residoo 0.4.5 → 0.4.7

package/README.md

@@ -82,6 +82,30 @@ precise about rather than lumping together:
   different set of choices, and its README is honest about its own tradeoffs
   too. Worth a look if broader source coverage matters more to you than a
   minimal dependency footprint.
+- **On verifying a found value is still live**, not just shaped like one:
+  the field splits into two real postures, and residoo picked a side.
+  [trufflehog](https://github.com/trufflesecurity/trufflehog) verifies
+  **by default**, an opt-out (`--no-verification`) rather than an opt-in,
+  across 700+ vendor-specific checks; that means a plain, unconfigured
+  trufflehog run makes network calls. gitleaks never added verification at
+  all and is now feature-complete (security patches only); its declared
+  successor, [betterleaks](https://github.com/betterleaks/betterleaks),
+  added it the other way: **off by default**, one global `--validation`
+  flag, each rule's own validate expression deciding whether and how it
+  calls out, with repeated occurrences of the same value deduped to one
+  request. agentsweep has none either, and is explicit about it: its own
+  README scores trufflehog's verification with a checkmark and its own
+  with an X, and states it is "fully offline, with zero network calls
+  during scanning or redacting" apart from an optional PyPI version-check
+  ping. residoo's `--verify` follows betterleaks' posture, not
+  trufflehog's: off by default, an explicit flag, and 32 vendors today
+  (still short of trufflehog's 700+) rather than every vendor its own
+  detection can name, deduped the same way betterleaks dedupes, and gated
+  the same way patterns.js's own detection rules are: only added where a
+  real, cited endpoint exists, not assumed by analogy to a similar vendor.
+  See [verify.js](src/verify.js) and
+  [What it does not do](#what-it-does-not-do) for exactly what it touches
+  and when.
 
 This isn't a gap Anthropic is planning to close upstream, either: a
 [request to scrub secrets from `~/.claude/projects` natively](https://github.com/anthropics/claude-code/issues/50014)
@@ -125,17 +149,38 @@ won't be built into the tool that writes it.
   discarded. See `src/jwtExpiry.js`.
 - **`--verify`** (opt-in, makes a real network call): asks a credential's own
   vendor whether it still authenticates, using the exact value found in your
-  transcript. Five vendors today: **AWS** (an access key id found paired with
-  its secret, checked via `sts:get-caller-identity`, the same free,
-  read-only, permission-less call the AWS CLI and tools like aws-vault use
-  for exactly this; shells out to your own `aws` CLI rather than
-  reimplementing AWS request signing, since residoo ships zero runtime
-  dependencies and a subtly wrong signing implementation would silently
-  report real keys as invalid, worse than not checking), and **Slack,
-  OpenAI, Anthropic, GitHub** (a direct API call to each vendor's own free
-  "list what I can see" endpoint, no CLI needed, no request signing to get
-  wrong). A verified-active credential is escalated to "rotate immediately";
-  a verified-invalid one is reported as already dead, no action needed, and
+  transcript. 32 vendors today. Two need a paired id+secret (see the
+  Rotation section below for what that means): **AWS** (checked via
+  `sts:get-caller-identity`, the same free, read-only, permission-less call
+  the AWS CLI and tools like aws-vault use for exactly this; shells out to
+  your own `aws` CLI rather than reimplementing AWS request signing, since
+  residoo ships zero runtime dependencies and a subtly wrong signing
+  implementation would silently report real keys as invalid, worse than not
+  checking) and **PlanetScale** (a direct API call, like every other
+  non-AWS vendor here, with the id/secret pairing found the same way AWS's
+  is, see `src/pairing.js`). The other **30 are a single credential each,
+  one direct API call, no CLI needed**: Slack, OpenAI, Anthropic, GitHub,
+  Hugging Face, Replicate, DigitalOcean, Pinecone, SendGrid, Groq, xAI,
+  OpenRouter, Stripe, npm, Notion, GitLab, Supabase (management tokens
+  only, project-scoped anon/service_role keys need a project URL residoo
+  doesn't have), ElevenLabs, CircleCI, Airtable, Cloudflare, Heroku,
+  Netlify, Linear, Telegram, Discord webhooks, Vercel, Cerebras, Render,
+  and Fly.io's `fo1_` tokens (Fly.io's other token family, `fm1a_`/`fm1r_`/
+  `fm2_` "macaroons," is detected nowhere in residoo: caught on this
+  project's own real-machine testing, that shape's short prefix plus a
+  wide, unstructured base64 body produced over a dozen apparent matches
+  inside one real, unrelated job-queue log file that simply contained a lot
