residoo 0.3.2 → 0.3.4

package/README.md

@@ -104,6 +104,18 @@ won't be built into the tool that writes it.
 - Covers Stripe keys in both modes: live (`sk_live`/`rk_live`) and test
   (`sk_test`/`rk_test`), because a leaked test key still holds real
   permissions in its sandbox and reveals account structure.
+- Pairs an AWS secret access key (40 base64 characters, no vendor prefix, not
+  a rule on its own) with a nearby confirmed access key id, and reports both
+  at high confidence: the pairing is the vendor-specific signal, not the
+  shape alone. Ambiguous pairings (more than one candidate nearby) are
+  reported as nothing rather than a guess. See `src/pairing.js`.
+- With `--include-noisy`, filters the broad generic-secret rules by how
+  machine-random the matched value actually looks (a lightweight, offline
+  approximation of BPE-tokenization rarity checks): ordinary English, a
+  placeholder, or a variable name is suppressed with its own stated reason
+  instead of padding the count; a value that reads as random gets its
+  confidence raised to `medium`. Never applied to the default high-confidence
+  rules. See `src/rarity.js`.
 - Redacts everything in its own output. You get a shape and a first/last-4
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
@@ -292,7 +304,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.3.0
+  - uses: dandovdub/residoo@v0.3.4
 ```
 
 As a pre-commit hook:
@@ -300,7 +312,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.3.0
+    rev: v0.3.4
     hooks:
       - id: residoo
 ```

package/SECURITY.md

@@ -45,8 +45,19 @@ just asserted. See the git history for the actual commands run:
 - **Not vulnerable to regex denial-of-service.** Every pattern checked
   against the nested-quantifier shape behind real, dated CVEs in adjacent
   tooling (e.g. CVE-2026-0621, a ReDoS in Anthropic's own MCP SDK from
-  catastrophic backtracking on an exploded template pattern). Also stress-
-  tested directly against multi-megabyte adversarial inputs.
+  catastrophic backtracking on an exploded template pattern). A second,
+  distinct failure mode was found and fixed during a pre-launch audit: an
+  open-ended quantifier (`{n,}`) matching a multi-megabyte same-charset run
+  can overflow V8's regex engine on stack depth alone, independent of
+  catastrophic backtracking. The raw-match, base64-decode, and split-line
+  passes shared one try/catch at the time, so a crash partway through the
+  rule list could silently skip every rule after it for that line. Every
+  rule's quantifier is now explicitly bounded to its format's real maximum
+  length (a credential shape has a knowable ceiling), each of the three
+  passes has its own try/catch as a second, independent layer, and a
+  regression test asserts a real secret placed immediately after a
+  multi-megabyte adversarial run is still found. Stress-tested directly
+  against multi-megabyte adversarial inputs, including that exact shape.
 - **No supply-chain surface.** Zero runtime dependencies, zero
   pre/post-install lifecycle scripts. Check `package.json` yourself;
   there's nothing to hide behind a `postinstall` hook.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/pairing.js

