `jumio` keyword.
detectors/jumpcloud
Package jumpcloud detects JumpCloud API keys (40-hex co-occurring with `jumpcloud`) and verifies them against /api/systemusers using the documented `x-api-key` header.
 Package jumpcloud detects JumpCloud API keys (40-hex co-occurring with `jumpcloud`) and verifies them against /api/systemusers using the documented `x-api-key` header.
detectors/june
Package june detects June.so analytics write keys near the `june` keyword.
 Package june detects June.so analytics write keys near the `june` keyword.
detectors/jwt
Package jwt detects JSON Web Tokens (header.payload.signature, base64url encoded) and surfaces decoded claims in ExtraData.
 Package jwt detects JSON Web Tokens (header.payload.signature, base64url encoded) and surfaces decoded claims in ExtraData.
detectors/kafka
Package kafka detects Kafka SASL/PLAIN credentials in client config blocks.
 Package kafka detects Kafka SASL/PLAIN credentials in client config blocks.
detectors/kagi
Package kagi detects Kagi search API tokens (`kagi_` prefix + alnum).
 Package kagi detects Kagi search API tokens (`kagi_` prefix + alnum).
detectors/kayako
Package kayako detects Kayako support API tokens — long alnum strings near a `kayako` keyword.
 Package kayako detects Kayako support API tokens — long alnum strings near a `kayako` keyword.
detectors/keycdn
Package keycdn detects KeyCDN API keys.
 Package keycdn detects KeyCDN API keys.
detectors/keycloak
Package keycloak detects Keycloak client_id + client_secret pairs near the `keycloak` keyword.
 Package keycloak detects Keycloak client_id + client_secret pairs near the `keycloak` keyword.
detectors/kickbox
Package kickbox detects Kickbox email-verification API keys — `live_`/`test_` prefixed alnum strings near the `kickbox` keyword.
 Package kickbox detects Kickbox email-verification API keys — `live_`/`test_` prefixed alnum strings near the `kickbox` keyword.
detectors/kinde
Package kinde detects Kinde Auth M2M client secrets — long base64url tokens (>=40 chars) gated on the `kinde` keyword window.
 Package kinde detects Kinde Auth M2M client secrets — long base64url tokens (>=40 chars) gated on the `kinde` keyword window.
detectors/klarna
Package klarna detects Klarna API credentials and verifies them against /payments/v1/sessions on api.klarna.com using HTTP Basic auth.
 Package klarna detects Klarna API credentials and verifies them against /payments/v1/sessions on api.klarna.com using HTTP Basic auth.
detectors/klaviyo
Package klaviyo detects Klaviyo private (`pk_…`) and public (`sk_…`) API keys and verifies them against /api/v2/profiles using the documented `Authorization: Klaviyo-API-Key …` header.
 Package klaviyo detects Klaviyo private (`pk_…`) and public (`sk_…`) API keys and verifies them against /api/v2/profiles using the documented `Authorization: Klaviyo-API-Key …` header.
detectors/klu
Package klu detects Klu LLM ops API keys (`klu_` prefix + alnum).
 Package klu detects Klu LLM ops API keys (`klu_` prefix + alnum).
detectors/knock
Package knock detects Knock notifications service API keys — `sk_(test|live)_<32+ alnum>` prefix-keyed strings near the `knock` keyword.
 Package knock detects Knock notifications service API keys — `sk_(test|live)_<32+ alnum>` prefix-keyed strings near the `knock` keyword.
detectors/kong
Package kong detects Kong Konnect personal access tokens — `kpat_` prefix + alnum near the `kong` keyword.
 Package kong detects Kong Konnect personal access tokens — `kpat_` prefix + alnum near the `kong` keyword.
detectors/kount
Package kount detects Kount API keys (JWT-shaped, three dot-separated base64 segments).
 Package kount detects Kount API keys (JWT-shaped, three dot-separated base64 segments).
detectors/kraken
Package kraken detects Kraken exchange API key + secret pairs near the `kraken` keyword.
 Package kraken detects Kraken exchange API key + secret pairs near the `kraken` keyword.
detectors/kubeconfig
Package kubeconfig detects kubeconfig YAML containing credential material — `client-certificate-data:`, `client-key-data:`, or `token:` fields under a `users:` block.
 Package kubeconfig detects kubeconfig YAML containing credential material — `client-certificate-data:`, `client-key-data:`, or `token:` fields under a `users:` block.
detectors/kustomer
Package kustomer detects Kustomer API tokens — long alphanumerics near the `kustomer` keyword.
 Package kustomer detects Kustomer API tokens — long alphanumerics near the `kustomer` keyword.
detectors/lacework
Package lacework detects Lacework API access tokens (`<base64>_<hex>` shape co-occurring with `lacework`) and verifies them against /api/v2/AccessTokens.
 Package lacework detects Lacework API access tokens (`<base64>_<hex>` shape co-occurring with `lacework`) and verifies them against /api/v2/AccessTokens.
detectors/lakera
Package lakera detects Lakera Guard LLM-security API keys (32-64 alnum).
 Package lakera detects Lakera Guard LLM-security API keys (32-64 alnum).
detectors/lambdalabs
Package lambdalabs detects Lambda Labs Cloud API keys — 40+ char alphanumeric strings near a Lambda Labs reference.
 Package lambdalabs detects Lambda Labs Cloud API keys — 40+ char alphanumeric strings near a Lambda Labs reference.
detectors/lambdatest
Package lambdatest detects LambdaTest username + access_key pairs near the `lambdatest` keyword.
 Package lambdatest detects LambdaTest username + access_key pairs near the `lambdatest` keyword.
detectors/langflow
Package langflow detects Langflow API keys (`lf_` prefix + alnum).
 Package langflow detects Langflow API keys (`lf_` prefix + alnum).
detectors/langfuse
Package langfuse detects Langfuse (langfuse.com) public + secret key pairs (`pk-lf-` + `sk-lf-` prefixes) near the `langfuse` keyword.
 Package langfuse detects Langfuse (langfuse.com) public + secret key pairs (`pk-lf-` + `sk-lf-` prefixes) near the `langfuse` keyword.
detectors/langsmith
Package langsmith detects LangSmith (smith.langchain.com) API keys (`lsv2_(pt|sk)_` prefix + 40-char hex).
 Package langsmith detects LangSmith (smith.langchain.com) API keys (`lsv2_(pt|sk)_` prefix + 40-char hex).
detectors/lark
Package lark detects Lark / Feishu Open Platform credentials — a paired app_id (`cli_<16 hex>`) + app_secret (32-char alphanumeric) near the `lark` / `feishu` keyword.
 Package lark detects Lark / Feishu Open Platform credentials — a paired app_id (`cli_<16 hex>`) + app_secret (32-char alphanumeric) near the `lark` / `feishu` keyword.
detectors/launchdarkly
Package launchdarkly detects LaunchDarkly access (`api-<uuid>`) and SDK (`sdk-<uuid>`) keys, verifying access keys against /api/v2/projects.
 Package launchdarkly detects LaunchDarkly access (`api-<uuid>`) and SDK (`sdk-<uuid>`) keys, verifying access keys against /api/v2/projects.
detectors/launchdarklyrelay
Package launchdarklyrelay detects LaunchDarkly relay-proxy service tokens.
 Package launchdarklyrelay detects LaunchDarkly relay-proxy service tokens.
detectors/launchnotes
Package launchnotes detects LaunchNotes API tokens.
 Package launchnotes detects LaunchNotes API tokens.
detectors/leaseweb
Package leaseweb detects Leaseweb API key + secret pairs near the `leaseweb` keyword.
 Package leaseweb detects Leaseweb API key + secret pairs near the `leaseweb` keyword.
detectors/lemlist
Package lemlist detects Lemlist cold-email API user_email + api_key pairs near the `lemlist` keyword.
 Package lemlist detects Lemlist cold-email API user_email + api_key pairs near the `lemlist` keyword.
detectors/lemonsqueezy
Package lemonsqueezy detects Lemon Squeezy API keys (long base64url-ish JWT-shaped tokens near `lemonsqueezy` keyword).
 Package lemonsqueezy detects Lemon Squeezy API keys (long base64url-ish JWT-shaped tokens near `lemonsqueezy` keyword).
detectors/leptonai
Package leptonai detects Lepton AI workspace / user tokens — long alnum strings near a `lepton` reference.
 Package leptonai detects Lepton AI workspace / user tokens — long alnum strings near a `lepton` reference.
detectors/lever
Package lever detects Lever recruiting API keys — 40-character hex strings near the `lever` keyword.
 Package lever detects Lever recruiting API keys — 40-character hex strings near the `lever` keyword.
detectors/lightstep
Package lightstep detects Lightstep / ServiceNow Cloud Observability API keys — long alphanumerics gated by a `lightstep[_-]?(api[_-]?)?(token|key| secret)` assignment-style reference within a tight proximity window, plus a conservative entropy floor.
 Package lightstep detects Lightstep / ServiceNow Cloud Observability API keys — long alphanumerics gated by a `lightstep[_-]?(api[_-]?)?(token|key| secret)` assignment-style reference within a tight proximity window, plus a conservative entropy floor.
detectors/linear
Package linear detects Linear personal API keys (lin_api_<40>) and verifies them against the GraphQL endpoint.
 Package linear detects Linear personal API keys (lin_api_<40>) and verifies them against the GraphQL endpoint.
detectors/linode
Package linode detects Linode personal access tokens (64 lowercase hex near `linode`) and verifies them against /v4/account.
 Package linode detects Linode personal access tokens (64 lowercase hex near `linode`) and verifies them against /v4/account.
detectors/livechat
Package livechat detects LiveChat (livechat.com) personal access tokens (`dal:` prefix + colon-separated id/secret) near the livechat keyword.
 Package livechat detects LiveChat (livechat.com) personal access tokens (`dal:` prefix + colon-separated id/secret) near the livechat keyword.
detectors/livekit
Package livekit detects LiveKit realtime audio/video API key + secret pairs near the `livekit` keyword.
 Package livekit detects LiveKit realtime audio/video API key + secret pairs near the `livekit` keyword.
detectors/lobehub
Package lobehub detects LobeHub / LobeChat API keys — `lobehub-` prefixed alnum near the `lobehub` keyword.
 Package lobehub detects LobeHub / LobeChat API keys — `lobehub-` prefixed alnum near the `lobehub` keyword.
detectors/loggly
Package loggly detects Loggly customer tokens (UUID near `loggly`).
 Package loggly detects Loggly customer tokens (UUID near `loggly`).
detectors/logzio
Package logzio detects Logz.io account API tokens (32-hex near `logz` / `logzio`).
 Package logzio detects Logz.io account API tokens (32-hex near `logz` / `logzio`).
detectors/lokalise
Package lokalise detects Lokalise API tokens (40-hex co-occurring with `lokalise`) and verifies them against /api2/projects using the documented `x-api-token` header.
 Package lokalise detects Lokalise API tokens (40-hex co-occurring with `lokalise`) and verifies them against /api2/projects using the documented `x-api-token` header.
detectors/looker
Package looker detects Looker API3 client_id + client_secret pairs.