+  of embedded base64 data, a measured false-positive rate, not a
+  hypothetical one). Every one of the 32 was researched against that
+  vendor's own current docs or a
+  named open-source scanner's real, running verifier code before being
+  wired up, the same bar as the first five; a real, sourced reason (no free
+  endpoint, needs external context the credential doesn't carry, or a
+  credential format not confirmed specifically enough to detect safely in
+  the first place) is why some detected credential types aren't wired to
+  `--verify` at all, not an oversight. A
+  verified-active credential is escalated to "rotate immediately"; a
+  verified-invalid one is reported as already dead, no action needed, and
   sorted out of the way. Off by default; every environment variable the
   `aws` CLI reads is built from scratch, never inherited, so it can never
   fall back to your own real AWS profile. See `src/verify.js`.
@@ -150,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.5 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.7 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.5 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.7 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -384,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.5
+  - uses: dandovdub/residoo@v0.4.7
 ```
 
 As a pre-commit hook:
@@ -392,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.5
+    rev: v0.4.7
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cli.js

@@ -57,9 +57,9 @@ const HELP = `residoo: find secrets leaking through your AI agent's session hist
   Scanning makes NO network calls by default and changes nothing on disk.
   Findings are redacted in every output format. The one opt-in exception is
   --verify, which asks a credential's own vendor whether it still
-  authenticates (AWS, Slack, OpenAI, Anthropic, GitHub today); see below.
-  Sealing (--seal) writes NEW encrypted files only. It never modifies or
-  deletes anything that already exists.
+  authenticates (32 vendors today, see below). Sealing (--seal) writes NEW
+  encrypted files only. It never modifies or deletes anything that already
+  exists.
 
 Usage:
   residoo scan [options]
@@ -102,21 +102,27 @@ Scan options:
   --verify                ask the credential's own vendor whether it still
                           authenticates, using the exact value found in
                           your transcript. THIS MAKES A REAL NETWORK CALL.
-                          Off by default. Five vendors today:
-                            AWS: every access key id found paired with its
-                            secret (see Rotation below) is checked via
-                            sts:get-caller-identity. Needs the aws CLI on
-                            PATH; residoo shells out to it rather than
-                            reimplementing AWS request signing.
-                            Slack: every token via auth.test.
-                            OpenAI, Anthropic, GitHub: every key/token via
-                            that vendor's own models/user listing endpoint.
-                          All four non-AWS vendors are a direct, dependency-
-                          free API call, no CLI needed. A verified-invalid
-                          credential is reported as already dead, not as
-                          something to rotate; a JWT's own signed exp claim
-                          is checked locally with no network call at all,
-                          on by default, not part of --verify.
+                          Off by default. 32 vendors today. Two need a
+                          paired id+secret (see Rotation below): AWS,
+                          checked via sts:get-caller-identity (needs the
+                          aws CLI on PATH, residoo shells out to it rather
+                          than reimplementing AWS request signing), and
+                          PlanetScale, checked via a direct API call like
+                          every other non-AWS vendor here. The other 30 are
+                          each a single credential, one direct,
+                          dependency-free API call, no CLI needed: Slack,
+                          OpenAI, Anthropic, GitHub, Hugging Face,
+                          Replicate, DigitalOcean, Pinecone, SendGrid,
+                          Groq, xAI, OpenRouter, Stripe, npm, Notion,
+                          GitLab, Supabase (management tokens only),
+                          ElevenLabs, CircleCI, Airtable, Cloudflare,
+                          Heroku, Netlify, Linear, Telegram, Discord
+                          webhooks, Vercel, Cerebras, Render, and Fly.io.