@@ -0,0 +1,83 @@
+"use strict";
+
+/**
+ * Feature 3: paired-secret detection.
+ *
+ * An AWS secret access key is a 40-character base64 value with no
+ * vendor-recognizable prefix. Reported alone, it is indistinguishable from
+ * a hash, a session id, or any other base64-shaped string, so it is not one
+ * of patterns.js's own PATTERNS: a bare rule for it would be exactly the
+ * noisy, low-confidence shape that file's own header keeps out of the
+ * default set.
+ *
+ * But an AWS secret key is never leaked alone: every real credential pair
+ * ships an access key id alongside it (the id names WHICH key; the secret
+ * authenticates it, and one is useless to an attacker without the other),
+ * so every AWS SDK config, env file, or credentials file that leaks the
+ * secret leaks the id in the same breath. Instead of a standalone rule,
+ * this looks for a 40-char base64 run within a tight window of an
+ * already-confirmed AKIA/ASIA match: the PAIRING is the vendor-specific
+ * signal, not the shape alone. Same idea as betterleaks' `components`
+ * mechanism (pairing a low-signal shape to a nearby high-confidence rule to
+ * raise combined confidence), built offline and dependency-free like every
+ * other mechanism here: no rule is added to the default set, and a bare
+ * 40-char base64 string anywhere else on a line, with no access key nearby,
+ * is still silently ignored exactly as before this feature existed.
+ */
+
+const WINDOW = 400; // chars searched on each side of the access-key match
+
+// AWS secret keys are exactly 40 base64-alphabet characters (40 is a
+// multiple of 4, so real keys carry no "=" padding). \b on both sides so a
+// candidate embedded in a longer alnum run (a hash, a dash-free UUID) is
+// not mistaken for one — the same boundary discipline every rule in
+// patterns.js already applies to its own matches.
+const CANDIDATE_RE = /\b[A-Za-z0-9/+]{40}\b/g;
+
+/**
+ * A run of 12+ identical characters at either end. This is the same
+ * placeholder tell as scan.js's zeroEntropyTail, reimplemented locally (not
+ * imported) because it must check BOTH ends here: a candidate window can
+ * hold a placeholder abutting real text on either side, where scan.js's own
+ * rules only ever see a value anchored at a rule's own prefix, so only the
+ * tail end needs checking there.
+ */
+function looksZeroEntropy(value) {
+  const isRun = (s) => {
+    for (let i = 1; i < s.length; i++) if (s[i] !== s[0]) return false;
+    return true;
+  };
+  return isRun(value.slice(0, 12)) || isRun(value.slice(-12));
+}
+
+/**
+ * Find an AWS secret access key candidate paired with an already-matched
+ * access key id or session token on this line. `akiaValue` and `akiaIndex`
+ * locate the paired match so the search can be windowed around it and so
+ * the access key's own text is never re-matched as its own pair.
+ *
+ * Returns the candidate string, or null when there is none, or when more
+ * than one distinct candidate sits in the window. Ambiguous pairing is
+ * reported as nothing at all: for a finding whose whole point is "this is
+ * high confidence because of what it's next to," guessing wrong is worse
+ * than staying silent.
+ */
+function findPairedSecret(line, akiaValue, akiaIndex) {
+  const start = Math.max(0, akiaIndex - WINDOW);
+  const end = Math.min(line.length, akiaIndex + akiaValue.length + WINDOW);
+  const around = line.slice(start, end);
+  CANDIDATE_RE.lastIndex = 0;
+  let m;
+  let found = null;
+  while ((m = CANDIDATE_RE.exec(around)) !== null) {
+    const value = m[0];
+    if (value !== akiaValue && !looksZeroEntropy(value)) {
+      if (found !== null && found !== value) return null;
+      found = value;
+    }
+    if (m.index === CANDIDATE_RE.lastIndex) CANDIDATE_RE.lastIndex++;
+  }
+  return found;
+}
+
+module.exports = { findPairedSecret };