 Package looker detects Looker API3 client_id + client_secret pairs.
detectors/loopsso
Package loopsso detects Loops.so API keys (32-hex co-occurring with `loops`) and verifies them against /v1/api-key using Bearer auth.
 Package loopsso detects Loops.so API keys (32-hex co-occurring with `loops`) and verifies them against /v1/api-key using Bearer auth.
detectors/lucidchart
Package lucidchart detects Lucidchart API tokens (>=40 base64url chars) gated on the `lucidchart` keyword window.
 Package lucidchart detects Lucidchart API tokens (>=40 base64url chars) gated on the `lucidchart` keyword window.
detectors/magento
Package magento detects Magento (Adobe Commerce) admin access tokens (32-char alnum).
 Package magento detects Magento (Adobe Commerce) admin access tokens (32-char alnum).
detectors/magiclabs
Package magiclabs detects Magic (magic.link) secret API keys near the `magic` keyword.
 Package magiclabs detects Magic (magic.link) secret API keys near the `magic` keyword.
detectors/mailboxlayer
Package mailboxlayer detects Mailboxlayer email-verification access keys — 32-char hex tokens near the `mailboxlayer` keyword.
 Package mailboxlayer detects Mailboxlayer email-verification access keys — 32-char hex tokens near the `mailboxlayer` keyword.
detectors/mailchimp
Package mailchimp detects Mailchimp API keys (32 hex + "-us" + dc number) and verifies them against the per-datacenter API root.
 Package mailchimp detects Mailchimp API keys (32 hex + "-us" + dc number) and verifies them against the per-datacenter API root.
detectors/mailerlite
Package mailerlite detects MailerLite API tokens.
 Package mailerlite detects MailerLite API tokens.
detectors/mailersend
Package mailersend detects MailerSend (mailersend.com) API tokens (`mlsn.` prefix + JWT-shaped suffix) near the `mailersend` keyword.
 Package mailersend detects MailerSend (mailersend.com) API tokens (`mlsn.` prefix + JWT-shaped suffix) near the `mailersend` keyword.
detectors/mailgun
Package mailgun detects Mailgun API keys (legacy "key-..." and the newer "<32 hex>-<8 hex>-<8 hex>" shape) and verifies them against /v3/domains using HTTP Basic auth (api:<key>).
 Package mailgun detects Mailgun API keys (legacy "key-..." and the newer "<32 hex>-<8 hex>-<8 hex>" shape) and verifies them against /v3/domains using HTTP Basic auth (api:<key>).
detectors/mailjet
Package mailjet detects Mailjet API key + API secret pairs (each 32 hex chars) near the `mailjet` keyword.
 Package mailjet detects Mailjet API key + API secret pairs (each 32 hex chars) near the `mailjet` keyword.
detectors/mailmodo
Package mailmodo detects Mailmodo email-marketing API keys — long alnum strings near a `mailmodo` keyword.
 Package mailmodo detects Mailmodo email-marketing API keys — long alnum strings near a `mailmodo` keyword.
detectors/mailtrap
Package mailtrap detects Mailtrap API tokens — long alphanumeric strings near a `mailtrap_(api_)?token|key|secret` assignment reference.
 Package mailtrap detects Mailtrap API tokens — long alphanumeric strings near a `mailtrap_(api_)?token|key|secret` assignment reference.
detectors/make
Package make detects Make.com (formerly Integromat) API tokens near the `make.com` / `integromat` keyword.
 Package make detects Make.com (formerly Integromat) API tokens near the `make.com` / `integromat` keyword.
detectors/mandiant
Package mandiant detects Mandiant Advantage API key + secret pairs near the `mandiant` / `fireeye` keyword.
 Package mandiant detects Mandiant Advantage API key + secret pairs near the `mandiant` / `fireeye` keyword.
detectors/mandrill
Package mandrill detects Mailchimp Mandrill API keys — 22-char URL-safe alphanumeric strings near the `mandrill` keyword.
 Package mandrill detects Mailchimp Mandrill API keys — 22-char URL-safe alphanumeric strings near the `mandrill` keyword.
detectors/mapbox
Package mapbox detects Mapbox secret tokens (`sk.<base64url>`).
 Package mapbox detects Mapbox secret tokens (`sk.<base64url>`).
detectors/marketo
Package marketo detects Marketo REST API client_id + client_secret pairs near the `marketo` keyword.
 Package marketo detects Marketo REST API client_id + client_secret pairs near the `marketo` keyword.
detectors/marqo
Package marqo detects Marqo Cloud API keys — `mzpat_` prefix + alnum near the `marqo` keyword.
 Package marqo detects Marqo Cloud API keys — `mzpat_` prefix + alnum near the `marqo` keyword.
detectors/materialize
Package materialize detects Materialize Cloud app passwords / tokens — `mzp_` prefixed base64url tokens near the `materialize` keyword.
 Package materialize detects Materialize Cloud app passwords / tokens — `mzp_` prefixed base64url tokens near the `materialize` keyword.
detectors/meilisearch
Package meilisearch detects Meilisearch master / admin API keys — 32+ alnum near the `meilisearch` keyword.
 Package meilisearch detects Meilisearch master / admin API keys — 32+ alnum near the `meilisearch` keyword.
detectors/mercurybank
Package mercurybank detects Mercury Bank API tokens.
 Package mercurybank detects Mercury Bank API tokens.
detectors/messagebird
Package messagebird detects MessageBird API access keys gated on a `messagebird` reference.
 Package messagebird detects MessageBird API access keys gated on a `messagebird` reference.
detectors/microsoftdynamics
Package microsoftdynamics detects Microsoft Dynamics 365 access tokens near the `dynamics` keyword.
 Package microsoftdynamics detects Microsoft Dynamics 365 access tokens near the `dynamics` keyword.
detectors/milvus
Package milvus detects Milvus / Zilliz Cloud API tokens — `db_`-prefixed long alnum strings near the `milvus` keyword.
 Package milvus detects Milvus / Zilliz Cloud API tokens — `db_`-prefixed long alnum strings near the `milvus` keyword.
detectors/miro
Package miro detects Miro OAuth access tokens (>=40 base64url chars) gated on the `miro` keyword window.
 Package miro detects Miro OAuth access tokens (>=40 base64url chars) gated on the `miro` keyword window.
detectors/missiveapp
Package missiveapp detects Missive (missiveapp.com) API tokens (32-64 alnum) near the missive keyword.
 Package missiveapp detects Missive (missiveapp.com) API tokens (32-64 alnum) near the missive keyword.
detectors/mistral
Package mistral detects Mistral AI API keys (32-char base62) and verifies them against /v1/models.
 Package mistral detects Mistral AI API keys (32-char base62) and verifies them against /v1/models.
detectors/mixpanel
Package mixpanel detects Mixpanel service-account credentials.
 Package mixpanel detects Mixpanel service-account credentials.
detectors/modal
Package modal detects Modal token-id (`ak-…`) + token-secret (`as-…`) pairs.
 Package modal detects Modal token-id (`ak-…`) + token-secret (`as-…`) pairs.
detectors/modeanalytics
Package modeanalytics detects Mode Analytics API token + secret pairs near the `mode` keyword.
 Package modeanalytics detects Mode Analytics API token + secret pairs near the `mode` keyword.
detectors/modelscope
Package modelscope detects ModelScope API tokens — `ms-` prefixed UUID-shaped tokens near the `modelscope` keyword.
 Package modelscope detects ModelScope API tokens — `ms-` prefixed UUID-shaped tokens near the `modelscope` keyword.
detectors/mollie
Package mollie detects Mollie API keys (live_<base62>{30+} and test_<base62>{30+}) and verifies them against /v2/methods on api.mollie.com with Bearer auth — that endpoint is read-only and lists available payment methods.
 Package mollie detects Mollie API keys (live_<base62>{30+} and test_<base62>{30+}) and verifies them against /v2/methods on api.mollie.com with Bearer auth — that endpoint is read-only and lists available payment methods.
detectors/monday
Package monday detects Monday.com API tokens (JWT-shaped near a `monday` keyword) and verifies them with a `{ me { id } }` GraphQL query.
 Package monday detects Monday.com API tokens (JWT-shaped near a `monday` keyword) and verifies them with a `{ me { id } }` GraphQL query.
detectors/mongodb
Package mongodb detects MongoDB connection URIs that embed a password (`mongodb://user:password@host` or `mongodb+srv://user:password@host`).
 Package mongodb detects MongoDB connection URIs that embed a password (`mongodb://user:password@host` or `mongodb+srv://user:password@host`).
detectors/mongodbatlas
Package mongodbatlas detects MongoDB Atlas Programmatic API key pairs (8-char public key + UUID-shaped private key) and verifies them against /api/atlas/v2/orgs.
 Package mongodbatlas detects MongoDB Atlas Programmatic API key pairs (8-char public key + UUID-shaped private key) and verifies them against /api/atlas/v2/orgs.
detectors/mongodbrealm
Package mongodbrealm detects MongoDB Realm / Atlas App Services API keys — UUID-shaped (36-char) tokens near the `realm` or `app_services` keyword.
 Package mongodbrealm detects MongoDB Realm / Atlas App Services API keys — UUID-shaped (36-char) tokens near the `realm` or `app_services` keyword.
detectors/monsterapi
Package monsterapi detects MonsterAPI inference API keys — long alphanumerics near the `monsterapi` keyword.
 Package monsterapi detects MonsterAPI inference API keys — long alphanumerics near the `monsterapi` keyword.
detectors/moonpay
Package moonpay detects MoonPay API keys — `pk_live_` / `pk_test_` / `sk_live_` / `sk_test_` prefixed alnum near the `moonpay` keyword.
 Package moonpay detects MoonPay API keys — `pk_live_` / `pk_test_` / `sk_live_` / `sk_test_` prefixed alnum near the `moonpay` keyword.
detectors/moralis
Package moralis detects Moralis Web3 API keys — long alnum/JWT-shaped strings near the `moralis` keyword.
 Package moralis detects Moralis Web3 API keys — long alnum/JWT-shaped strings near the `moralis` keyword.
detectors/motherduck
Package motherduck detects MotherDuck access tokens — long base64url JWT strings near the `motherduck` keyword.
 Package motherduck detects MotherDuck access tokens — long base64url JWT strings near the `motherduck` keyword.
detectors/mux
Package mux detects Mux access token id + secret key pairs.
 Package mux detects Mux access token id + secret key pairs.
detectors/mysql
Package mysql detects MySQL connection URIs that embed a password (`mysql://user:password@host` or `mysqlx://`).
 Package mysql detects MySQL connection URIs that embed a password (`mysql://user:password@host` or `mysqlx://`).
detectors/n8n
Package n8n detects n8n workflow-automation API keys near the `n8n` keyword.
 Package n8n detects n8n workflow-automation API keys near the `n8n` keyword.
detectors/nearrpc
Package nearrpc detects NEAR Protocol RPC API keys (Pagoda, FastNEAR, Lava) — long alnum keys near a near-rpc-flavoured keyword.