+                          A verified-invalid credential is reported as
+                          already dead, not as something to rotate; a
+                          JWT's own signed exp claim is checked locally
+                          with no network call at all, on by default, not
+                          part of --verify.
 
 Rotation:
   residoo explain <rule-id>     full rotation runbook for one detection rule
@@ -572,7 +578,17 @@ async function main(argv) {
   }
 
   const progress = makeProgressReporter(noColor);
-  const result = await scan({ sources, includeNoisy, includeSuppressed, onProgress: progress.onProgress, verify });
+  const result = await scan({
+    sources, includeNoisy, includeSuppressed, verify,
+    onProgress: progress.onProgress,
+    // Clears the spinner's last frame before --verify's own stderr lines
+    // print; without this the last spinner line sits uncleared on screen
+    // and the first --verify line gets appended directly onto its end with
+    // no separator (a real rendering bug caught live). Safe to call twice:
+    // stop() is idempotent, and the normal post-scan progress.stop() below
+    // still runs regardless of whether this fired.
+    onBeforeVerify: progress.stop,
+  });
   progress.stop();
   const integrity = wantsIntegrity ? runIntegrity() : null;
   const rotation = renderRotation(result.findings, acks, dismissed);

package/src/pairing.js

@@ -23,6 +23,11 @@
  * other mechanism here: no rule is added to the default set, and a bare
  * 40-char base64 string anywhere else on a line, with no access key nearby,
  * is still silently ignored exactly as before this feature existed.
+ *
+ * findNearbyCandidate below is the same mechanism generalized: PlanetScale
+ * (see scan.js) needs an identical pairing step, just with the anchor and
+ * candidate roles swapped (the SECRET is the prefixed, independently
+ * detected value; the unprefixed id is what gets found nearby).
  */
 
 const WINDOW = 400; // chars searched on each side of the access-key match
@@ -51,33 +56,48 @@ function looksZeroEntropy(value) {
 }
 
 /**
- * Find an AWS secret access key candidate paired with an already-matched
- * access key id or session token on this line. `akiaValue` and `akiaIndex`
- * locate the paired match so the search can be windowed around it and so
- * the access key's own text is never re-matched as its own pair.
+ * Find a candidate value paired with an already-matched anchor value on
+ * this line, within `window` characters on either side. `anchorValue` and
+ * `anchorIndex` locate the anchor so the search can exclude the anchor's
+ * own text from matching itself.
  *
  * Returns the candidate string, or null when there is none, or when more
  * than one distinct candidate sits in the window. Ambiguous pairing is
  * reported as nothing at all: for a finding whose whole point is "this is
  * high confidence because of what it's next to," guessing wrong is worse
  * than staying silent.
+ *
+ * Generic over which value is the anchor and which is the candidate: AWS
+ * anchors on the prefixed access key id and searches for the unprefixed
+ * secret; PlanetScale (see scan.js) anchors on the prefixed secret and
+ * searches for the unprefixed id — same mechanism, opposite roles, so one
+ * function serves both rather than two near-identical copies.
  */
-function findPairedSecret(line, akiaValue, akiaIndex) {
-  const start = Math.max(0, akiaIndex - WINDOW);
-  const end = Math.min(line.length, akiaIndex + akiaValue.length + WINDOW);
+function findNearbyCandidate(line, anchorValue, anchorIndex, candidateRe, window) {
+  const start = Math.max(0, anchorIndex - window);
+  const end = Math.min(line.length, anchorIndex + anchorValue.length + window);
   const around = line.slice(start, end);
-  CANDIDATE_RE.lastIndex = 0;
+  candidateRe.lastIndex = 0;
   let m;
   let found = null;
-  while ((m = CANDIDATE_RE.exec(around)) !== null) {
+  while ((m = candidateRe.exec(around)) !== null) {
     const value = m[0];
-    if (value !== akiaValue && !looksZeroEntropy(value)) {
+    if (value !== anchorValue && !looksZeroEntropy(value)) {
       if (found !== null && found !== value) return null;
       found = value;
     }
-    if (m.index === CANDIDATE_RE.lastIndex) CANDIDATE_RE.lastIndex++;
+    if (m.index === candidateRe.lastIndex) candidateRe.lastIndex++;
   }
   return found;
 }
 
-module.exports = { findPairedSecret };
+/**
+ * Find an AWS secret access key candidate paired with an already-matched
+ * access key id or session token on this line. See findNearbyCandidate for
+ * the shared mechanism this wraps with AWS's own candidate shape and window.
