residoo 0.4.10 → 0.4.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.10",
+  "version": "0.4.12",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cli.js

@@ -57,7 +57,7 @@ const HELP = `residoo: find secrets leaking through your AI agent's session hist
   Scanning makes NO network calls by default and changes nothing on disk.
   Findings are redacted in every output format. The one opt-in exception is
   --verify, which asks a credential's own vendor whether it still
-  authenticates (32 vendors today, see below). Sealing (--seal) writes NEW
+  authenticates (35 vendors today, see below). Sealing (--seal) writes NEW
   encrypted files only. It never modifies or deletes anything that already
   exists.
 
@@ -102,22 +102,24 @@ Scan options:
   --verify                ask the credential's own vendor whether it still
                           authenticates, using the exact value found in
                           your transcript. THIS MAKES A REAL NETWORK CALL.
-                          Off by default. 32 vendors today. Two need a
+                          Off by default. 35 vendors today. Three need a
                           paired id+secret (see Rotation below): AWS,
                           checked via sts:get-caller-identity (needs the
                           aws CLI on PATH, residoo shells out to it rather
-                          than reimplementing AWS request signing), and
-                          PlanetScale, checked via a direct API call like
-                          every other non-AWS vendor here. The other 30 are
-                          each a single credential, one direct,
-                          dependency-free API call, no CLI needed: Slack,
-                          OpenAI, Anthropic, GitHub, Hugging Face,
+                          than reimplementing AWS request signing);
+                          PlanetScale and MongoDB Atlas (Service Account
+                          credentials only), each checked via a direct API
+                          call like every other non-AWS vendor here. The
+                          other 32 are each a single credential, one
+                          direct, dependency-free API call, no CLI needed:
+                          Slack, OpenAI, Anthropic, GitHub, Hugging Face,
                           Replicate, DigitalOcean, Pinecone, SendGrid,
                           Groq, xAI, OpenRouter, Stripe, npm, Notion,
                           GitLab, Supabase (management tokens only),
                           ElevenLabs, CircleCI, Airtable, Cloudflare,
                           Heroku, Netlify, Linear, Telegram, Discord
-                          webhooks, Vercel, Cerebras, Render, and Fly.io.
+                          webhooks, Vercel, Cerebras, Render, Fly.io,
+                          Neon, and PostHog.
                           A verified-invalid credential is reported as
                           already dead, not as something to rotate; a
                           JWT's own signed exp claim is checked locally
@@ -579,7 +581,7 @@ async function main(argv) {
 
   const progress = makeProgressReporter(noColor);
   const result = await scan({
-    sources, includeNoisy, includeSuppressed, verify,
+    sources, includeNoisy, includeSuppressed, verify, noColor,
     onProgress: progress.onProgress,
     // Clears the spinner's last frame before --verify's own stderr lines
     // print; without this the last spinner line sits uncleared on screen

package/src/color.js

@@ -0,0 +1,36 @@
+"use strict";
+
+/**
+ * Minimal raw ANSI — no chalk, no deps. A security tool asking you to trust
+ * a pile of third-party packages before it's even scanned anything is a bad
+ * first impression; residoo ships with zero runtime dependencies.
+ *
+ * Shared between report.js (stdout: the findings/rotation report) and
+ * scan.js (stderr: the --verify disclosure table), which is why `stream` is
+ * a parameter here rather than a hardcoded process.stdout: stdout and
+ * stderr can be redirected independently of each other (piping stdout to a
+ * file while stderr still reaches a real terminal, or the reverse), so each
+ * caller's own stream decides its own color support instead of one
+ * borrowing the other's answer.
+ */
+const c = {
+  reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
+  red: "\x1b[31m", yellow: "\x1b[33m", green: "\x1b[32m", cyan: "\x1b[36m",
+};
+
+// `forceNoColor` read fresh on every call, not captured once at require()
+// time — a module-level const would freeze whatever the environment was
+// before cli.js has even parsed argv. This is how cli.js's --no-color flag
+// actually reaches these functions: as an explicit per-call argument, not
+// by mutating process.env.NO_COLOR, so a mutated env var can never leak
+// into a later call in the same process (a test runner, a wrapper CLI
+// reusing this module) and silently disable color for a call that never
+// asked for that.
+function supportsColor(forceNoColor, stream = process.stdout) {
+  return !forceNoColor && stream.isTTY && process.env.NO_COLOR === undefined;
+}
+function makePaint(forceNoColor, stream = process.stdout) {
+  return (code, s) => (supportsColor(forceNoColor, stream) ? `${code}${s}${c.reset}` : s);
+}
+
+module.exports = { c, supportsColor, makePaint };