 Package nearrpc detects NEAR Protocol RPC API keys (Pagoda, FastNEAR, Lava) — long alnum keys near a near-rpc-flavoured keyword.
detectors/nebius
Package nebius detects Nebius AI Studio API keys — `AAAA`-prefixed JWT-like tokens near the `nebius` keyword.
 Package nebius detects Nebius AI Studio API keys — `AAAA`-prefixed JWT-like tokens near the `nebius` keyword.
detectors/neo4jaura
Package neo4jaura detects Neo4j Aura DBaaS API client credentials — long alnum strings near a `neo4j` or `aura` keyword.
 Package neo4jaura detects Neo4j Aura DBaaS API client credentials — long alnum strings near a `neo4j` or `aura` keyword.
detectors/neon
Package neon detects Neon serverless Postgres API keys (`neon_<base62>`).
 Package neon detects Neon serverless Postgres API keys (`neon_<base62>`).
detectors/neptuneai
Package neptuneai detects Neptune.ai API tokens (`eyJ`-prefixed JWT shape carrying api_address) near the neptune keyword.
 Package neptuneai detects Neptune.ai API tokens (`eyJ`-prefixed JWT shape carrying api_address) near the neptune keyword.
detectors/netlify
Package netlify detects Netlify personal access tokens (nfp_<40>) and verifies them against /api/v1/user.
 Package netlify detects Netlify personal access tokens (nfp_<40>) and verifies them against /api/v1/user.
detectors/netrc
Package netrc detects `.netrc` / `_netrc` credential entries: the `machine <host> login <user> password <pass>` token grammar (RFC unspecified, but stable since 4.2BSD ftp(1)) used by curl, ftp, git's credential.helper=netrc, and countless CI systems.
 Package netrc detects `.netrc` / `_netrc` credential entries: the `machine <host> login <user> password <pass>` token grammar (RFC unspecified, but stable since 4.2BSD ftp(1)) used by curl, ftp, git's credential.helper=netrc, and countless CI systems.
detectors/neverbounce
Package neverbounce detects NeverBounce API keys — `secret_` or `private_` prefixed alnum strings near the `neverbounce` keyword.
 Package neverbounce detects NeverBounce API keys — `secret_` or `private_` prefixed alnum strings near the `neverbounce` keyword.
detectors/newrelic
Package newrelic detects New Relic keys in three flavors:
 Package newrelic detects New Relic keys in three flavors:
detectors/ngrok
Package ngrok detects ngrok personal auth and API tokens (`2…`-prefixed, 40+ url-safe characters with an embedded `_`) and verifies them against /api/users/me on api.ngrok.com.
 Package ngrok detects ngrok personal auth and API tokens (`2…`-prefixed, 40+ url-safe characters with an embedded `_`) and verifies them against /api/users/me on api.ngrok.com.
detectors/nomic
Package nomic detects Nomic Atlas API keys — `nk-` prefix followed by a long base64url body.
 Package nomic detects Nomic Atlas API keys — `nk-` prefix followed by a long base64url body.
detectors/notion
Package notion detects Notion integration tokens (secret_<43>) and verifies them against /v1/users/me.
 Package notion detects Notion integration tokens (secret_<43>) and verifies them against /v1/users/me.
detectors/novitaai
Package novitaai detects Novita AI API keys — `sk_`-prefixed alnum strings near the `novita` keyword.
 Package novitaai detects Novita AI API keys — `sk_`-prefixed alnum strings near the `novita` keyword.
detectors/npm
Package npm detects npm automation/granular tokens (npm_…) and verifies them against registry.npmjs.org/-/whoami.
 Package npm detects npm automation/granular tokens (npm_…) and verifies them against registry.npmjs.org/-/whoami.
detectors/npmrcauth
Package npmrcauth detects npm's `.npmrc` credential directives: `_auth = <base64(user:pass)>` (npm's legacy combined Basic-auth blob), `_authToken = <token>` (the modern bearer form, optionally scoped to a registry as `//<registry>/:_authToken=<token>`), and `_password = <base64(pass)>`.
 Package npmrcauth detects npm's `.npmrc` credential directives: `_auth = <base64(user:pass)>` (npm's legacy combined Basic-auth blob), `_authToken = <token>` (the modern bearer form, optionally scoped to a registry as `//<registry>/:_authToken=<token>`), and `_password = <base64(pass)>`.
detectors/ns1
Package ns1 detects NS1 (IBM NS1 Connect) API keys — alnum tokens (16+ chars) gated on the `ns1` keyword window.
 Package ns1 detects NS1 (IBM NS1 Connect) API keys — alnum tokens (16+ chars) gated on the `ns1` keyword window.
detectors/nvidiangc
Package nvidiangc detects NVIDIA NGC API keys — `nvapi-` prefixed base64url tokens near the `nvidia` / `ngc` keyword.
 Package nvidiangc detects NVIDIA NGC API keys — `nvapi-` prefixed base64url tokens near the `nvidia` / `ngc` keyword.
detectors/octoai
Package octoai detects OctoAI / OctoML inference API tokens — long alphanumerics near the `octoai` / `octoml` keyword.
 Package octoai detects OctoAI / OctoML inference API tokens — long alphanumerics near the `octoai` / `octoml` keyword.
detectors/octopusdeploy
Package octopusdeploy detects Octopus Deploy API keys (`API-<26 base32>`).
 Package octopusdeploy detects Octopus Deploy API keys (`API-<26 base32>`).
detectors/okta
Package okta detects Okta API tokens (00...
 Package okta detects Okta API tokens (00...
detectors/okteto
Package okteto detects Okteto Cloud personal access tokens — long alphanumerics near the `okteto` keyword.
 Package okteto detects Okteto Cloud personal access tokens — long alphanumerics near the `okteto` keyword.
detectors/ollamacloud
Package ollamacloud detects Ollama Cloud API keys near the `ollama` keyword.
 Package ollamacloud detects Ollama Cloud API keys near the `ollama` keyword.
detectors/onelogin
Package onelogin detects OneLogin API client secrets (64-hex co-occurring with `onelogin`) and verifies them against the /api/2/users endpoint using the documented `Authorization: bearer:<token>` header form.
 Package onelogin detects OneLogin API client secrets (64-hex co-occurring with `onelogin`) and verifies them against the /api/2/users endpoint using the documented `Authorization: bearer:<token>` header form.
detectors/onesignal
Package onesignal detects OneSignal REST API keys near the `onesignal` keyword.
 Package onesignal detects OneSignal REST API keys near the `onesignal` keyword.
detectors/onetrust
Package onetrust detects OneTrust integration / OAuth tokens — long base64url tokens near the `onetrust` keyword.
 Package onetrust detects OneTrust integration / OAuth tokens — long base64url tokens near the `onetrust` keyword.
detectors/onfido
Package onfido detects Onfido (onfido.com) KYC API tokens (`api_(live|sandbox)_(us|eu|ca)_` prefix + alnum) near the `onfido` keyword.
 Package onfido detects Onfido (onfido.com) KYC API tokens (`api_(live|sandbox)_(us|eu|ca)_` prefix + alnum) near the `onfido` keyword.
detectors/openai
Package openai detects OpenAI API keys (sk-…, sk-proj-…, sk-svcacct-…, sk-admin-…) and verifies them against /v1/models.
 Package openai detects OpenAI API keys (sk-…, sk-proj-…, sk-svcacct-…, sk-admin-…) and verifies them against /v1/models.
detectors/openaipf
Package openaipf is the detector half of the openai/privacy-filter PII integration.
 Package openaipf is the detector half of the openai/privacy-filter PII integration.
detectors/openpipe
Package openpipe detects OpenPipe LLM gateway API keys (`opk_` prefix + alnum).
 Package openpipe detects OpenPipe LLM gateway API keys (`opk_` prefix + alnum).
detectors/openrouter
Package openrouter detects OpenRouter API keys (`sk-or-v1-…`) and verifies them against /api/v1/auth/key.
 Package openrouter detects OpenRouter API keys (`sk-or-v1-…`) and verifies them against /api/v1/auth/key.
detectors/opensea
Package opensea detects OpenSea API keys — 32-char hex strings near the `opensea` keyword.
 Package opensea detects OpenSea API keys — 32-char hex strings near the `opensea` keyword.
detectors/opensearchcloud
Package opensearchcloud detects OpenSearch Service / Aiven OpenSearch credentials — `os_` prefixed alnum tokens near the `opensearch` keyword.
 Package opensearchcloud detects OpenSearch Service / Aiven OpenSearch credentials — `os_` prefixed alnum tokens near the `opensearch` keyword.
detectors/opsgenie
Package opsgenie detects Opsgenie API integration keys (UUID near `opsgenie` keyword) and verifies them against /v2/integrations using the `GenieKey <key>` Authorization scheme.
 Package opsgenie detects Opsgenie API integration keys (UUID near `opsgenie` keyword) and verifies them against /v2/integrations using the `GenieKey <key>` Authorization scheme.
detectors/opslevel
Package opslevel detects OpsLevel (opslevel.com) API tokens (mixed-case alnum) armed by an OpsLevel token/key/secret reference.
 Package opslevel detects OpsLevel (opslevel.com) API tokens (mixed-case alnum) armed by an OpsLevel token/key/secret reference.
detectors/optimizely
Package optimizely detects Optimizely personal access tokens — long base64url tokens near the `optimizely` keyword.
 Package optimizely detects Optimizely personal access tokens — long base64url tokens near the `optimizely` keyword.
detectors/oraclecloud
Package oraclecloud detects Oracle Cloud Infrastructure (OCI) auth tokens — long alphanumerics near an assignment-style OCI reference.
 Package oraclecloud detects Oracle Cloud Infrastructure (OCI) auth tokens — long alphanumerics near an assignment-style OCI reference.
detectors/oraclenetsuite
Package oraclenetsuite detects Oracle NetSuite OAuth1 token ID + secret pairs near the `netsuite` keyword.
 Package oraclenetsuite detects Oracle NetSuite OAuth1 token ID + secret pairs near the `netsuite` keyword.
detectors/ortto
Package ortto detects Ortto (formerly Autopilot) marketing-automation API keys (`pak_` prefix + 32-64 alnum) near the `ortto` / `autopilothq` keyword.
 Package ortto detects Ortto (formerly Autopilot) marketing-automation API keys (`pak_` prefix + 32-64 alnum) near the `ortto` / `autopilothq` keyword.
detectors/ory
Package ory detects Ory Network workspace API keys — `ory_`-prefixed alnum strings near the `ory` keyword.
 Package ory detects Ory Network workspace API keys — `ory_`-prefixed alnum strings near the `ory` keyword.
detectors/outreach
Package outreach detects Outreach.io OAuth access tokens — long base64url tokens near the `outreach` keyword.
 Package outreach detects Outreach.io OAuth access tokens — long base64url tokens near the `outreach` keyword.
detectors/ovhcloud
Package ovhcloud detects OVH Cloud API credentials.