+ */
+function findPairedSecret(line, akiaValue, akiaIndex) {
+  return findNearbyCandidate(line, akiaValue, akiaIndex, CANDIDATE_RE, WINDOW);
+}
+
+module.exports = { findPairedSecret, findNearbyCandidate };

package/src/patterns.js

@@ -105,12 +105,87 @@ const PATTERNS = [
     re: /\bpplx-[A-Za-z0-9]{40,200}\b/g },
   { id: "replicate_token", label: "Replicate API token", confidence: "high",
     re: /\br8_[0-9A-Za-z_-]{37}\b/g },
+  // Confirmed via ElevenLabs' own docs (elevenlabs.io/docs/api-reference/authentication):
+  // sk_ + 48 hex. Distinct from the sk-/sk_live_/sk_test_ families above —
+  // underscore not hyphen, and no "_live_"/"_test_" substring, so it cannot
+  // collide with any of them.
+  { id: "elevenlabs_key", label: "ElevenLabs API key", confidence: "high",
+    re: /\bsk_[a-f0-9]{48}\b/g },
 
   // ── Cloud / infra ──────────────────────────────────────────────────────
   { id: "digitalocean_token", label: "DigitalOcean access token", confidence: "high",
     re: /\b(?:dop|doo|dor)_v1_[a-f0-9]{64}\b/g },
   { id: "supabase_token", label: "Supabase personal access token", confidence: "high",
     re: /\bsbp_[a-z0-9]{40}\b/g },
+  // Confirmed via planetscale.com/docs/api/reference/service-tokens: the
+  // secret half of a service token pair. The id half (12 lowercase
+  // alphanumeric characters, no prefix) is not a rule on its own for the
+  // same reason AWS's secret access key isn't: on its own it is
+  // indistinguishable from any other short id. Instead it is found the
+  // same way AWS's secret is (see pairing.js's findNearbyCandidate), just
+  // with the anchor and candidate roles swapped — this prefixed secret is
+  // the confirmed anchor, and the id is the nearby unprefixed candidate.
+  { id: "planetscale_secret", label: "PlanetScale service token", confidence: "high",
+    re: /\bpscale_tkn_[A-Za-z0-9_]{43}\b/g },
+  // Current CircleCI PAT format only (CCIPAT_<22 alnum>_<40 hex>, confirmed
+  // via circleci.com/docs/api/v2). The legacy format is a bare 40-char hex
+  // string with no prefix at all — nowhere near specific enough to be a
+  // vendor signal, so deliberately left out, same reasoning as Vault's
+  // legacy "s." format above.
+  { id: "circleci_token", label: "CircleCI personal API token", confidence: "high",
+    re: /\bCCIPAT_[A-Za-z0-9]{22}_[a-f0-9]{40}\b/g },
+  // Confirmed via airtable.com/developers/web/api: pat + 14 alnum + "." + 64 hex.
+  { id: "airtable_token", label: "Airtable personal access token", confidence: "high",
+    re: /\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b/g },
+  // Current Cloudflare API Token format only (cfat_/cfut_, confirmed via
+  // developers.cloudflare.com). The legacy format is a bare 40-char string
+  // with no prefix, left out for the same reason as CircleCI's legacy form.