package/src/patterns.js

@@ -21,13 +21,13 @@ const PATTERNS = [
   { id: "private_key_block", label: "Private key block", confidence: "high",
     re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g },
   { id: "github_pat", label: "GitHub personal access token", confidence: "high",
-    re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+    re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
   { id: "gitlab_pat", label: "GitLab personal access token", confidence: "high",
-    re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g },
+    re: /\bglpat-[A-Za-z0-9_-]{20,100}\b/g },
   { id: "slack_token", label: "Slack token", confidence: "high",
-    re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+    re: /\bxox[baprs]-[0-9A-Za-z-]{10,500}\b/g },
   { id: "stripe_key", label: "Stripe API key (live mode)", confidence: "high",
-    re: /\b(sk|rk)_live_[A-Za-z0-9]{20,}\b/g },
+    re: /\b(sk|rk)_live_[A-Za-z0-9]{20,250}\b/g },
   // The sandbox-mode twin of the rule above, same body charset and the same
   // 20-char floor. Format verified against two production detectors plus the
   // vendor (2026-09-02): gitleaks' stripe-access-token rule matches
@@ -45,34 +45,34 @@ const PATTERNS = [
   // transcript that pastes sk_test today is the same workflow that will
   // paste sk_live at go-live.
   { id: "stripe_test_key", label: "Stripe API key (test mode)", confidence: "high",
-    re: /\b(sk|rk)_test_[A-Za-z0-9]{20,}\b/g },
+    re: /\b(sk|rk)_test_[A-Za-z0-9]{20,250}\b/g },
   // The negative lookahead keeps this rule mutually exclusive with anthropic_key
   // and openrouter_key below — without it, "sk-ant-..." or "sk-or-v1-..." match
   // BOTH this pattern and the more specific one, and get reported twice under
   // two different (one wrong) provider labels. Verified: all three regexes
   // independently matched their overlapping synthetic keys before this fix.
   { id: "openai_key", label: "OpenAI API key", confidence: "high",
-    re: /\bsk-(?!ant-|or-)(proj-)?[A-Za-z0-9_-]{20,}\b/g },
+    re: /\bsk-(?!ant-|or-)(proj-)?[A-Za-z0-9_-]{20,300}\b/g },
   { id: "anthropic_key", label: "Anthropic API key", confidence: "high",
-    re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g },
+    re: /\bsk-ant-[A-Za-z0-9_-]{20,300}\b/g },
   { id: "google_api_key", label: "Google / Firebase API key", confidence: "high",
     re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
   { id: "npm_token", label: "npm access token", confidence: "high",
     re: /\bnpm_[A-Za-z0-9]{36}\b/g },
   { id: "sendgrid_key", label: "SendGrid API key", confidence: "high",
-    re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
+    re: /\bSG\.[A-Za-z0-9_-]{16,100}\.[A-Za-z0-9_-]{16,100}\b/g },
   { id: "twilio_key", label: "Twilio API key", confidence: "high",
     re: /\bSK[a-f0-9]{32}\b/g },
   { id: "jwt", label: "JWT-shaped token", confidence: "medium",
-    re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+    re: /\beyJ[A-Za-z0-9_-]{10,2000}\.eyJ[A-Za-z0-9_-]{10,20000}\.[A-Za-z0-9_-]{10,2000}\b/g },
   { id: "connection_string_with_password", label: "Database connection string with embedded password", confidence: "high",
-    re: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s:@\/]+:[^\s@\/]{3,}@[^\s\/]+/g },
+    re: /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?):\/\/[^\s:@\/]{1,255}:[^\s@\/]{3,255}@[^\s\/]{1,255}/g },
   { id: "bearer_header", label: "Authorization: Bearer header with a real-looking token", confidence: "medium",
-    re: /\bauthorization["']?\s*[:=]\s*["']?bearer\s+[A-Za-z0-9._-]{16,}/gi },
+    re: /\bauthorization["']?\s*[:=]\s*["']?bearer\s+[A-Za-z0-9._-]{16,1000}/gi },
   { id: "refresh_token_field", label: "refresh_token field", confidence: "medium",
-    re: /"refresh_token"\s*:\s*"[^"\s]{20,}"/gi },
+    re: /"refresh_token"\s*:\s*"[^"\s]{20,4000}"/gi },
   { id: "access_token_field", label: "access_token field", confidence: "medium",
-    re: /"access_token"\s*:\s*"[^"\s]{20,}"/gi },
+    re: /"access_token"\s*:\s*"[^"\s]{20,4000}"/gi },
 
   // ── AI / LLM providers (added: competitive gap-close, see project history) ─
   // Every regex body below was checked against a production, field-tested
@@ -102,7 +102,7 @@ const PATTERNS = [
   // "pplx-" + a >=40-char body — consistent across independent sources even
   // without one canonical spec page.
   { id: "perplexity_key", label: "Perplexity API key", confidence: "high",
-    re: /\bpplx-[A-Za-z0-9]{40,}\b/g },
+    re: /\bpplx-[A-Za-z0-9]{40,200}\b/g },
   { id: "replicate_token", label: "Replicate API token", confidence: "high",
     re: /\br8_[0-9A-Za-z_-]{37}\b/g },
 