 Package ovhcloud detects OVH Cloud API credentials.
detectors/paddle
Package paddle detects Paddle Billing API keys — `pdl_<live|sdbx>_apikey_` prefix followed by a base64url body.
 Package paddle detects Paddle Billing API keys — `pdl_<live|sdbx>_apikey_` prefix followed by a base64url body.
detectors/pagerduty
Package pagerduty detects PagerDuty REST API tokens (20-char alnum) and verifies them against /users/me (user-scoped) with /users as a fallback for General Access (account-scoped) tokens.
 Package pagerduty detects PagerDuty REST API tokens (20-char alnum) and verifies them against /users/me (user-scoped) with /users as a fallback for General Access (account-scoped) tokens.
detectors/pagertree
Package pagertree detects PagerTree integration tokens (32-hex near `pagertree`) and verifies them against /api/v4/integrations with Bearer auth.
 Package pagertree detects PagerTree integration tokens (32-hex near `pagertree`) and verifies them against /api/v4/integrations with Bearer auth.
detectors/paperspace
Package paperspace detects Paperspace API keys and verifies them via /users/getPublicProfile.
 Package paperspace detects Paperspace API keys and verifies them via /users/getPublicProfile.
detectors/parabola
Package parabola detects Parabola workflow API tokens — long alnum strings near a `parabola` keyword.
 Package parabola detects Parabola workflow API tokens — long alnum strings near a `parabola` keyword.
detectors/pardot
Package pardot detects Salesforce Pardot / Account Engagement business unit id + access token pairs near the `pardot` keyword.
 Package pardot detects Salesforce Pardot / Account Engagement business unit id + access token pairs near the `pardot` keyword.
detectors/particleio
Package particleio detects Particle.io IoT access tokens — long hex strings near a `particle` keyword.
 Package particleio detects Particle.io IoT access tokens — long hex strings near a `particle` keyword.
detectors/paylocity
Package paylocity detects Paylocity OAuth client_id + client_secret pairs near the `paylocity` keyword.
 Package paylocity detects Paylocity OAuth client_id + client_secret pairs near the `paylocity` keyword.
detectors/paypal
Package paypal detects PayPal REST API client_id / client_secret pairs and verifies them by minting an OAuth access token at /v1/oauth2/token.
 Package paypal detects PayPal REST API client_id / client_secret pairs and verifies them by minting an OAuth access token at /v1/oauth2/token.
detectors/paystack
Package paystack detects Paystack secret keys (`sk_(live|test)_` prefix + 40-50 alnum) near the `paystack` keyword.
 Package paystack detects Paystack secret keys (`sk_(live|test)_` prefix + 40-50 alnum) near the `paystack` keyword.
detectors/pdfshift
Package pdfshift detects PDFShift API keys (`sk_` prefix + 40-80 alnum chars).
 Package pdfshift detects PDFShift API keys (`sk_` prefix + 40-80 alnum chars).
detectors/pendo
Package pendo detects Pendo integration tokens.
 Package pendo detects Pendo integration tokens.
detectors/perplexity
Package perplexity detects Perplexity AI API keys (`pplx-<base62>`).
 Package perplexity detects Perplexity AI API keys (`pplx-<base62>`).
detectors/persona
Package persona detects Persona (withpersona.com) KYC API keys (`persona_(production|sandbox)_` prefix + alnum) near the `persona` keyword.
 Package persona detects Persona (withpersona.com) KYC API keys (`persona_(production|sandbox)_` prefix + alnum) near the `persona` keyword.
detectors/pgpass
Package pgpass detects PostgreSQL `.pgpass` credential lines: `hostname:port:database:username:password` (libpq's PGPASSFILE format).
 Package pgpass detects PostgreSQL `.pgpass` credential lines: `hostname:port:database:username:password` (libpq's PGPASSFILE format).
detectors/phpconfigsecret
Package phpconfigsecret detects two PHP config-file credential shapes that pkg/detectors/hardcodedpassword structurally cannot see:
 Package phpconfigsecret detects two PHP config-file credential shapes that pkg/detectors/hardcodedpassword structurally cannot see:
detectors/pinecone
Package pinecone detects Pinecone API keys (`pcsk_<base62>`) and verifies them against the control-plane /databases endpoint with the documented `Api-Key` header.
 Package pinecone detects Pinecone API keys (`pcsk_<base62>`) and verifies them against the control-plane /databases endpoint with the documented `Api-Key` header.
detectors/pingdom
Package pingdom detects Pingdom API tokens (`<base62>{64,72}` near `pingdom`) and verifies them against /api/3.1/checks with Bearer auth.
 Package pingdom detects Pingdom API tokens (`<base62>{64,72}` near `pingdom`) and verifies them against /api/3.1/checks with Bearer auth.
detectors/pingidentity
Package pingidentity detects Ping Identity (PingOne) worker/client app secrets (UUID v4 shape).
 Package pingidentity detects Ping Identity (PingOne) worker/client app secrets (UUID v4 shape).
detectors/pingone
Package pingone detects PingOne worker app credentials — client_id + client_secret pair (each UUID or 36+ alnum) near the `pingone` keyword.
 Package pingone detects PingOne worker app credentials — client_id + client_secret pair (each UUID or 36+ alnum) near the `pingone` keyword.
detectors/pipedream
Package pipedream detects Pipedream API tokens near the `pipedream` keyword.
 Package pipedream detects Pipedream API tokens near the `pipedream` keyword.
detectors/pipedrive
Package pipedrive detects Pipedrive personal API tokens — 40-char alphanumeric strings near the `pipedrive` keyword.
 Package pipedrive detects Pipedrive personal API tokens — 40-char alphanumeric strings near the `pipedrive` keyword.
detectors/plaid
Package plaid detects Plaid client_id (24-hex) + secret (30-hex) pairs and verifies them by POSTing to /categories/get, the cheapest sandbox-safe endpoint that authenticates the pair without side effects.
 Package plaid detects Plaid client_id (24-hex) + secret (30-hex) pairs and verifies them by POSTing to /categories/get, the cheapest sandbox-safe endpoint that authenticates the pair without side effects.
detectors/planetscale
Package planetscale detects PlanetScale service token id + secret pairs (`pscale_oauth_…` / `pscale_tkn_…` + 32-64 char secret) and verifies them against /v1/organizations.
 Package planetscale detects PlanetScale service token id + secret pairs (`pscale_oauth_…` / `pscale_tkn_…` + 32-64 char secret) and verifies them against /v1/organizations.
detectors/planhat
Package planhat detects Planhat customer-success tenant tokens near the `planhat` keyword.
 Package planhat detects Planhat customer-success tenant tokens near the `planhat` keyword.
detectors/plivo
Package plivo detects Plivo Auth ID + Auth Token credentials — a paired detector.
 Package plivo detects Plivo Auth ID + Auth Token credentials — a paired detector.
detectors/polygonrpc
Package polygonrpc detects Polygon (PoS / zkEVM) RPC API keys — long alnum keys near a polygon-rpc-flavoured keyword.
 Package polygonrpc detects Polygon (PoS / zkEVM) RPC API keys — long alnum keys near a polygon-rpc-flavoured keyword.
detectors/portkey
Package portkey detects Portkey (portkey.ai) AI-gateway API keys (43-50 char base64url) near the `portkey` keyword.
 Package portkey detects Portkey (portkey.ai) AI-gateway API keys (43-50 char base64url) near the `portkey` keyword.
detectors/portswigger
Package portswigger detects PortSwigger Burp Suite Enterprise API keys — long alnum strings near a `portswigger` or `burp` keyword.
 Package portswigger detects PortSwigger Burp Suite Enterprise API keys — long alnum strings near a `portswigger` or `burp` keyword.
detectors/postageapp
Package postageapp detects PostageApp API keys — 32-hex strings near the `postageapp` keyword.
 Package postageapp detects PostageApp API keys — 32-hex strings near the `postageapp` keyword.
detectors/postgres
Package postgres detects PostgreSQL connection URIs that embed a password (`postgres://user:password@host` or `postgresql://...`).
 Package postgres detects PostgreSQL connection URIs that embed a password (`postgres://user:password@host` or `postgresql://...`).
detectors/posthog
Package posthog detects PostHog personal API keys (`phx_<base62>`).
 Package posthog detects PostHog personal API keys (`phx_<base62>`).
detectors/postman
Package postman detects Postman API keys (PMAK-...) and verifies them against /me.
 Package postman detects Postman API keys (PMAK-...) and verifies them against /me.
detectors/postmark
Package postmark detects Postmark server API tokens (UUID shape) and verifies them against /server.
 Package postmark detects Postmark server API tokens (UUID shape) and verifies them against /server.
detectors/postmarkaccount
Package postmarkaccount detects Postmark Account API tokens.
 Package postmarkaccount detects Postmark Account API tokens.
detectors/prefectcloud
Package prefectcloud detects Prefect Cloud API keys (`pnu_` prefix + URL-safe base64).
 Package prefectcloud detects Prefect Cloud API keys (`pnu_` prefix + URL-safe base64).
detectors/prismadata
Package prismadata detects Prisma Data Platform service tokens — `pdp_` prefixed alnum near the `prisma` keyword.
 Package prismadata detects Prisma Data Platform service tokens — `pdp_` prefixed alnum near the `prisma` keyword.
detectors/privatekey
Package privatekey detects PEM-encoded private keys (RSA, EC, OpenSSH, PGP, DSA, Ed25519, generic PKCS8).
 Package privatekey detects PEM-encoded private keys (RSA, EC, OpenSSH, PGP, DSA, Ed25519, generic PKCS8).
detectors/privatekey/blastradius
Certificate Transparency lookup for a derived public key.
 Certificate Transparency lookup for a derived public key.
detectors/productboard
Package productboard detects Productboard API keys (>=32 base64url chars) gated on the `productboard` keyword window.
 Package productboard detects Productboard API keys (>=32 base64url chars) gated on the `productboard` keyword window.
detectors/promptlayer
Package promptlayer detects PromptLayer (promptlayer.com) API keys (`pl_` prefix + 32-64 alnum).
 Package promptlayer detects PromptLayer (promptlayer.com) API keys (`pl_` prefix + 32-64 alnum).
detectors/propelauth
Package propelauth detects PropelAuth backend API keys — 40+ char alphanumeric strings near the `propelauth` keyword.
 Package propelauth detects PropelAuth backend API keys — 40+ char alphanumeric strings near the `propelauth` keyword.
detectors/pubnub
Package pubnub detects PubNub realtime publish / subscribe / secret keys — `pub-c-` / `sub-c-` / `sec-c-` UUID-shaped near the `pubnub` keyword.
 Package pubnub detects PubNub realtime publish / subscribe / secret keys — `pub-c-` / `sub-c-` / `sec-c-` UUID-shaped near the `pubnub` keyword.
detectors/pulumi
Package pulumi detects Pulumi Cloud access tokens (`pul-` prefix + 40-hex) and verifies them against /api/user using the documented `Authorization: token <pat>` header.