+  { id: "cloudflare_api_token", label: "Cloudflare API token", confidence: "high",
+    re: /\bcf[au]t_[a-zA-Z0-9]{40}[a-f0-9]{8}\b/g },
+  // Current Heroku API key format only (HRKU-AA + 58 chars, confirmed via
+  // Heroku's own help docs). The legacy format is a bare UUID, left out:
+  // "any UUID-shaped string" is exactly the noisy, unspecific shape this
+  // file's header says to avoid.
+  { id: "heroku_api_key", label: "Heroku API key", confidence: "high",
+    re: /\bHRKU-AA[0-9a-zA-Z_-]{58}\b/g },
+  // Current Netlify PAT format only (nfp_ + 36, confirmed via trufflehog's
+  // live netlify/v2 detector). The legacy format is a bare 43-45 char
+  // opaque string with no prefix, left out for the same reason as above.
+  { id: "netlify_token", label: "Netlify personal access token", confidence: "high",
+    re: /\bnfp_[a-zA-Z0-9_]{36}\b/g },
+  // Confirmed via vercel.com/docs/accounts/access-tokens (updated 2026-08):
+  // "Personal access tokens begin with the prefix vcp_", 24-char alnum
+  // body shown in the docs' own example. A recent format rollout — an
+  // earlier research pass on this vendor found no confirmed prefix at all,
+  // since the vendor had not yet published this shape.
+  { id: "vercel_token", label: "Vercel personal access token", confidence: "high",
+    re: /\bvcp_[A-Za-z0-9]{24}\b/g },
+  // Fly.io issues a second token family too (fm1a_/fm1r_/fm2_
+  // "macaroons"), confirmed straight from Fly's own macaroon library
+  // source (github.com/superfly/macaroon, format.go). Deliberately NOT a
+  // rule here: caught live on this project's own real-machine testing, the
+  // macaroon shape (a short 4-5 char prefix plus a WIDE 100-700 char plain
+  // base64 body, no further structure) produced 16 distinct apparent
+  // matches inside a single real, unrelated job-queue log file that simply
+  // contained a lot of embedded base64 data — a real false-positive rate,
+  // not a hypothetical one, and exactly the noisy-shape case this file's
+  // own header says to leave out. fo1_ below did not show this problem
+  // (its body is a FIXED 43-char requirement, far less permissive), so
+  // that half of Fly.io's tokens is still covered.
+  { id: "flyio_bearer_token", label: "Fly.io API token", confidence: "high",
+    re: /\bfo1_[\w-]{43}\b/g },
+  // Prefix confirmed via Cerebras' own docs (inference-docs.cerebras.ai:
+  // "API Key (starts with csk-)"), but Cerebras has not published an exact
+  // body length — same situation as notion_token's ntn_ format above, so
+  // the bound here is a floor and a generous ceiling, not a verified exact
+  // count.
+  { id: "cerebras_key", label: "Cerebras API key", confidence: "high",
+    re: /\bcsk-[A-Za-z0-9]{20,200}\b/g },
+  // Prefix confirmed via Render's own docs (render.com, appears 6 times in
+  // the full-text docs dump), body length not published — same
+  // floor/ceiling treatment as Cerebras above.
+  { id: "render_key", label: "Render API key", confidence: "high",
+    re: /\brnd_[A-Za-z0-9]{20,200}\b/g },
   { id: "vault_token", label: "HashiCorp Vault service token", confidence: "high",
     // Vault 1.10+ format only (hvs.<90-120 chars>). The pre-1.10 legacy
     // format is a bare "s." + 18-40 chars — "s." is nowhere near specific

package/src/report.js

@@ -85,7 +85,14 @@ function makeProgressReporter(noColor) {
     const label = `scanning ${source}… ${count} file${count === 1 ? "" : "s"}  ${safeBasename(file)}`;
     write(paint(c.bold + c.cyan, SPINNER_FRAMES[frame]) + " " + paint(c.dim, label), 2 + label.length);
   };
-  const stop = () => { if (lastLineLen > 0) process.stderr.write("\r" + " ".repeat(lastLineLen) + "\r"); };
+  // Idempotent: a caller may legitimately stop() more than once (scan.js's
+  // onBeforeVerify calls it before --verify's own stderr lines, and the
+  // normal post-scan call still follows); lastLineLen resets to 0 so a
+  // second call is a true no-op, not a second blank-line clear.