package/src/patterns.js

@@ -186,6 +186,34 @@ const PATTERNS = [
   // floor/ceiling treatment as Cerebras above.
   { id: "render_key", label: "Render API key", confidence: "high",
     re: /\brnd_[A-Za-z0-9]{20,200}\b/g },
+  // Confirmed via Neon's own changelog (neon.com/docs/changelog/2025-01-31):
+  // keys created after that date are prefixed napi_ (personal), or
+  // neon_org_key_ / neon_project_key_ (org and project-scoped), specifically
+  // "to use secret scanning mechanisms that rely on identifiable markers" —
+  // about as direct an endorsement as a vendor gives. Length/charset are
+  // not published (only "randomly-generated 64-bit token," and the docs'
+  // own example is a transparently synthetic placeholder), so the bound
+  // here is a floor, same treatment as Cerebras/Render above. Keys created
+  // before 2025-01-31 have no prefix and are not covered — a real but
+  // bounded coverage gap, not a false negative in this rule's own logic.
+  { id: "neon_key", label: "Neon API key", confidence: "high",
+    re: /\b(?:napi_|neon_org_key_|neon_project_key_)[A-Za-z0-9]{20,}\b/g },
+  // MongoDB Atlas has two distinct credential systems; only one is a rule
+  // here. The legacy Programmatic API Key pair (Public Key / Private Key,
+  // HTTP Digest auth) has NO prefix at all -- an 8-char alnum string and a
+  // bare UUID, confirmed via MongoDB's own OpenAPI spec -- and is exactly
+  // the noisy, unspecific shape this file's header says to leave out. The
+  // newer Service Account pair does have a distinguishing prefix on BOTH
+  // halves (confirmed in the same OpenAPI spec): mdb_sa_sk_ for the client
+  // secret (this rule; length not published beyond the prefix, same
+  // floor-only treatment as Cerebras/Render) and mdb_sa_id_ for the client
+  // id (fully specified as exactly 24 hex characters by the spec's own
+  // schema pattern, matched only as a paired candidate near this secret --
+  // see pairing.js's findNearbyCandidate and PlanetScale's identical
+  // secret-is-the-anchor structure above -- never as a standalone rule,
+  // since verification needs both halves together).
+  { id: "mongodb_atlas_secret", label: "MongoDB Atlas Service Account secret", confidence: "high",
+    re: /\bmdb_sa_sk_[A-Za-z0-9]{16,}\b/g },
   { id: "vault_token", label: "HashiCorp Vault service token", confidence: "high",
     // Vault 1.10+ format only (hvs.<90-120 chars>). The pre-1.10 legacy
     // format is a bare "s." + 18-40 chars — "s." is nowhere near specific
@@ -220,6 +248,17 @@ const PATTERNS = [
     // Covers both current Sentry token shapes: org-scoped (sntrys_, base64
     // JWT-like body) and user-scoped (sntryu_, hex body).
     re: /\b(?:sntrys_eyJ[A-Za-z0-9+/=_]{100,4000}|sntryu_[a-f0-9]{64})\b/g },
+  // phx_ is PostHog's Personal API Key prefix, confirmed directly in
+  // PostHog's own docs (the masked example "phx_***1234" on the personal-
+  // api-keys page, and phx_ named explicitly in the API overview's GitHub
+  // secret-scanning section alongside sibling prefixes for its OTHER token
+  // types: phc_ is the PUBLIC project token and must never be targeted as a
+  // secret, phs_/pha_/phr_ are other PostHog token families not covered
+  // here). Exact length (~48 chars) is sourced from PostHog's own OSS
+  // source, not prose docs, so the bound below is a generous floor rather
+  // than a doc-confirmed exact count.
+  { id: "posthog_key", label: "PostHog personal API key", confidence: "high",
+    re: /\bphx_[A-Za-z0-9]{40,}\b/g },
 ];
 