 Package pulumi detects Pulumi Cloud access tokens (`pul-` prefix + 40-hex) and verifies them against /api/user using the documented `Authorization: token <pat>` header.
detectors/pumble
Package pumble detects Pumble (pumble.com) team-chat API tokens — long alphanumeric tokens near the `pumble` keyword.
 Package pumble detects Pumble (pumble.com) team-chat API tokens — long alphanumeric tokens near the `pumble` keyword.
detectors/pusherbeams
Package pusherbeams detects Pusher Beams secret keys — 32-hex strings near `pusher_beams` keyword.
 Package pusherbeams detects Pusher Beams secret keys — 32-hex strings near `pusher_beams` keyword.
detectors/pusherchannels
Package pusherchannels detects Pusher Channels app secrets — a 20-character lowercase-alphanumeric secret used together with an app id and key for HMAC signing the realtime API.
 Package pusherchannels detects Pusher Channels app secrets — a 20-character lowercase-alphanumeric secret used together with an app id and key for HMAC signing the realtime API.
detectors/pushover
Package pushover detects Pushover application API tokens — 30-char alphanumeric strings near the `pushover` keyword.
 Package pushover detects Pushover application API tokens — 30-char alphanumeric strings near the `pushover` keyword.
detectors/puttyprivatekey
Package puttyprivatekey detects PuTTY's `.ppk` private-key file format: a `PuTTY-User-Key-File-2:`/`-3:` header line through the trailing `Private-MAC:` line, e.g.:
 Package puttyprivatekey detects PuTTY's `.ppk` private-key file format: a `PuTTY-User-Key-File-2:`/`-3:` header line through the trailing `Private-MAC:` line, e.g.:
detectors/pypi
Package pypi detects PyPI upload tokens (pypi-AgEIc…) and verifies them against the upload endpoint.
 Package pypi detects PyPI upload tokens (pypi-AgEIc…) and verifies them against the upload endpoint.
detectors/qdrant
Package qdrant detects Qdrant Cloud API keys — long base64url tokens near the `qdrant` keyword.
 Package qdrant detects Qdrant Cloud API keys — long base64url tokens near the `qdrant` keyword.
detectors/qualys
Package qualys detects Qualys VMDR API username + password pairs near the `qualys` keyword.
 Package qualys detects Qualys VMDR API username + password pairs near the `qualys` keyword.
detectors/quay
Package quay detects Quay.io OAuth access tokens — long base64 (40+ chars) tokens gated on the `quay` keyword window.
 Package quay detects Quay.io OAuth access tokens — long base64 (40+ chars) tokens gated on the `quay` keyword window.
detectors/quicknode
Package quicknode detects QuickNode endpoint URLs and tokens — alnum strings near the `quicknode` keyword.
 Package quicknode detects QuickNode endpoint URLs and tokens — alnum strings near the `quicknode` keyword.
detectors/quip
Package quip detects Quip developer tokens (long base64url-ish strings) gated on the `quip` keyword window.
 Package quip detects Quip developer tokens (long base64url-ish strings) gated on the `quip` keyword window.
detectors/rabbitmq
Package rabbitmq detects RabbitMQ AMQP URIs that embed a password (`amqp://user:password@host` or `amqps://`).
 Package rabbitmq detects RabbitMQ AMQP URIs that embed a password (`amqp://user:password@host` or `amqps://`).
detectors/railsmasterkey
Package railsmasterkey detects Ruby on Rails' `config/master.key`: a file whose entire content is nothing but a 32-character lowercase hex string (Rails generates it via `SecureRandom.hex(16)`).
 Package railsmasterkey detects Ruby on Rails' `config/master.key`: a file whose entire content is nothing but a 32-character lowercase hex string (Rails generates it via `SecureRandom.hex(16)`).
detectors/railssecretkeybase
Package railssecretkeybase detects Ruby on Rails' `secret_key_base` directive, found in `config/secrets.yml` (pre-Rails-5.2 apps) under per-environment keys (`development:`, `test:`, `production:`):
 Package railssecretkeybase detects Ruby on Rails' `secret_key_base` directive, found in `config/secrets.yml` (pre-Rails-5.2 apps) under per-environment keys (`development:`, `test:`, `production:`):
detectors/railway
Package railway detects Railway API tokens (UUIDs near `railway`).
 Package railway detects Railway API tokens (UUIDs near `railway`).
detectors/rapid7
Package rapid7 detects Rapid7 InsightVM / InsightIDR / InsightAppSec platform API keys (UUID v4 shape).
 Package rapid7 detects Rapid7 InsightVM / InsightIDR / InsightAppSec platform API keys (UUID v4 shape).
detectors/raygun
Package raygun detects Raygun personal access tokens (UUID near `raygun`).
 Package raygun detects Raygun personal access tokens (UUID near `raygun`).
detectors/razorpay
Package razorpay detects Razorpay key + secret pairs and verifies them against /v1/items with HTTP Basic auth (key as username, secret as password).
 Package razorpay detects Razorpay key + secret pairs and verifies them against /v1/items with HTTP Basic auth (key as username, secret as password).
detectors/recurly
Package recurly detects Recurly subscription billing API keys (32-char alphanumeric) near an assignment-style `recurly[_-]?(api[_-]?)?(token|key| secret)` reference.
 Package recurly detects Recurly subscription billing API keys (32-char alphanumeric) near an assignment-style `recurly[_-]?(api[_-]?)?(token|key| secret)` reference.
detectors/redis
Package redis detects Redis connection URIs that embed a password (`redis://:password@host:port` or `rediss://user:password@host`).
 Package redis detects Redis connection URIs that embed a password (`redis://:password@host:port` or `rediss://user:password@host`).
detectors/rekaai
Package rekaai detects Reka AI API keys near the `reka` keyword.
 Package rekaai detects Reka AI API keys near the `reka` keyword.
detectors/render
Package render detects Render API keys (rnd_<14>) and verifies them via /v1/owners.
 Package render detects Render API keys (rnd_<14>) and verifies them via /v1/owners.
detectors/replicate
Package replicate detects Replicate API tokens (`r8_…`) and verifies them against /v1/account.
 Package replicate detects Replicate API tokens (`r8_…`) and verifies them against /v1/account.
detectors/replit
Package replit detects Replit deploy / API tokens — long base62 strings near the `replit` keyword.
 Package replit detects Replit deploy / API tokens — long base62 strings near the `replit` keyword.
detectors/requestbin
Package requestbin detects RequestBin / Pipedream webhook URLs — `https://*.m.pipedream.net/<id>` or `https://*.requestbin.com/<id>`.
 Package requestbin detects RequestBin / Pipedream webhook URLs — `https://*.m.pipedream.net/<id>` or `https://*.requestbin.com/<id>`.
detectors/resend
Package resend detects Resend API keys (`re_…`) and verifies them against /domains using Bearer auth.
 Package resend detects Resend API keys (`re_…`) and verifies them against /domains using Bearer auth.
detectors/retool
Package retool detects Retool API keys (`retool_` prefix + alphanumeric).
 Package retool detects Retool API keys (`retool_` prefix + alphanumeric).
detectors/ringcentral
Package ringcentral detects RingCentral OAuth client_id (appKey) + client_secret (appSecret) pairs near the `ringcentral` keyword.
 Package ringcentral detects RingCentral OAuth client_id (appKey) + client_secret (appSecret) pairs near the `ringcentral` keyword.
detectors/rippling
Package rippling detects Rippling API tokens — 40+ char alphanumeric strings near the `rippling` keyword.
 Package rippling detects Rippling API tokens — 40+ char alphanumeric strings near the `rippling` keyword.
detectors/riskified
Package riskified detects Riskified merchant API auth tokens — long hex/base64 strings paired with a `riskified` keyword.
 Package riskified detects Riskified merchant API auth tokens — long hex/base64 strings paired with a `riskified` keyword.
detectors/rollbar
Package rollbar detects Rollbar access tokens (32 hex near the `rollbar` keyword) and verifies them against /api/1/projects with the documented `X-Rollbar-Access-Token` header.
 Package rollbar detects Rollbar access tokens (32 hex near the `rollbar` keyword) and verifies them against /api/1/projects with the documented `X-Rollbar-Access-Token` header.
detectors/rootly
Package rootly detects Rootly incident-response API keys (`rootly_` prefix + alphanumeric).
 Package rootly detects Rootly incident-response API keys (`rootly_` prefix + alphanumeric).
detectors/runpod
Package runpod detects RunPod API keys (UUID near `runpod`) and verifies them against the GraphQL endpoint with a `{ myself { id } }` probe.
 Package runpod detects RunPod API keys (UUID near `runpod`) and verifies them against the GraphQL endpoint with a `{ myself { id } }` probe.
detectors/runway
Package runway detects Runway ML API keys — `key_` prefix followed by a long hex body.
 Package runway detects Runway ML API keys — `key_` prefix followed by a long hex body.
detectors/runwayml
Package runwayml detects RunwayML SDK secret keys (`key_` prefix + 48-64 alnum) near the `runwayml` / `runway` keyword.
 Package runwayml detects RunwayML SDK secret keys (`key_` prefix + 48-64 alnum) near the `runwayml` / `runway` keyword.
detectors/sageintacct
Package sageintacct detects Sage Intacct (accounting) sender_id / sender_password / user_password values near the `intacct` keyword.
 Package sageintacct detects Sage Intacct (accounting) sender_id / sender_password / user_password values near the `intacct` keyword.
detectors/salesforcerefresh
Package salesforcerefresh detects Salesforce OAuth refresh tokens (5Aep861...
 Package salesforcerefresh detects Salesforce OAuth refresh tokens (5Aep861...
detectors/salesloft
Package salesloft detects Salesloft API keys — 64-char alnum near the `salesloft` keyword.
 Package salesloft detects Salesloft API keys — 64-char alnum near the `salesloft` keyword.
detectors/sambanova
Package sambanova detects SambaNova Cloud API keys — 40+ char alphanumeric strings near the `sambanova` keyword.
 Package sambanova detects SambaNova Cloud API keys — 40+ char alphanumeric strings near the `sambanova` keyword.
detectors/sapariba
Package sapariba detects SAP Ariba Application Keys (the apiKey header value) near the `ariba` keyword.
 Package sapariba detects SAP Ariba Application Keys (the apiKey header value) near the `ariba` keyword.
detectors/saucelabs
Package saucelabs detects Sauce Labs (saucelabs.com) username + access_key pairs near the `saucelabs` / `sauce-labs` keyword.
 Package saucelabs detects Sauce Labs (saucelabs.com) username + access_key pairs near the `saucelabs` / `sauce-labs` keyword.
detectors/scaleway
Package scaleway detects Scaleway secret keys (UUID near `scaleway`) and verifies them against /account/v3/users with the X-Auth-Token header.
 Package scaleway detects Scaleway secret keys (UUID near `scaleway`) and verifies them against /account/v3/users with the X-Auth-Token header.
detectors/schematic
Package schematic detects Schematic (schematichq.com) pricing/billing API keys (`api_<base62>` with prod/test variant), verified via /v1/companies on api.schematichq.com using `X-Schematic-Api-Key` header.