@@ -121,7 +121,7 @@ const PATTERNS = [
     // Confirmed against 1Password's own developer docs (developer.1password.com
     // -> 1password.dev/service-accounts/security): the token is "ops_" plus a
     // base64-encoded JWT, so it always continues "eyJ" (base64 of `{"`).
-    re: /\bops_eyJ[A-Za-z0-9+/=_-]{40,}\b/g },
+    re: /\bops_eyJ[A-Za-z0-9+/=_-]{40,2000}\b/g },
 
   // ── Comms / SaaS ───────────────────────────────────────────────────────
   { id: "discord_webhook", label: "Discord webhook URL", confidence: "high",
@@ -138,13 +138,13 @@ const PATTERNS = [
   // but Notion has not published an exact body length for it, so its bound
   // below is a floor, not a verified exact count.
   { id: "notion_token", label: "Notion integration token", confidence: "high",
-    re: /\b(?:secret_[A-Za-z0-9]{43}|ntn_[A-Za-z0-9]{20,})\b/g },
+    re: /\b(?:secret_[A-Za-z0-9]{43}|ntn_[A-Za-z0-9]{20,200})\b/g },
   { id: "linear_key", label: "Linear API key", confidence: "high",
     re: /\blin_api_[0-9A-Za-z]{40}\b/g },
   { id: "sentry_token", label: "Sentry auth token", confidence: "high",
     // Covers both current Sentry token shapes: org-scoped (sntrys_, base64
     // JWT-like body) and user-scoped (sntryu_, hex body).
-    re: /\b(?:sntrys_eyJ[A-Za-z0-9+/=_]{100,}|sntryu_[a-f0-9]{64})\b/g },
+    re: /\b(?:sntrys_eyJ[A-Za-z0-9+/=_]{100,4000}|sntryu_[a-f0-9]{64})\b/g },
 ];
 
 /**
@@ -154,9 +154,9 @@ const PATTERNS = [
  */
 const NOISY_PATTERNS = [
   { id: "generic_password_assignment", label: "password / pwd assignment", confidence: "low",
-    re: /\b(password|passwd|pwd)\s*[:=]\s*["']?[^\s"']{6,}["']?/gi },
+    re: /\b(password|passwd|pwd)\s*[:=]\s*["']?[^\s"']{6,500}["']?/gi },
   { id: "generic_secret_assignment", label: "generic secret / apikey assignment", confidence: "low",
-    re: /\b(api[_-]?key|secret)\s*[:=]\s*["']?[A-Za-z0-9_\-\/+=]{12,}["']?/gi },
+    re: /\b(api[_-]?key|secret)\s*[:=]\s*["']?[A-Za-z0-9_\-\/+=]{12,500}["']?/gi },
 ];
 