 /**

package/src/report.js

@@ -2,28 +2,10 @@
 
 const path = require("path");
 const { fingerprintFinding, ROTATION_ORDER_ADVISORY } = require("./rotation");
-
-// Minimal raw ANSI — no chalk, no deps. A security tool asking you to trust
-// a pile of third-party packages before it's even scanned anything is a bad
-// first impression; residoo ships with zero runtime dependencies.
-const c = {
-  reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
-  red: "\x1b[31m", yellow: "\x1b[33m", green: "\x1b[32m", cyan: "\x1b[36m",
-};
-// Read fresh on every call, not once at require() time — a module-level
-// const would freeze whatever the environment was at require() time, before
-// cli.js has even parsed argv. `forceNoColor` is how cli.js's --no-color
-// flag actually reaches this function: as an explicit per-call argument, not
-// by mutating process.env.NO_COLOR. `main()` is an exported function, not
-// only a one-shot CLI entrypoint — a mutated env var would leak into any
-// later call in the same process (a test runner, a wrapper CLI reusing it)
-// and silently disable color for calls that never asked for that.
-function supportsColor(forceNoColor) {
-  return !forceNoColor && process.stdout.isTTY && process.env.NO_COLOR === undefined;
-}
-function makePaint(forceNoColor) {
-  return (code, s) => (supportsColor(forceNoColor) ? `${code}${s}${c.reset}` : s);
-}
+// c/makePaint moved to color.js so scan.js's --verify disclosure table
+// (written to stderr, not stdout) can use the same palette and
+// NO_COLOR/--no-color contract without duplicating it.
+const { c, makePaint } = require("./color");
 
 function ageDays(mtimeMs) {
   return Math.max(0, Math.floor((Date.now() - mtimeMs) / 86400000));
@@ -453,9 +435,28 @@ function render({ findings, filesScanned, sourcesScanned, bytesScanned, suppress
   }
   push();
 
+  // A real table, not a run-on line: fixed-width count/confidence columns,
+  // and the label column padded to the widest label actually being shown
+  // (capped, so one extreme outlier like the paired MongoDB Atlas label
+  // doesn't drag every other row's notes off toward the right edge) so the
+  // distinct-value note and any encoding marks start in the same place on
+  // every row. The confidence tag now colors its own count too, not just
+  // the bracket, so severity reads at a glance down the left edge without
+  // having to read the bracket text on every line.
   const sorted = [...byRule.entries()].sort((a, b) => b[1].items.length - a[1].items.length);
+  const CONFIDENCE_COLOR = { high: c.red, medium: c.yellow, low: c.dim };
+  const CONFIDENCE_TAG = { high: "high", medium: "med ", low: "low " };
+  const LABEL_COL_CAP = 40;
+  const labelWidth = Math.min(
+    LABEL_COL_CAP,
+    Math.max(0, ...sorted.map(([, { label }]) => label.length))
+  );
+  if (sorted.length > 0) {
+    push(paint(c.dim, `  ${"COUNT".padStart(4)}  CONF   ${"RULE".padEnd(labelWidth)}`));
+  }
   for (const [ruleId, { label, confidence, items }] of sorted) {
-    const tag = confidence === "high" ? paint(c.red, "high") : confidence === "medium" ? paint(c.yellow, "med ") : paint(c.dim, "low ");
+    const color = CONFIDENCE_COLOR[confidence] || c.dim;
+    const tag = paint(color, CONFIDENCE_TAG[confidence] || "low ");
     const distinct = distinctCounts[ruleId];
     const distinctNote = distinct && distinct !== items.length
       ? paint(c.dim, `  (${distinct} distinct value${distinct === 1 ? "" : "s"}, re-exposed ${items.length - distinct}× across tool output)`)
@@ -469,7 +470,8 @@ function render({ findings, filesScanned, sourcesScanned, bytesScanned, suppress
     if (encoded) marks.push(`${encoded} base64-wrapped`);
     if (split) marks.push(`${split} split across lines`);
     const markNote = marks.length ? paint(c.yellow, `  [${marks.join(", ")}]`) : "";
-    push(`  ${paint(c.bold, String(items.length).padStart(4))}  [${tag}]  ${label}${distinctNote}${markNote}`);
+    const paddedLabel = label.length <= labelWidth ? label.padEnd(labelWidth) : label;
+    push(`  ${paint(color + c.bold, String(items.length).padStart(4))}  [${tag}]  ${paddedLabel}${distinctNote}${markNote}`);
   }
 