 Package schematic detects Schematic (schematichq.com) pricing/billing API keys (`api_<base62>` with prod/test variant), verified via /v1/companies on api.schematichq.com using `X-Schematic-Api-Key` header.
detectors/scoutapm
Package scoutapm detects Scout APM agent credentials — a paired detector surfacing both the account-key (8-16 alphanumeric agent key) and the API key (>=40 base64url) near the `scoutapm` / `scout_apm` keyword.
 Package scoutapm detects Scout APM agent credentials — a paired detector surfacing both the account-key (8-16 alphanumeric agent key) and the API key (>=40 base64url) near the `scoutapm` / `scout_apm` keyword.
detectors/secureframe
Package secureframe detects Secureframe API tokens — long base64url tokens near the `secureframe` keyword.
 Package secureframe detects Secureframe API tokens — long base64url tokens near the `secureframe` keyword.
detectors/segment
Package segment detects Segment write keys (32-char base62-ish).
 Package segment detects Segment write keys (32-char base62-ish).
detectors/semaphoreci
Package semaphoreci detects Semaphore CI 2.0 API tokens.
 Package semaphoreci detects Semaphore CI 2.0 API tokens.
detectors/semgrep
Package semgrep detects Semgrep API tokens (URL-safe alnum, 40-80 chars).
 Package semgrep detects Semgrep API tokens (URL-safe alnum, 40-80 chars).
detectors/semrush
Package semrush detects Semrush SEO API keys — 32 hex near the `semrush` keyword.
 Package semrush detects Semrush SEO API keys — 32 hex near the `semrush` keyword.
detectors/sendgrid
Package sendgrid detects SendGrid API keys (SG.<id>.<secret>) and verifies them against /v3/scopes.
 Package sendgrid detects SendGrid API keys (SG.<id>.<secret>) and verifies them against /v3/scopes.
detectors/sendoso
Package sendoso detects Sendoso direct-mail API keys (`sendoso_` prefix + 32-64 alnum) near the `sendoso` keyword.
 Package sendoso detects Sendoso direct-mail API keys (`sendoso_` prefix + 32-64 alnum) near the `sendoso` keyword.
detectors/sendpulse
Package sendpulse detects SendPulse client_id + client_secret pairs near the `sendpulse` keyword.
 Package sendpulse detects SendPulse client_id + client_secret pairs near the `sendpulse` keyword.
detectors/sentinelone
Package sentinelone detects SentinelOne Singularity API tokens — long alphanumerics near the `sentinelone` or `s1` keyword.
 Package sentinelone detects SentinelOne Singularity API tokens — long alphanumerics near the `sentinelone` or `s1` keyword.
detectors/sentry
Package sentry detects Sentry DSN URLs (https://<32 hex>@<host>/<project>).
 Package sentry detects Sentry DSN URLs (https://<32 hex>@<host>/<project>).
detectors/sentryuser
Package sentryuser detects Sentry user auth tokens (`sntryu_<hex>`), distinct from the project DSNs handled by pkg/detectors/sentry.
 Package sentryuser detects Sentry user auth tokens (`sntryu_<hex>`), distinct from the project DSNs handled by pkg/detectors/sentry.
detectors/shippo
Package shippo detects Shippo API keys — `shippo_(live|test)_<40+ alnum>` prefix-keyed strings.
 Package shippo detects Shippo API keys — `shippo_(live|test)_<40+ alnum>` prefix-keyed strings.
detectors/shodan
Package shodan detects Shodan API keys and verifies them via /api-info.
 Package shodan detects Shodan API keys and verifies them via /api-info.
detectors/shopify
Package shopify detects Shopify Admin API access tokens (`shpat_`, `shpss_`, `shpca_` prefixes followed by 32-hex).
 Package shopify detects Shopify Admin API access tokens (`shpat_`, `shpss_`, `shpca_` prefixes followed by 32-hex).
detectors/sift
Package sift detects Sift Science API key + account id pairs near the `sift` keyword.
 Package sift detects Sift Science API key + account id pairs near the `sift` keyword.
detectors/signalwire
Package signalwire detects SignalWire Project ID + API token pairs near the `signalwire` keyword.
 Package signalwire detects SignalWire Project ID + API token pairs near the `signalwire` keyword.
detectors/signifyd
Package signifyd detects Signifyd API key + team id pairs near the `signifyd` keyword.
 Package signifyd detects Signifyd API key + team id pairs near the `signifyd` keyword.
detectors/similarweb
Package similarweb detects SimilarWeb API keys near the `similarweb` keyword.
 Package similarweb detects SimilarWeb API keys near the `similarweb` keyword.
detectors/sinch
Package sinch detects Sinch API keys (UUIDs) gated on an assignment-style `sinch` keyword in close proximity.
 Package sinch detects Sinch API keys (UUIDs) gated on an assignment-style `sinch` keyword in close proximity.
detectors/slack
Package slack detects Slack bot tokens and incoming webhook URLs.
 Package slack detects Slack bot tokens and incoming webhook URLs.
detectors/slackusertoken
Package slackusertoken detects Slack user OAuth tokens (xoxp-) — distinct from xoxb- bot tokens already handled by pkg/detectors/slack.
 Package slackusertoken detects Slack user OAuth tokens (xoxp-) — distinct from xoxb- bot tokens already handled by pkg/detectors/slack.
detectors/sleuth
Package sleuth detects Sleuth (sleuth.io) DORA-metrics API keys (40-char hex).
 Package sleuth detects Sleuth (sleuth.io) DORA-metrics API keys (40-char hex).
detectors/smartsheet
Package smartsheet detects Smartsheet API access tokens (alnum, no public prefix) gated on the `smartsheet` keyword window.
 Package smartsheet detects Smartsheet API access tokens (alnum, no public prefix) gated on the `smartsheet` keyword window.
detectors/smee
Package smee detects smee.io webhook proxy channel URLs — the URL itself is the credential.
 Package smee detects smee.io webhook proxy channel URLs — the URL itself is the credential.
detectors/smtp
Package smtp detects SMTP submission URIs that embed a password (`smtp://user:password@host:port` or `smtps://`).
 Package smtp detects SMTP submission URIs that embed a password (`smtp://user:password@host:port` or `smtps://`).
detectors/snipcart
Package snipcart detects Snipcart secret API keys.
 Package snipcart detects Snipcart secret API keys.
detectors/snov
Package snov detects Snov.io OAuth2 client_id + client_secret pairs near the `snov` keyword.
 Package snov detects Snov.io OAuth2 client_id + client_secret pairs near the `snov` keyword.
detectors/snowflake
Package snowflake detects Snowflake JWT keypair-auth tokens.
 Package snowflake detects Snowflake JWT keypair-auth tokens.
detectors/snyk
Package snyk detects Snyk API tokens gated on the "snyk" keyword window, verifying via /api/v1/user/me with `Authorization: token`.
 Package snyk detects Snyk API tokens gated on the "snyk" keyword window, verifying via /api/v1/user/me with `Authorization: token`.
detectors/socure
Package socure detects Socure RiskOS API keys near a `socure` keyword.
 Package socure detects Socure RiskOS API keys near a `socure` keyword.
detectors/sonarqube
Package sonarqube detects SonarQube / SonarCloud user tokens.
 Package sonarqube detects SonarQube / SonarCloud user tokens.
detectors/sonatypenexus
Package sonatypenexus detects Sonatype Nexus Repository user tokens (NXRT-<base64url>) gated on the `nexus` keyword window.
 Package sonatypenexus detects Sonatype Nexus Repository user tokens (NXRT-<base64url>) gated on the `nexus` keyword window.
detectors/spacelift
Package spacelift detects Spacelift IaC platform API keys (`s_<base62>`) — distinct prefix; verification is not attempted because Spacelift uses per-account hosts (<account>.app.spacelift.io).
 Package spacelift detects Spacelift IaC platform API keys (`s_<base62>`) — distinct prefix; verification is not attempted because Spacelift uses per-account hosts (<account>.app.spacelift.io).
detectors/sparkpost
Package sparkpost detects SparkPost transactional email API keys.
 Package sparkpost detects SparkPost transactional email API keys.
detectors/spinnaker
Package spinnaker detects Spinnaker (Netflix) API tokens (40-80 char base62 or JWT-shaped) gated on an assignment-style `spinnaker` credential anchor.
 Package spinnaker detects Spinnaker (Netflix) API tokens (40-80 char base62 or JWT-shaped) gated on an assignment-style `spinnaker` credential anchor.
detectors/splunkhec
Package splunkhec detects Splunk HTTP Event Collector tokens (UUIDv4 near `splunk_hec` / `services/collector`).
 Package splunkhec detects Splunk HTTP Event Collector tokens (UUIDv4 near `splunk_hec` / `services/collector`).
detectors/spotify
Package spotify detects Spotify Web API client_id + client_secret pairs and verifies them by minting an OAuth client_credentials token at /api/token.
 Package spotify detects Spotify Web API client_id + client_secret pairs and verifies them by minting an OAuth client_credentials token at /api/token.
detectors/sproutsocial
Package sproutsocial detects Sprout Social API access tokens — long alnum tokens near the `sproutsocial` keyword.
 Package sproutsocial detects Sprout Social API access tokens — long alnum tokens near the `sproutsocial` keyword.
detectors/squadcast
Package squadcast detects Squadcast API tokens (40+ alphanumeric near the `squadcast` keyword).
 Package squadcast detects Squadcast API tokens (40+ alphanumeric near the `squadcast` keyword).
detectors/square
Package square detects Square access tokens and verifies them via /v2/locations.
 Package square detects Square access tokens and verifies them via /v2/locations.
detectors/squarespace
Package squarespace detects Squarespace Commerce API keys (UUID shape).
 Package squarespace detects Squarespace Commerce API keys (UUID shape).
detectors/stabilityai
Package stabilityai detects Stability AI API keys (sk-<base62>{>=40}) gated on the `stability` keyword window.
 Package stabilityai detects Stability AI API keys (sk-<base62>{>=40}) gated on the `stability` keyword window.
detectors/statsig
Package statsig detects Statsig Console / server-secret API keys — `console-` / `secret-` prefix + alnum near the `statsig` keyword.
 Package statsig detects Statsig Console / server-secret API keys — `console-` / `secret-` prefix + alnum near the `statsig` keyword.
detectors/statuspage
Package statuspage detects Atlassian Statuspage API keys (UUID near `statuspage`) and verifies them against /v1/pages with `OAuth <token>` authorization.
 Package statuspage detects Atlassian Statuspage API keys (UUID near `statuspage`) and verifies them against /v1/pages with `OAuth <token>` authorization.
detectors/storj
Package storj detects Storj DCS access grants and API keys — long alphanumerics near the `storj` keyword.
 Package storj detects Storj DCS access grants and API keys — long alphanumerics near the `storj` keyword.
detectors/stripe
Package stripe detects Stripe keys, verifies them, and supports restricted-key revoke.
 Package stripe detects Stripe keys, verifies them, and supports restricted-key revoke.
detectors/stytch
Package stytch detects Stytch project secrets (secret-test-/secret-live-) gated on the `stytch` keyword window.