+  const stop = () => {
+    if (lastLineLen > 0) process.stderr.write("\r" + " ".repeat(lastLineLen) + "\r");
+    lastLineLen = 0;
+  };
   return { onProgress, stop };
 }
 
@@ -260,17 +267,19 @@ function renderRotationSection(rotation, { noColor = false, showAdvisory = false
       // downgrade it to "already dead": both come from a real answer from
       // AWS, not a guess, so they get their own wording rather than folding
       // into the generic pairing line.
-      if (e.pairedSecretPreview || e.pairedAccessKeyPreview) {
+      if (e.pairedSecretPreview || e.pairedAccessKeyPreview || e.pairedOtherPreview) {
         const otherHalf = e.pairedSecretPreview
           ? `paired with secret ${e.pairedSecretPreview}`
-          : `paired with access key ${e.pairedAccessKeyPreview}`;
-        if (e.awsVerified === "active") {
-          push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · VERIFIED ACTIVE: AWS accepted these credentials moments ago, rotate immediately`));
-        } else if (e.awsVerified === "invalid") {
-          push(paint(c.green, `               ✓ ${otherHalf} · already inactive: AWS rejected these credentials, no rotation needed`));
-        } else if (e.awsVerified === "error") {
+          : e.pairedAccessKeyPreview
+            ? `paired with access key ${e.pairedAccessKeyPreview}`
+            : `paired with ${e.pairedOtherLabel || "value"} ${e.pairedOtherPreview}`;
+        if (e.verified === "active") {
+          push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · VERIFIED ACTIVE: the vendor accepted these credentials moments ago, rotate immediately`));
+        } else if (e.verified === "invalid") {
+          push(paint(c.green, `               ✓ ${otherHalf} · already inactive: the vendor rejected these credentials, no rotation needed`));
+        } else if (e.verified === "error") {
           push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · full working credential, rotate this one first`) +
-            paint(c.dim, ` (could not verify: ${e.awsVerifiedDetail || "unknown error"})`));
+            paint(c.dim, ` (could not verify: ${e.verifiedDetail || "unknown error"})`));
         } else {
           push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · full working credential, rotate this one first`));
         }

package/src/rotation.js

@@ -435,6 +435,19 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Disabling stops all API requests with that token immediately.",
   },
+  // Fetched https://elevenlabs.io/docs/api-reference/authentication
+  // (2026-09-03): keys are managed and deleted from the Profile + API keys
+  // page in the ElevenLabs dashboard.
+  elevenlabs_key: {
+    label: "ElevenLabs API key",
+    consolePath: "elevenlabs.io > Profile + API keys",
+    steps: [
+      "Open Profile + API keys in the ElevenLabs dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update the applications using it",
+    ],
+    revokeNote: "A key grants full account access (voices, generations, billing); deletion is immediate.",
+  },
 
   // ── Cloud / infra ─────────────────────────────────────────────────────
   // docs.digitalocean.com/reference/api/create-personal-access-token/
@@ -465,6 +478,29 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "This is the account-level token (sbp_); a project's anon and service_role keys rotate separately in that project's API settings.",
   },
+  // Fetched https://planetscale.com/docs/api/reference/service-tokens
+  // (2026-09-03): tokens are managed and revoked from the organization's
+  // Service tokens page in the PlanetScale dashboard.