   push();

package/src/rotation.js

@@ -640,6 +640,43 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Revocation is immediate; the key stops authenticating on the next request.",
   },
+  // Fetched https://neon.com/docs/manage/api-keys (2026-09-03): keys are
+  // listed and revoked from the Neon console's Account/Organization
+  // Settings > API keys page; revocation is immediate per the docs' own
+  // "All API requests using the revoked key will fail" line.
+  neon_key: {
+    label: "Neon API key",
+    consolePath: "console.neon.tech > Account/Organization Settings > API keys",
+    steps: [
+      "Open API keys under Account or Organization Settings in the Neon console",
+      "Revoke the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Revocation is immediate; the key stops authenticating on the next request.",
+  },
+  // Fetched MongoDB Atlas's own API/OpenAPI docs (2026-09-03): Service
+  // Accounts are managed from Organization Access Manager > Service
+  // Accounts, where a secret can be deleted independently of the account.
+  mongodb_atlas_secret: {
+    label: "MongoDB Atlas Service Account secret",
+    consolePath: "cloud.mongodb.com > Organization Access Manager > Service Accounts",
+    steps: [
+      "Open Service Accounts under your organization's Access Manager",
+      "Delete the leaked client secret from the service account",
+      "Create a replacement secret and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the secret stops authenticating on the next request.",
+  },
+  mongodb_atlas_client_id: {
+    label: "MongoDB Atlas Service Account client id (paired with a leaked secret)",
+    consolePath: "cloud.mongodb.com > Organization Access Manager > Service Accounts",
+    steps: [
+      "This is the client id half of the service account also found on this line",
+      "Delete the leaked secret from the service account; the id alone cannot authenticate",
+      "Create a replacement secret and update whatever used the old one",
+    ],
+    revokeNote: "The id cannot authenticate alone: deleting the paired secret is what invalidates the pair.",
+  },
 
   // ── Comms / SaaS ──────────────────────────────────────────────────────
   // The user-facing support article (support.discord.com article 228383668)
@@ -722,6 +759,19 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "The redacted preview cannot distinguish the two prefixes; check the original file for sntrys_ (organization) vs sntryu_ (personal).",
   },
+  // Fetched https://posthog.com/docs/api (2026-09-03): personal API keys
+  // are listed and revoked from the user's own Personal API Keys settings
+  // page, independent of any single project.
+  posthog_key: {
+    label: "PostHog personal API key",
+    consolePath: "app.posthog.com > Settings > Personal API keys (or the EU/self-hosted equivalent)",
+    steps: [
+      "Open Personal API Keys under your account settings",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {

package/src/scan.js

@@ -15,8 +15,9 @@ const {
   verifyCircleciToken, verifyAirtableToken, verifyCloudflareToken, verifyHerokuKey,
   verifyNetlifyToken, verifyLinearKey, verifyTelegramToken, verifyDiscordWebhook,
   verifyPlanetScaleToken, verifyVercelToken, verifyCerebrasKey, verifyRenderKey,
-  verifyFlyioBearerToken,
+  verifyFlyioBearerToken, verifyMongoDbAtlasCredential, verifyNeonKey, verifyPostHogKey,
 } = require("./verify");
+const { c, makePaint } = require("./color");
 