 Package stytch detects Stytch project secrets (secret-test-/secret-live-) gated on the `stytch` keyword window.
detectors/sumologic
Package sumologic detects Sumo Logic access ID + access key pairs and verifies them via /api/v1/users/me with HTTP Basic auth.
 Package sumologic detects Sumo Logic access ID + access key pairs and verifies them via /api/v1/users/me with HTTP Basic auth.
detectors/sumsub
Package sumsub detects Sumsub (sumsub.com) KYC API key + secret pairs.
 Package sumsub detects Sumsub (sumsub.com) KYC API key + secret pairs.
detectors/supabase
Package supabase detects Supabase JWT keys and verifies hosted refs against PostgREST.
 Package supabase detects Supabase JWT keys and verifies hosted refs against PostgREST.
detectors/supertokens
Package supertokens detects SuperTokens core API keys near the `supertokens` keyword.
 Package supertokens detects SuperTokens core API keys near the `supertokens` keyword.
detectors/surrealdb
Package surrealdb detects SurrealDB Cloud tokens — long base64url tokens near the `surrealdb` / `surreal` keyword.
 Package surrealdb detects SurrealDB Cloud tokens — long base64url tokens near the `surrealdb` / `surreal` keyword.
detectors/swimlane
Package swimlane detects Swimlane SOAR personal access tokens — long alnum strings near a `swimlane[_-]?(api[_-]?)?(token|key|secret)` assignment reference.
 Package swimlane detects Swimlane SOAR personal access tokens — long alnum strings near a `swimlane[_-]?(api[_-]?)?(token|key|secret)` assignment reference.
detectors/sysdig
Package sysdig detects Sysdig API tokens (40-hex co-occurring with `sysdig`) and verifies them against /api/v1/user/me.
 Package sysdig detects Sysdig API tokens (40-hex co-occurring with `sysdig`) and verifies them against /api/v1/user/me.
detectors/tailscale
Package tailscale detects Tailscale auth keys (`tskey-auth-…`), API keys (`tskey-api-…`), OAuth client secrets (`tskey-client-…`), and verifies them against Tailscale's dedicated secret-scanning partner endpoint.
 Package tailscale detects Tailscale auth keys (`tskey-auth-…`), API keys (`tskey-api-…`), OAuth client secrets (`tskey-client-…`), and verifies them against Tailscale's dedicated secret-scanning partner endpoint.
detectors/taxjar
Package taxjar detects TaxJar API tokens.
 Package taxjar detects TaxJar API tokens.
detectors/teamcity
Package teamcity detects JetBrains TeamCity server access tokens (40+ char base62 near `teamcity`).
 Package teamcity detects JetBrains TeamCity server access tokens (40+ char base62 near `teamcity`).
detectors/tektonhub
Package tektonhub detects Tekton Hub API tokens captured from an explicit token assignment (e.g.
 Package tektonhub detects Tekton Hub API tokens captured from an explicit token assignment (e.g.
detectors/telegram
Package telegram detects Telegram Bot API tokens (`<bot_id>:<35-char base64>`) and verifies them via /getMe.
 Package telegram detects Telegram Bot API tokens (`<bot_id>:<35-char base64>`) and verifies them via /getMe.
detectors/telnyx
Package telnyx detects Telnyx API V2 keys (`KEY<32-hex>` near `telnyx`) and verifies them against /v2/messaging_profiles with Bearer auth.
 Package telnyx detects Telnyx API V2 keys (`KEY<32-hex>` near `telnyx`) and verifies them against /v2/messaging_profiles with Bearer auth.
detectors/temporalcloud
Package temporalcloud detects Temporal Cloud API keys (`tcsk_` prefix + URL-safe base64).
 Package temporalcloud detects Temporal Cloud API keys (`tcsk_` prefix + URL-safe base64).
detectors/tenable
Package tenable detects Tenable.io / Tenable.sc API key+secret pairs.
 Package tenable detects Tenable.io / Tenable.sc API key+secret pairs.
detectors/tencentcloud
Package tencentcloud detects Tencent Cloud SecretId + SecretKey pairs and verifies them live against the STS OpenAPI.
 Package tencentcloud detects Tencent Cloud SecretId + SecretKey pairs and verifies them live against the STS OpenAPI.
detectors/terraformcloud
Package terraformcloud detects Terraform Cloud / Enterprise API tokens (<14 alnum>.atlasv1.<60+ url-safe>) and verifies them against /api/v2/account/details.
 Package terraformcloud detects Terraform Cloud / Enterprise API tokens (<14 alnum>.atlasv1.<60+ url-safe>) and verifies them against /api/v2/account/details.
detectors/terraformcloudteam
Package terraformcloudteam detects Terraform Cloud / Enterprise team API tokens.
 Package terraformcloudteam detects Terraform Cloud / Enterprise team API tokens.
detectors/thegraph
Package thegraph detects The Graph Studio API keys — 32-char hex strings near the `thegraph` keyword.
 Package thegraph detects The Graph Studio API keys — 32-char hex strings near the `thegraph` keyword.
detectors/tidio
Package tidio detects Tidio customer-chat OpenAPI keys (40-char hex).
 Package tidio detects Tidio customer-chat OpenAPI keys (40-char hex).
detectors/tinybird
Package tinybird detects Tinybird auth tokens (UUID-shaped) gated on the `tinybird` keyword.
 Package tinybird detects Tinybird auth tokens (UUID-shaped) gated on the `tinybird` keyword.
detectors/together
Package together detects Together.ai API keys (64-char lowercase hex) and verifies them against /v1/models.
 Package together detects Together.ai API keys (64-char lowercase hex) and verifies them against /v1/models.
detectors/totango
Package totango detects Totango customer-success service tokens near the `totango` keyword.
 Package totango detects Totango customer-success service tokens near the `totango` keyword.
detectors/traceloop
Package traceloop detects Traceloop LLM tracing API keys (`tl_` prefix + base64url).
 Package traceloop detects Traceloop LLM tracing API keys (`tl_` prefix + base64url).
detectors/transifex
Package transifex detects Transifex API tokens — `1/<hex>` or 40+ alnum strings near the `transifex` keyword.
 Package transifex detects Transifex API tokens — `1/<hex>` or 40+ alnum strings near the `transifex` keyword.
detectors/travisci
Package travisci detects Travis CI personal access tokens — 22 alnum near the `travis` keyword.
 Package travisci detects Travis CI personal access tokens — 22 alnum near the `travis` keyword.
detectors/tray
Package tray detects Tray.io master tokens (`tray_` prefix + alphanumeric).
 Package tray detects Tray.io master tokens (`tray_` prefix + alphanumeric).
detectors/trello
Package trello detects Trello API key + token pairs and verifies them against /1/members/me.
 Package trello detects Trello API key + token pairs and verifies them against /1/members/me.
detectors/trulioo
Package trulioo detects Trulioo (trulioo.com) GlobalGateway API keys near the `trulioo` keyword.
 Package trulioo detects Trulioo (trulioo.com) GlobalGateway API keys near the `trulioo` keyword.
detectors/trustpilot
Package trustpilot detects Trustpilot Business API keys — long alphanumerics near the `trustpilot` keyword.
 Package trustpilot detects Trustpilot Business API keys — long alphanumerics near the `trustpilot` keyword.
detectors/turso
Package turso detects Turso platform API tokens — 40+ char base64ish strings near the `turso` keyword.
 Package turso detects Turso platform API tokens — 40+ char base64ish strings near the `turso` keyword.
detectors/twilio
Package twilio detects Twilio Account SID + Auth Token pairs and verifies them against /2010-04-01/Accounts/<sid>.json.
 Package twilio detects Twilio Account SID + Auth Token pairs and verifies them against /2010-04-01/Accounts/<sid>.json.
detectors/twingate
Package twingate detects Twingate (twingate.com) API tokens (`tk_` prefix + colon/underscore-separated id + secret).
 Package twingate detects Twingate (twingate.com) API tokens (`tk_` prefix + colon/underscore-separated id + secret).
detectors/twitch
Package twitch detects Twitch OAuth client_secret values (30-char alnum co-occurring with `twitch` keyword) and verifies them against the /oauth2/validate endpoint after a client-credentials exchange.
 Package twitch detects Twitch OAuth client_secret values (30-char alnum co-occurring with `twitch` keyword) and verifies them against the /oauth2/validate endpoint after a client-credentials exchange.
detectors/typesense
Package typesense detects Typesense API keys.
 Package typesense detects Typesense API keys.
detectors/unixcrypthash
Package unixcrypthash detects `username:hash` password-hash lines: Apache/nginx `.htpasswd`, ProFTPD's flat-file passwd db (`proftpdpasswd` and similar), and `/etc/shadow`-style entries.
 Package unixcrypthash detects `username:hash` password-hash lines: Apache/nginx `.htpasswd`, ProFTPD's flat-file passwd db (`proftpdpasswd` and similar), and `/etc/shadow`-style entries.
detectors/upstashredis
Package upstashredis detects Upstash Redis REST tokens (long base64url near `upstash`).
 Package upstashredis detects Upstash Redis REST tokens (long base64url near `upstash`).
detectors/uptimerobot
Package uptimerobot detects UptimeRobot API keys (`u<digits>-<32 alnum>` for main account keys, `m<digits>-<32 alnum>` for monitor-specific keys).
 Package uptimerobot detects UptimeRobot API keys (`u<digits>-<32 alnum>` for main account keys, `m<digits>-<32 alnum>` for monitor-specific keys).
detectors/vanta
Package vanta detects Vanta (vanta.com) API tokens — long alnum tokens near `vanta` keyword.
 Package vanta detects Vanta (vanta.com) API tokens — long alnum tokens near `vanta` keyword.
detectors/vault
Package vault detects HashiCorp Vault tokens (`hvs.…`, `hvb.…`, legacy `s.…` service tokens).
 Package vault detects HashiCorp Vault tokens (`hvs.…`, `hvb.…`, legacy `s.…` service tokens).
detectors/vectra
Package vectra detects Vectra AI (NDR) API tokens near the `vectra` keyword.
 Package vectra detects Vectra AI (NDR) API tokens near the `vectra` keyword.
detectors/vercel
Package vercel detects Vercel API access tokens.
 Package vercel detects Vercel API access tokens.
detectors/vercelaigateway
Package vercelaigateway detects Vercel AI Gateway API keys (`vck_<base62>`) — distinct from Vercel deploy/account tokens (which are 24-char alphanumeric without a prefix).
 Package vercelaigateway detects Vercel AI Gateway API keys (`vck_<base62>`) — distinct from Vercel deploy/account tokens (which are 24-char alphanumeric without a prefix).
detectors/vercelblob
Package vercelblob detects Vercel Blob read-write tokens (`vercel_blob_rw_` prefix).
 Package vercelblob detects Vercel Blob read-write tokens (`vercel_blob_rw_` prefix).
detectors/veriff
Package veriff detects Veriff KYC API key (UUID) + shared-secret pair near the `veriff` keyword.