 /**

package/src/rarity.js

@@ -0,0 +1,75 @@
+"use strict";
+
+/**
+ * "Rare, not random" — a lightweight, offline approximation of betterleaks'
+ * BPE-tokenization rarity filter (see their "Rare Not Random" writeup),
+ * applied only to NOISY_PATTERNS matches: a bare `password = "..."` or
+ * `api_key = "..."` assignment is the hardest class of finding precisely
+ * because most matches are placeholders, variable names, or ordinary
+ * English ("password = correcthorsebattery", "secret = temporary_value"),
+ * not real secrets.
+ *
+ * A real BPE tokenizer needs an embedded merge-rules vocabulary (GPT-2's is
+ * roughly 50,000 entries) — far too heavy for a zero-dependency, small CLI.
+ * This approximates the same signal ("does this look like language, or like
+ * noise") with a small, hand-picked table of common English letter bigrams
+ * (standard digraph-frequency tables — "th", "he", "in", "er"... together
+ * cover a large majority of ordinary English text) instead of a learned
+ * vocabulary: real secret material is high-entropy machine output and
+ * essentially never strings together English digraphs at the rate real
+ * words and sentences do, while a placeholder, a variable name, or a
+ * pasted sentence almost always does.
+ *
+ * This is deliberately not a security boundary. It only ever adjusts
+ * confidence on the already-opt-in, already low-confidence NOISY_PATTERNS
+ * rules (see patterns.js's own header on why those are opt-in) and is never
+ * applied to, and never changes the outcome of, any of the default 38
+ * high/medium-confidence rules.
+ */
+
+// The most frequent English letter bigrams (standard digraph-frequency
+// tables, e.g. Konheim's letter-pair frequency study). Not exhaustive by
+// design: the point is common, unmistakably-linguistic pairs, not full
+// coverage of every English bigram.
+const COMMON_BIGRAMS = new Set([
+  "th", "he", "in", "er", "an", "re", "on", "at", "en", "nd",
+  "ti", "es", "or", "te", "of", "ed", "is", "it", "al", "ar",
+  "st", "to", "nt", "ng", "se", "ha", "as", "ou", "io", "le",
+  "ve", "co", "me", "de", "hi", "ri", "ro", "ic", "ne", "ea",
+  "ra", "ce", "li", "ch", "ll", "be", "ma", "si", "om", "ur",
+]);
+
+/**
+ * Fraction of the value's consecutive lowercase-letter bigrams that are one
+ * of the common English digraphs above. A non-letter character (digit,
+ * punctuation, symbol) breaks a bigram pair rather than being skipped over:
+ * a real secret's occasional letter run should not accidentally read as
+ * language just because two of its letters happen to land next to each
+ * other and spell a common pair across what was actually a digit boundary.
+ */
+function commonBigramFraction(value) {
+  const lower = value.toLowerCase();
+  let total = 0;
+  let common = 0;
+  for (let i = 0; i < lower.length - 1; i++) {
+    const a = lower[i], b = lower[i + 1];
+    if (a >= "a" && a <= "z" && b >= "a" && b <= "z") {
+      total++;
+      if (COMMON_BIGRAMS.has(a + b)) common++;
+    }
+  }
+  return total === 0 ? 0 : common / total;
+}
+
+// Above this fraction, a value reads as language (or a language-shaped
+// placeholder) rather than machine-random output. Calibrated against common
+// English words and phrases scoring well above it, and random/base64/hex
+// strings scoring at or near zero (see tests/smoke.js).
+const LANGUAGE_THRESHOLD = 0.20;
+
+/** True when `value` reads as machine-random rather than as language. */
+function looksRandom(value) {
+  return commonBigramFraction(value) < LANGUAGE_THRESHOLD;
+}
+
+module.exports = { looksRandom, commonBigramFraction };

package/src/rotation.js

@@ -97,6 +97,21 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deactivate before delete: a deactivated key can be re-enabled while you hunt down stragglers, a deleted one cannot.",
   },
+  // The secret half of the same pair (see pairing.js): reported only when
+  // found near a matched aws_access_key_id, so the same key is the one that
+  // needs deactivating. Same console flow, called out separately because the
+  // finding itself is a distinct rule id and deserves its own runbook rather
+  // than silently reusing aws_access_key_id's guidance under a different name.
+  aws_secret_access_key_paired: {
+    label: "AWS IAM secret access key (paired with a leaked access key id)",
+    rotateUrl: "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html",
+    steps: [
+      "This is the secret half of the access key id also found on this line",
+      "Console: IAM > Users > your user > Security credentials > Access keys",
+      "Deactivate and delete the paired access key; its secret dies with it",
+    ],
+    revokeNote: "An AWS secret key cannot be revoked on its own: deactivating its paired access key id is what invalidates it.",
+  },
   // Fetched https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_revoke-sessions.html
   // (2026-09-02): "Revoke IAM role temporary security credentials", console
   // path IAM > Roles > role > Revoke sessions tab.