 // PlanetScale's id half: 12 lowercase alphanumeric characters, no prefix —
 // confirmed via planetscale.com/docs/api/reference/service-tokens. Searched
@@ -32,6 +33,18 @@ const PLANETSCALE_ID_RE = /\b[a-z0-9]{12}\b/g;
 // false ambiguous match.
 const PLANETSCALE_PAIR_WINDOW = 100;
 
+// MongoDB Atlas Service Account client id: fully specified by MongoDB's own
+// OpenAPI schema (mdb_sa_id_ + exactly 24 hex characters) — the ONE paired
+// candidate regex in this file precise enough to have a confirmed exact
+// length rather than a shape-only guess, since it carries its own
+// distinguishing prefix too (unlike AWS's secret or PlanetScale's id, which
+// have no prefix of their own and rely entirely on nearby-anchor context).
+const MONGODB_ATLAS_ID_RE = /\bmdb_sa_id_[a-fA-F0-9]{24}\b/g;
+// MongoDB's own docs show the id and secret as sibling fields in the same
+// JSON credentials block or adjacent env vars, not spread across a file —
+// same reasoning as PlanetScale's tighter window, not AWS's wider one.
+const MONGODB_ATLAS_PAIR_WINDOW = 150;
+
 // Never verify more than this many distinct credentials of ONE vendor in a
 // single scan: a pathological transcript with dozens of distinct
 // credentials should not turn --verify into a long burst of outbound calls.
@@ -45,10 +58,11 @@ const MAX_VERIFICATIONS_PER_VENDOR = 10;
 // belong to any Google product; testing it against one product's endpoint
 // would misreport a valid key for a DIFFERENT product as invalid) and
 // perplexity_key (no free, side-effect-free endpoint exists at all).
-// PlanetScale is ALSO not here despite being verified: it needs pairing
-// (see pendingPlanetScaleVerifications below), the same reason AWS isn't
-// here either. See verify.js's own header comment for the fuller
-// reasoning behind every vendor left out.
+// PlanetScale and MongoDB Atlas are ALSO not here despite being verified:
+// both need pairing (see pendingPlanetScaleVerifications and
+// pendingMongoDbAtlasVerifications below), the same reason AWS isn't here
+// either. See verify.js's own header comment for the fuller reasoning
+// behind every vendor left out.
 const SIMPLE_VERIFY_FNS = {
   slack_token: verifySlackToken,
   openai_key: verifyOpenAiKey,
@@ -81,6 +95,8 @@ const SIMPLE_VERIFY_FNS = {
   cerebras_key: verifyCerebrasKey,
   render_key: verifyRenderKey,
   flyio_bearer_token: verifyFlyioBearerToken,
+  neon_key: verifyNeonKey,
+  posthog_key: verifyPostHogKey,
 };
 const SIMPLE_VERIFY_VENDOR_LABEL = {
   slack_token: "Slack's auth.test",
@@ -114,6 +130,8 @@ const SIMPLE_VERIFY_VENDOR_LABEL = {
   cerebras_key: "Cerebras's models endpoint",
   render_key: "Render's owners endpoint",
   flyio_bearer_token: "Fly.io's GraphQL API",
+  neon_key: "Neon's projects endpoint",
+  posthog_key: "PostHog's users endpoint",
 };
 
 // Rule ids that findPairedSecret's window search applies to (see pairing.js):
@@ -219,6 +237,16 @@ const VENDOR_EXAMPLE_VALUES = new Set([
 /** Matches every finding's own `relFile` convention — never the full path. See SECURITY.md. */
 function safeName(file) { return path.basename(file); }
 