 Package veriff detects Veriff KYC API key (UUID) + shared-secret pair near the `veriff` keyword.
detectors/verifycoverage
Package verifycoverage mirrors docs/verify-coverage.md as Go data.
 Package verifycoverage mirrors docs/verify-coverage.md as Go data.
detectors/vertexai
Package vertexai detects Google Vertex AI / aiplatform OAuth access tokens near the `vertex` / `aiplatform` keyword.
 Package vertexai detects Google Vertex AI / aiplatform OAuth access tokens near the `vertex` / `aiplatform` keyword.
detectors/vespacloud
Package vespacloud detects Vespa Cloud API tokens near the `vespa` keyword.
 Package vespacloud detects Vespa Cloud API tokens near the `vespa` keyword.
detectors/victorops
Package victorops detects VictorOps / Splunk On-Call API keys (UUID near `victorops`).
 Package victorops detects VictorOps / Splunk On-Call API keys (UUID near `victorops`).
detectors/vimeo
Package vimeo detects Vimeo OAuth2 access tokens issued from the developer dashboard.
 Package vimeo detects Vimeo OAuth2 access tokens issued from the developer dashboard.
detectors/virustotal
Package virustotal detects VirusTotal API keys (64-char lowercase hex) gated on a "virustotal"/"vt_api_key" keyword window, and verifies them via the v3 users-self endpoint with x-apikey.
 Package virustotal detects VirusTotal API keys (64-char lowercase hex) gated on a "virustotal"/"vt_api_key" keyword window, and verifies them via the v3 users-self endpoint with x-apikey.
detectors/vitally
Package vitally detects Vitally customer-success API tokens near the `vitally` keyword.
 Package vitally detects Vitally customer-success API tokens near the `vitally` keyword.
detectors/vonage
Package vonage detects Vonage (Nexmo) API key + API secret pairs.
 Package vonage detects Vonage (Nexmo) API key + API secret pairs.
detectors/vouched
Package vouched detects Vouched KYC API keys (`pk_` prefix + alnum).
 Package vouched detects Vouched KYC API keys (`pk_` prefix + alnum).
detectors/voyageai
Package voyageai detects Voyage AI API keys (`pa-<base64url>`) and verifies them against /v1/embeddings with Bearer auth.
 Package voyageai detects Voyage AI API keys (`pa-<base64url>`) and verifies them against /v1/embeddings with Bearer auth.
detectors/vultr
Package vultr detects Vultr API keys (36-char alphanumeric near `vultr`) and verifies them via /v2/account.
 Package vultr detects Vultr API keys (36-char alphanumeric near `vultr`) and verifies them via /v2/account.
detectors/walmart
Package walmart detects Walmart Marketplace API client identifiers (UUID) + secret pair near the walmart keyword.
 Package walmart detects Walmart Marketplace API client identifiers (UUID) + secret pair near the walmart keyword.
detectors/wandb
Package wandb detects Weights & Biases API keys (40-char hex) near the wandb / weights-and-biases keyword.
 Package wandb detects Weights & Biases API keys (40-char hex) near the wandb / weights-and-biases keyword.
detectors/wasabi
Package wasabi detects Wasabi access key + secret pairs (S3-compatible shape: 20-char access key, 40-char secret) gated on the `wasabi` keyword window, and verifies them via the S3 GET Service (ListBuckets) operation.
 Package wasabi detects Wasabi access key + secret pairs (S3-compatible shape: 20-char access key, 40-char secret) gated on the `wasabi` keyword window, and verifies them via the S3 GET Service (ListBuckets) operation.
detectors/watsonx
Package watsonx detects IBM watsonx.ai API keys — 44-char base64-url alnum near the `watsonx` keyword.
 Package watsonx detects IBM watsonx.ai API keys — 44-char base64-url alnum near the `watsonx` keyword.
detectors/weaviate
Package weaviate detects Weaviate Cloud admin API keys (64-char base62 near `weaviate`) and verifies them against the cluster's /v1/meta with Bearer auth.
 Package weaviate detects Weaviate Cloud admin API keys (64-char base62 near `weaviate`) and verifies them against the cluster's /v1/meta with Bearer auth.
detectors/webex
Package webex detects Cisco Webex API access tokens.
 Package webex detects Cisco Webex API access tokens.
detectors/webhookrelay
Package webhookrelay detects WebhookRelay token key + secret pairs — `key`/`secret` UUID-shaped near the `webhookrelay` keyword.
 Package webhookrelay detects WebhookRelay token key + secret pairs — `key`/`secret` UUID-shaped near the `webhookrelay` keyword.
detectors/wise
Package wise detects Wise API tokens (UUIDs) gated on the `wise` / `transferwise` keyword window.
 Package wise detects Wise API tokens (UUIDs) gated on the `wise` / `transferwise` keyword window.
detectors/wiz
Package wiz detects Wiz.io OAuth2 access tokens.
 Package wiz detects Wiz.io OAuth2 access tokens.
detectors/woocommerce
Package woocommerce detects WooCommerce REST API consumer key + secret pairs (`ck_<40hex>` + `cs_<40hex>`).
 Package woocommerce detects WooCommerce REST API consumer key + secret pairs (`ck_<40hex>` + `cs_<40hex>`).
detectors/woodpecker
Package woodpecker detects Woodpecker CI access tokens near the `woodpecker` keyword.
 Package woodpecker detects Woodpecker CI access tokens near the `woodpecker` keyword.
detectors/workato
Package workato detects Workato API auth tokens.
 Package workato detects Workato API auth tokens.
detectors/workday
Package workday detects Workday OAuth bearer tokens — alnum 32+ near the `workday` keyword.
 Package workday detects Workday OAuth bearer tokens — alnum 32+ near the `workday` keyword.
detectors/workos
Package workos detects WorkOS API keys (`sk_test_` / `sk_live_` prefix followed by base62).
 Package workos detects WorkOS API keys (`sk_test_` / `sk_live_` prefix followed by base62).
detectors/wrike
Package wrike detects Wrike permanent access tokens (>=40 base64url chars) gated on the `wrike` keyword window.
 Package wrike detects Wrike permanent access tokens (>=40 base64url chars) gated on the `wrike` keyword window.
detectors/writer
Package writer detects Writer.com generative-AI Writer-Key API tokens — long alphanumerics near the `writer` keyword.
 Package writer detects Writer.com generative-AI Writer-Key API tokens — long alphanumerics near the `writer` keyword.
detectors/xai
Package xai detects xAI API keys (`xai-<base62>`).
 Package xai detects xAI API keys (`xai-<base62>`).
detectors/yugabytecloud
Package yugabytecloud detects YugabyteDB Managed (Yugabyte Cloud) API keys.
 Package yugabytecloud detects YugabyteDB Managed (Yugabyte Cloud) API keys.
detectors/zendesk
Package zendesk detects Zendesk API tokens (40 alphanumerics near `zendesk` keyword) paired with the operator email Zendesk requires for Basic auth.
 Package zendesk detects Zendesk API tokens (40 alphanumerics near `zendesk` keyword) paired with the operator email Zendesk requires for Basic auth.
detectors/zerobounce
Package zerobounce detects ZeroBounce email-validation API keys (32 hex) near the `zerobounce` keyword.
 Package zerobounce detects ZeroBounce email-validation API keys (32 hex) near the `zerobounce` keyword.
detectors/zerotier
Package zerotier detects ZeroTier Central API tokens.
 Package zerotier detects ZeroTier Central API tokens.
detectors/zoho
Package zoho detects Zoho OAuth refresh tokens near Zoho context.
 Package zoho detects Zoho OAuth refresh tokens near Zoho context.
detectors/zoom
Package zoom detects Zoom OAuth client_id + client_secret pairs and verifies them by exchanging the pair for an access token via the /oauth/token endpoint with HTTP Basic auth.
 Package zoom detects Zoom OAuth client_id + client_secret pairs and verifies them by exchanging the pair for an access token via the /oauth/token endpoint with HTTP Basic auth.
detectors/zoominfo
Package zoominfo detects ZoomInfo API access tokens — long base64url JWT-shaped tokens near the `zoominfo` keyword.
 Package zoominfo detects ZoomInfo API access tokens — long base64url JWT-shaped tokens near the `zoominfo` keyword.
engine
Package engine drives chunk dispatch, detector execution, and sink emission.
 Package engine drives chunk dispatch, detector execution, and sink emission.
output
Package output renders findings in table, JSON, or SARIF form.
 Package output renders findings in table, JSON, or SARIF form.
piidb
Package piidb implements cross-finding PIIDB candidate detection and severity escalation.
 Package piidb implements cross-finding PIIDB candidate detection and severity escalation.
piiengine/anonymize
Package anonymize manages the lifecycle of an external pleno-anonymize HTTP server bound to a loopback port and exposes a thin Analyze client.
 Package anonymize manages the lifecycle of an external pleno-anonymize HTTP server bound to a loopback port and exposes a thin Analyze client.
piiengine/opfnative
Package opfnative is the in-process privacy-filter.cpp PII engine, gated by build tag opf_native (ADR-0005).
 Package opfnative is the in-process privacy-filter.cpp PII engine, gated by build tag opf_native (ADR-0005).
sources
Package sources defines the Source interface and the Chunk shape that detectors consume.
 Package sources defines the Source interface and the Chunk shape that detectors consume.
sources/all
Package all blank-imports every concrete source so their init() registers against pkg/sources.registry.
 Package all blank-imports every concrete source so their init() registers against pkg/sources.registry.
sources/catalog
Package catalog unifies pkg/sources' core-source registry and pkg/connectors' SaaS-connector registry into one enumerable list, so `pleno-dlp sources list` and doc counts derive from what is actually registered instead of hand-typed prose.
 Package catalog unifies pkg/sources' core-source registry and pkg/connectors' SaaS-connector registry into one enumerable list, so `pleno-dlp sources list` and doc counts derive from what is actually registered instead of hand-typed prose.
sources/dockerimage
Package dockerimage scans OCI/Docker image layers and the image config blob for secrets.
 Package dockerimage scans OCI/Docker image layers and the image config blob for secrets.
sources/filesystem
Package filesystem walks local paths and emits one chunk per regular file.
 Package filesystem walks local paths and emits one chunk per regular file.
sources/gcs
Package gcs lists objects in a GCS bucket and emits one chunk per text object.
 Package gcs lists objects in a GCS bucket and emits one chunk per text object.
sources/git
Package git walks local git history and emits added content per commit.
 Package git walks local git history and emits added content per commit.
sources/s3
Package s3 lists objects in an S3 bucket and emits one chunk per text object.
 Package s3 lists objects in an S3 bucket and emits one chunk per text object.
sources/sqldump
Package sqldump scans SQL dump files for secrets.
 Package sqldump scans SQL dump files for secrets.
sources/stdin
Package stdin reads one chunk from stdin or an injected reader.
 Package stdin reads one chunk from stdin or an injected reader.
verify
Package verify provides shared HTTP infrastructure for detector verification.
 Package verify provides shared HTTP infrastructure for detector verification.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.