package/src/scan.js

@@ -3,6 +3,17 @@
 const path = require("path");
 const { PATTERNS, NOISY_PATTERNS, redact } = require("./patterns");
 const { findDecodedMatches, findBoundaryMatches, contentProjection } = require("./decode");
+const { findPairedSecret } = require("./pairing");
+const { looksRandom } = require("./rarity");
+
+// Rule ids that findPairedSecret's window search applies to (see pairing.js):
+// AWS access key ids and STS session tokens both pair with the same shape
+// of 40-char base64 secret value.
+const AWS_PAIR_RULE_IDS = new Set(["aws_access_key_id", "aws_session_token"]);
+
+// The two NOISY_PATTERNS ids (see patterns.js): the only rules the rarity
+// check (rarity.js) ever touches. Never applied to the default 38 rules.
+const NOISY_RULE_IDS = new Set(["generic_password_assignment", "generic_secret_assignment"]);
 
 /**
  * Text immediately before a match that strongly suggests "this is an example
@@ -165,27 +176,62 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // last and only where surrounding text exists (`before` is null for the
   // decode and boundary passes, whose transforms have no stable "40 chars
   // before" in the original line).
-  const suppressionReason = (value, before) => {
+  const suppressionReason = (value, before, ruleId) => {
     if (VENDOR_EXAMPLE_VALUES.has(value)) return "vendor-documented example value";
     if (zeroEntropyTail(value)) return "zero-entropy body";
     if (before !== null && SUPPRESS_CONTEXT_RE.test(before)) return "placeholder-like context";
+    // Rarity check (rarity.js): only the two opt-in NOISY_PATTERNS rules ever
+    // reach here with a matching ruleId. A generic password/secret
+    // assignment whose value reads as English (a placeholder, a variable
+    // name, a pasted sentence) is exactly the false-positive class those
+    // rules are known for; a value that reads as machine-random is not.
+    if (ruleId && NOISY_RULE_IDS.has(ruleId) && !looksRandom(value)) return "reads like natural language, not random";
     return null;
   };
 