+// Same format as report.js's own localTimestamp, duplicated rather than
+// imported: this is a 3-line pure function, and report.js is the
+// presentation layer for stdout while this file's own --verify results
+// table is stderr, the same reasoning pairing.js gives for its own small
+// duplicated helper (looksZeroEntropy) rather than cross-importing.
+function localTimestamp(d) {
+  const p2 = (n) => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p2(d.getMonth() + 1)}-${p2(d.getDate())} ${p2(d.getHours())}:${p2(d.getMinutes())}`;
+}
+
 /**
  * Scan every transcript from every available source.
  *
@@ -237,7 +265,7 @@ function safeName(file) { return path.basename(file); }
  * absolute path can itself carry a username or a project name the rest of
  * this report is careful never to print.
  */
-async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false, onBeforeVerify = null } = {}) {
+async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false, onBeforeVerify = null, noColor = false } = {}) {
   const rules = includeNoisy ? PATTERNS.concat(NOISY_PATTERNS) : PATTERNS;
   // The decode pass (see decode.js) only applies high-confidence, vendor-
   // prefixed rules to decoded bytes: random binary that decodes to printable
@@ -271,6 +299,10 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // credential (see the planetscale_secret match branch below): keyed by
   // the secret value (the confirmed, prefixed anchor) -> { idValue, refs }.
   const pendingPlanetScaleVerifications = new Map();
+  // Same shape again, for MongoDB Atlas Service Account credentials (see
+  // the mongodb_atlas_secret match branch below): keyed by the secret value
+  // -> { idValue, refs }.
+  const pendingMongoDbAtlasVerifications = new Map();
   // --verify only (see verify.js): ruleId -> (token value -> { refs }), for
   // every SIMPLE_VERIFY_FNS vendor. Unlike AWS/PlanetScale, none of these
   // need pairing (the token itself is the complete credential), so this is
@@ -399,6 +431,30 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
               }
             }
           }
+          // MongoDB Atlas: same shape as PlanetScale (secret is the
+          // confirmed, prefixed anchor; the id is the nearby candidate),
+          // except the id here ALSO carries its own distinguishing prefix
+          // (mdb_sa_id_) rather than being a bare unprefixed shape — a
+          // stronger candidate signal than PlanetScale's or AWS's, but the
+          // same pairing mechanism and the same generic pairedOtherPreview/
+          // pairedOtherLabel display fields.
+          let mongoDbIdFinding = null;
+          let rawMongoDbId = null;
+          if (!suppressedReason && rule.id === "mongodb_atlas_secret") {
+            const pairedId = findNearbyCandidate(line, m[0], m.index, MONGODB_ATLAS_ID_RE, MONGODB_ATLAS_PAIR_WINDOW);
+            if (pairedId) {
+              const idSuppressedReason = suppressionReason(pairedId, null);
+              if (idSuppressedReason && !includeSuppressed) {
+                suppressedCount++;
+              } else {
+                rawMongoDbId = pairedId;
+                mongoDbIdFinding = record({ id: "mongodb_atlas_client_id", label: "MongoDB Atlas Service Account client id (paired with secret)" },
+                  pairedId, relFile, file, lineNo, mtimeMs,
+                  idSuppressedReason ? "low" : "high", idSuppressedReason,
+                  { paired: true, pairedOtherPreview: redact(m[0]), pairedOtherLabel: "secret" });
+              }
+            }
+          }
           // Local, offline JWT expiry (see jwtExpiry.js): only ever reads
           // the `exp` claim out of the decoded payload, nothing else, and
           // only for the unsuppressed default `jwt` rule, since a
@@ -413,6 +469,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             {
               ...(pairedSecretPreview ? { pairedSecretPreview } : {}),
               ...(planetScaleIdFinding ? { pairedOtherPreview: redact(rawPlanetScaleId), pairedOtherLabel: "id" } : {}),
+              ...(mongoDbIdFinding ? { pairedOtherPreview: redact(rawMongoDbId), pairedOtherLabel: "id" } : {}),
               ...(jwtExtra || {}),
             });
 
