@runa-ai/runa-cli 0.5.46 → 0.5.47

package/dist/index.js

@@ -929,7 +929,7 @@ var CLI_VERSION, HAS_ADMIN_COMMAND;
 var init_version = __esm({
   "src/version.ts"() {
     init_esm_shims();
-    CLI_VERSION = "0.5.46";
+    CLI_VERSION = "0.5.47";
     HAS_ADMIN_COMMAND = false;
   }
 });
@@ -1905,6 +1905,14 @@ function calculateConfidence(pattern) {
     "github-token",
     // ghp_/gho_/etc prefix is unique
     "github-oauth",
+    "openai-api-key",
+    // sk- prefix with length constraint
+    "openai-project-key",
+    // sk-proj- prefix is unique
+    "anthropic-api-key",
+    // sk-ant-api prefix is unique
+    "google-api-key",
+    // AIza prefix is unique to Google (Gemini, Vertex AI, etc.)
     "stripe-secret",
     // sk_live_ prefix is unique
     "stripe-test",
@@ -1926,8 +1934,6 @@ function calculateConfidence(pattern) {
     return 0.95;
   }
   const mediumConfidencePatterns = [
-    "google-api-key",
-    // AIza prefix is fairly unique
     "google-oauth",
     "database-url",
     // Has structure but could be example
@@ -2150,13 +2156,13 @@ var init_secret_analyzer = __esm({
         description: "GitHub OAuth Token detected",
         cweId: CWE.HARDCODED_CREDENTIALS
       },
-      // Google
+      // Google / Gemini
       {
         id: "google-api-key",
-        name: "Google API Key",
+        name: "Google / Gemini API Key",
         pattern: /AIza[0-9A-Za-z\-_]{35}/g,
-        severity: "high",
-        description: "Google API Key detected",
+        severity: "critical",
+        description: "Google API Key detected (used by Gemini, Vertex AI, Maps, etc.)",
         cweId: CWE.HARDCODED_CREDENTIALS
       },
       {
@@ -2190,7 +2196,12 @@ var init_secret_analyzer = __esm({
       {
         id: "supabase-service-role",
         name: "Supabase Service Role Key",
-        pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Ilth-z0-9XXsyMH0iLCJyb2xlIjoic2VydmljZV9yb2xlIi/g,
+        // Supabase JWT: header.payload.signature
+        // Header: {"alg":"HS256","typ":"JWT"} (fixed)
+        // Payload prefix: {"iss":"supabase","ref": (24 bytes, 3-byte aligned = stable base64url)
+        // Service role marker: role":"service_role" = cm9sZSI6InNlcnZpY2Vfcm9sZSI (stable)
+        // Variable content between prefix and marker covers the encoded project ref
+        pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6[A-Za-z0-9_-]+cm9sZSI6InNlcnZpY2Vfcm9sZSI[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+/g,
         severity: "critical",
         description: "Supabase Service Role Key detected",
         cweId: CWE.HARDCODED_CREDENTIALS
@@ -2354,6 +2365,26 @@ var init_secret_analyzer = __esm({
       // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
       // AI Service API Keys (2024-2026 patterns)
       // ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+      {
+        id: "openai-api-key",
+        name: "OpenAI API Key",
+        // Format: sk-{48+ alphanumeric chars} (real keys are typically 51 chars)
+        // SECURITY: Bounded quantifier to prevent ReDoS
+        pattern: /sk-[a-zA-Z0-9]{48,200}/g,
+        severity: "critical",
+        description: "OpenAI API key detected",
+        cweId: CWE.HARDCODED_CREDENTIALS
+      },
+      {
+        id: "openai-project-key",
+        name: "OpenAI Project Key",
+        // Format: sk-proj-{48+ alphanumeric/dash/underscore chars}
+        // SECURITY: Bounded quantifier to prevent ReDoS
+        pattern: /sk-proj-[a-zA-Z0-9_-]{48,200}/g,
+        severity: "critical",
+        description: "OpenAI Project API key detected",
+        cweId: CWE.HARDCODED_CREDENTIALS
+      },
       {
         id: "anthropic-api-key",
         name: "Anthropic API Key",

package/dist/internal/vuln-checker/analyzers/secret-analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/secret-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AA2jClG;;GAEG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,IAAI,SAAoB;IACxB,UAAU,EAAE,QAAQ,EAAE,CAAc;IAE9B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB7C,cAAc;IAY5B,OAAO,CAAC,UAAU;CAGnB"}
+{"version":3,"file":"secret-analyzer.d.ts","sourceRoot":"","sources":["../../../../src/internal/vuln-checker/analyzers/secret-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAulClG;;GAEG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,IAAI,SAAoB;IACxB,UAAU,EAAE,QAAQ,EAAE,CAAc;IAE9B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YAkB7C,cAAc;IAY5B,OAAO,CAAC,UAAU;CAGnB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.5.46",
+  "version": "0.5.47",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",