+  // Confidence for a NOISY_PATTERNS match that survives every suppression
+  // check is bumped from the rule's default "low" to "medium" when the
+  // value also reads as machine-random (rarity.js): passing both "not a
+  // known placeholder shape" AND "doesn't read like language" is a real
+  // signal boost, not just the absence of a red flag. Never touches any of
+  // the default 38 rules' own confidence.
+  const resolveConfidence = (ruleId, value, defaultConfidence, suppressedReason) => {
+    if (suppressedReason) return "low";
+    if (NOISY_RULE_IDS.has(ruleId) && looksRandom(value)) return "medium";
+    return defaultConfidence;
+  };
+
   const matchLine = (line, file, relFile, lineNo, mtimeMs) => {
     for (const rule of rules) {
       rule.re.lastIndex = 0; // rules are reused across files; reset global regex state
       let m;
       while ((m = rule.re.exec(line)) !== null) {
         const before = line.slice(Math.max(0, m.index - CONTEXT_WINDOW), m.index);
-        const suppressedReason = suppressionReason(m[0], before);
+        const suppressedReason = suppressionReason(m[0], before, rule.id);
         if (suppressedReason && !includeSuppressed) {
           suppressedCount++;
         } else {
           record(rule, m[0], relFile, file, lineNo,
             mtimeMs,
-            suppressedReason ? "low" : rule.confidence,
+            resolveConfidence(rule.id, m[0], rule.confidence, suppressedReason),
             suppressedReason);
+          // Feature 3: paired-secret detection (see pairing.js). Only
+          // attempted for an UNSUPPRESSED access-key finding — pairing a
+          // vendor-example or placeholder access key with a random-looking
+          // neighbor would be a false amplification, not a real finding.
+          if (!suppressedReason && AWS_PAIR_RULE_IDS.has(rule.id)) {
+            const paired = findPairedSecret(line, m[0], m.index);
+            if (paired) {
+              const pairedSuppressedReason = suppressionReason(paired, null);
+              if (pairedSuppressedReason && !includeSuppressed) {
+                suppressedCount++;
+              } else {
+                record({ id: "aws_secret_access_key_paired", label: "AWS Secret Access Key (paired with access key id)" },
+                  paired, relFile, file, lineNo, mtimeMs,
+                  pairedSuppressedReason ? "low" : "high", pairedSuppressedReason, { paired: true });
+              }
+            }
+          }
         }
         if (m.index === rule.re.lastIndex) rule.re.lastIndex++; // guard zero-width matches
       }
@@ -217,7 +263,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // caller and reused across both of a line's pairs.
   const boundaryPair = (contentA, contentB, file, relFile, lineNoA, mtimeMs) => {
     for (const b of findBoundaryMatches(contentA, contentB, rules)) {
-      const suppressedReason = suppressionReason(b.value, null);
+      const suppressedReason = suppressionReason(b.value, null, b.ruleId);
       if (suppressedReason && !includeSuppressed) {
         // One straddling match is one suppressed match, even though an
         // unsuppressed one records against both contributing lines.
@@ -225,7 +271,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
         continue;
       }
       const span = [lineNoA, lineNoA + 1];
-      const conf = suppressedReason ? "low" : b.confidence;
+      const conf = resolveConfidence(b.ruleId, b.value, b.confidence, suppressedReason);
       record({ id: b.ruleId, label: b.label }, b.value, relFile, file, lineNoA, mtimeMs, conf, suppressedReason, { spanLines: span });
       record({ id: b.ruleId, label: b.label }, b.value, relFile, file, lineNoA + 1, mtimeMs, conf, suppressedReason, { spanLines: span });
     }
@@ -290,19 +336,36 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       // Per-file degradation flag, surfaced at most once so a pathological
       // file produces one visible entry, not thousands.
       let lineMatchFailed = false;
+      // Each pass gets its own try/catch: every rule quantifier is bounded
+      // (see patterns.js) so none of these should throw on adversarial input
+      // any more, but this is the second, independent layer against that
+      // failure mode — a throw in one pass must never suppress the other
+      // two for the same line. Without this, a bug reintroduced in any one
+      // pass silently blinds the other two for that line rather than
+      // degrading loudly on its own. One unmatched line must degrade to a
+      // visible per-file flag, never abort the scan and discard every
+      // finding already collected (same contract as the readLines catch
+      // above).
+      const flagFailed = () => {
+        if (!lineMatchFailed) {
+          lineMatchFailed = true;
+          unreadableFiles.push({ file: safeName(file), reason: "some lines could not be matched" });
+        }
+      };
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (line) {
-          // A rule regex itself can throw on adversarial input: V8's
-          // backtrack stack overflows (RangeError) when an open-ended
-          // quantifier meets a prefix followed by a multi-megabyte
-          // same-charset run — real transcripts contain such lines. One
-          // unmatched line must degrade to a visible per-file flag, never
-          // abort the scan and discard every finding already collected
-          // (same contract as the readLines catch above).
           try {
             matchLine(line, file, relFile, i + 1, mtimeMs);
+          } catch (err) {
+            flagFailed();
+          }
+          try {
             decodeLine(line, file, relFile, i + 1, mtimeMs);
+          } catch (err) {
+            flagFailed();
+          }
+          try {
             const content = contentProjection(line);
             // Boundary join with the previous line (2-way splits only; see
             // decode.js). Both lines must be non-empty so a blank separator
@@ -312,10 +375,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             }
             prevContent = content;
           } catch (err) {
-            if (!lineMatchFailed) {
-              lineMatchFailed = true;
-              unreadableFiles.push({ file: safeName(file), reason: "some lines could not be matched" });
-            }
+            flagFailed();
             prevContent = null;
           }
         } else {