@@ -440,6 +497,15 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             const psEntry = pendingPlanetScaleVerifications.get(m[0]);
             if (psEntry) psEntry.refs.push({ secretFinding: primaryFinding, idFinding: planetScaleIdFinding });
           }
+          // --verify, MongoDB Atlas: same dedup-by-anchor-value shape as
+          // AWS/PlanetScale above, keyed by the secret this time.
+          if (verify && mongoDbIdFinding && rawMongoDbId) {
+            if (!pendingMongoDbAtlasVerifications.has(m[0]) && pendingMongoDbAtlasVerifications.size < MAX_VERIFICATIONS_PER_VENDOR) {
+              pendingMongoDbAtlasVerifications.set(m[0], { idValue: rawMongoDbId, refs: [] });
+            }
+            const mdbEntry = pendingMongoDbAtlasVerifications.get(m[0]);
+            if (mdbEntry) mdbEntry.refs.push({ secretFinding: primaryFinding, idFinding: mongoDbIdFinding });
+          }
           // --verify, single-token vendors (Slack, OpenAI, Anthropic,
           // GitHub): none of these need pairing (the value IS the complete
           // credential), so queue every unsuppressed match directly, same
@@ -629,6 +695,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // actually something to verify, so a plain --verify with nothing to check
   // never clears a spinner line for no reason.
   const anyPending = pendingAwsVerifications.size > 0 || pendingPlanetScaleVerifications.size > 0 ||
+    pendingMongoDbAtlasVerifications.size > 0 ||
     [...pendingSimpleVerifications.values()].some((byValue) => byValue.size > 0);
   if (verify && anyPending && typeof onBeforeVerify === "function") onBeforeVerify();
 
@@ -642,6 +709,17 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
   };
   const awsAvailable = pendingAwsVerifications.size === 0 || isAwsCliAvailable();
+  // stderr, not stdout: color.js's supportsColor checks whichever stream is
+  // passed to it, and this table is never written to stdout, so it must
+  // check stderr's own TTY status, not borrow stdout's (piping stdout to a
+  // file while stderr still reaches a real terminal is a real case: `scan
+  // --verify --json > out.json` should still color this table).
+  const paint = makePaint(noColor, process.stderr);
+  // Populated inside the disclosure block below (when there's something to
+  // verify), then read again once every verify loop below has finished, to
+  // print the results table. Declared out here, not inside that block, so
+  // it survives to that second read.
+  let verifyRows = [];
   if (verify && anyPending) {
     // One disclosure, not one per vendor: this used to print a full
     // "this is a real network request..." paragraph for EACH vendor in
@@ -661,25 +739,41 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     // everywhere else in the report — reusing redact() on the same raw
     // value record() was called with, not a second display convention.
     // One line per vendor+endpoint header, one indented line per credential.
-    const rows = [];
+    //
+    // Each row also carries a `resultFinding` per credential: a direct
+    // reference to the finding object applyVerifyResult mutates below (the
+    // access-key/secret finding for AWS, the secret finding for
+    // PlanetScale/MongoDB Atlas, the finding itself for a simple vendor).
+    // Captured now, read after the verify loops run, so the results table
+    // further down needs no second vendor-shape dispatch of its own.
+    verifyRows = [];
     if (pendingAwsVerifications.size > 0 && awsAvailable) {
-      rows.push(["AWS", "sts:get-caller-identity", [...pendingAwsVerifications.keys()].map(redact)]);
+      verifyRows.push(["AWS", "sts:get-caller-identity",
+        [...pendingAwsVerifications.entries()].map(([value, { refs }]) => ({ value, resultFinding: refs[0].akiaFinding }))]);
     }
     if (pendingPlanetScaleVerifications.size > 0) {
-      rows.push(["PlanetScale", "organizations endpoint", [...pendingPlanetScaleVerifications.keys()].map(redact)]);
+      verifyRows.push(["PlanetScale", "organizations endpoint",
+        [...pendingPlanetScaleVerifications.entries()].map(([value, { refs }]) => ({ value, resultFinding: refs[0].secretFinding }))]);
+    }
+    if (pendingMongoDbAtlasVerifications.size > 0) {
+      verifyRows.push(["MongoDB Atlas", "oauth/token endpoint",
+        [...pendingMongoDbAtlasVerifications.entries()].map(([value, { refs }]) => ({ value, resultFinding: refs[0].secretFinding }))]);
     }
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
       const [vendor, endpoint] = SIMPLE_VERIFY_VENDOR_LABEL[ruleId].split("'s ");
-      rows.push([vendor, endpoint, [...byValue.keys()].map(redact)]);
+      verifyRows.push([vendor, endpoint,
+        [...byValue.entries()].map(([value, { refs }]) => ({ value, resultFinding: refs[0] }))]);
     }
-    if (rows.length > 0) {
-      const table = rows
-        .map(([vendor, endpoint, previews]) =>
-          `    ${vendor} · ${endpoint}\n` + previews.map((p) => `        ${p}`).join("\n"))
+    if (verifyRows.length > 0) {
+      const table = verifyRows
+        .map(([vendor, endpoint, credentials]) =>
+          `    ${paint(c.bold + c.cyan, vendor)} ${paint(c.dim, "·")} ${paint(c.dim, endpoint)}\n` +
+          credentials.map(({ value }) => `        ${redact(value)}`).join("\n"))
         .join("\n");
       process.stderr.write(
-        "residoo --verify: checking whether these credentials are still active. Real network " +
+        paint(c.yellow + c.bold, "residoo --verify:") +
+        " checking whether these credentials are still active. Real network " +
         "calls, using the exact value found in your transcript, one at a time. Nothing is cached " +
         "or sent anywhere but the endpoint listed below.\n\n" +
         table + "\n\n"
@@ -687,7 +781,8 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
     if (pendingAwsVerifications.size > 0 && !awsAvailable) {
       process.stderr.write(
-        "residoo --verify: the aws CLI was not found on PATH, so the " +
+        paint(c.yellow + c.bold, "residoo --verify:") +
+        " the aws CLI was not found on PATH, so the " +
         `${pendingAwsVerifications.size} AWS credential(s) found in this scan could not be checked. ` +
         "Install it (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) to use --verify.\n"
       );
@@ -715,6 +810,12 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
     }
   }
+  if (verify && pendingMongoDbAtlasVerifications.size > 0) {
+    for (const [secretValue, { idValue, refs }] of pendingMongoDbAtlasVerifications) {
+      const result = await verifyMongoDbAtlasCredential(idValue, secretValue);
+      for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
+    }
+  }
   if (verify) {
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;
@@ -726,6 +827,37 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
     }
   }
 
+  if (verify && verifyRows.length > 0) {
+    // Same vendor/endpoint grouping as the disclosure table above, now
+    // showing what each call actually found. An ACTIVE credential is a
+    // real, present-tense risk, colored the same red/bold the Rotation
+    // section below uses for the identical fact ("rotate immediately");
+    // "could not verify" gets the same red/bold too, on purpose, matching
+    // this project's fail-safe-direction policy of treating "unknown" as
+    // "assume risk" rather than as reassuring silence. Stamped with when
+    // this check actually ran, so a report read later (pasted into a
+    // ticket, screenshotted) doesn't silently imply "still true right now."
+    const checkedAt = localTimestamp(new Date());
+    const describeResult = (finding) => {
+      if (finding.verified === "active") {
+        return paint(c.red + c.bold, `⚠ ACTIVE: real working credential`) + paint(c.dim, ` (checked ${checkedAt})`);
+      }
+      if (finding.verified === "invalid") {
+        return paint(c.green, `✓ inactive: vendor rejected it`) + paint(c.dim, ` (checked ${checkedAt})`);
+      }
+      return paint(c.red + c.bold, `⚠ could not verify`) + paint(c.dim, ` (checked ${checkedAt}${finding.verifiedDetail ? `: ${finding.verifiedDetail}` : ""})`);
+    };
+    const resultsTable = verifyRows
+      .map(([vendor, endpoint, credentials]) =>
+        `    ${paint(c.bold + c.cyan, vendor)} ${paint(c.dim, "·")} ${paint(c.dim, endpoint)}\n` +
+        credentials.map(({ value, resultFinding }) => `        ${redact(value)}  ${describeResult(resultFinding)}`).join("\n"))
+      .join("\n");
+    process.stderr.write(
+      paint(c.yellow + c.bold, "residoo --verify:") + " results\n\n" +
+      resultsTable + "\n\n"
+    );
+  }
+
   const distinctCounts = {};
   for (const [ruleId, set] of distinctByRule) distinctCounts[ruleId] = set.size;
   return { findings, filesScanned, sourcesScanned, bytesScanned, suppressedCount, distinctCounts, unreadableFiles };