+  planetscale_secret: {
+    label: "PlanetScale service token",
+    consolePath: "app.planetscale.com > organization Settings > Service tokens",
+    steps: [
+      "Open Service tokens under your organization's settings",
+      "Delete the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
+  },
+  planetscale_id: {
+    label: "PlanetScale service token id (paired with a leaked secret)",
+    consolePath: "app.planetscale.com > organization Settings > Service tokens",
+    steps: [
+      "This is the id half of the service token also found on this line",
+      "Delete the leaked token from Service tokens; the id dies with it",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "The id cannot be revoked on its own: deleting the paired token is what invalidates it.",
+  },
   // Fetched https://developer.hashicorp.com/vault/docs/commands/token/revoke
   // (2026-09-02): "token revoke revokes authentication tokens and their
   // children", -accessor and -mode flags.
@@ -491,6 +527,119 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Revoking immediately removes the token's access to every vault the service account could reach.",
   },
+  // Fetched https://circleci.com/docs/managing-api-tokens/ (2026-09-03):
+  // Personal API Tokens tab under User Settings, revoke deletes it
+  // immediately.
+  circleci_token: {
+    label: "CircleCI personal API token",
+    consolePath: "circleci.com > User Settings > Personal API Tokens",
+    steps: [
+      "Open Personal API Tokens under your CircleCI user settings",
+      "Revoke the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Revocation is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://airtable.com/developers/web/guides/personal-access-tokens
+  // (2026-09-03): tokens are managed and deleted from the Personal access
+  // tokens page in the Airtable developer hub (airtable.com/create/tokens).
+  airtable_token: {
+    label: "Airtable personal access token",
+    consolePath: "airtable.com/create/tokens",
+    steps: [
+      "Open the Personal access tokens page in the developer hub",
+      "Delete the leaked token",
+      "Create a replacement scoped only to what your integration needs",
+    ],
+    revokeNote: "Deletion is immediate and applies to every base the token could reach.",
+  },
+  // Fetched https://developers.cloudflare.com/fundamentals/api/get-started/create-token/
+  // (2026-09-03): tokens are managed and revoked from My Profile > API
+  // Tokens.
+  cloudflare_api_token: {
+    label: "Cloudflare API token",
+    consolePath: "dash.cloudflare.com > My Profile > API Tokens",
+    steps: [
+      "Open My Profile > API Tokens in the Cloudflare dashboard",
+      "Roll (regenerate) or delete the leaked token",
+      "Update whatever used the old token with the replacement",
+    ],
+    revokeNote: "Deleting is immediate; a scoped token only affects the zones/permissions it was granted.",
+  },
+  // Fetched https://help.heroku.com/PBGP6IDE (2026-09-03): API keys are
+  // regenerated from Account Settings, which invalidates the previous key.
+  heroku_api_key: {
+    label: "Heroku API key",
+    consolePath: "dashboard.heroku.com/account > API Key",
+    steps: [
+      "Open Account Settings in the Heroku dashboard",
+      "Regenerate the API key (this immediately invalidates the old one)",
+      "Update the CLI/CI configs and tools that used the old key",
+    ],
+    revokeNote: "Regeneration is the only way to invalidate a Heroku API key; there is no separate revoke action.",
+  },
+  // Fetched https://docs.netlify.com/api/get-started/#authentication
+  // (2026-09-03): personal access tokens are managed from User settings >
+  // Applications > Personal access tokens.
+  netlify_token: {
+    label: "Netlify personal access token",
+    consolePath: "app.netlify.com/user/applications#personal-access-tokens",
+    steps: [
+      "Open User settings > Applications > Personal access tokens",
+      "Delete the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://vercel.com/docs/accounts/access-tokens (2026-09-03):
+  // tokens are managed and deleted from Account Settings > Tokens.
+  vercel_token: {
+    label: "Vercel personal access token",
+    consolePath: "vercel.com/account/tokens",
+    steps: [
+      "Open Account Settings > Tokens",
+      "Delete the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://fly.io/docs/security/tokens/ (2026-09-03): tokens are
+  // managed via flyctl or the dashboard's Tokens page; revoking is
+  // immediate.
+  flyio_bearer_token: {
+    label: "Fly.io API token",
+    consolePath: "fly.io/dashboard > your organization > Tokens (or: flyctl tokens revoke)",
+    steps: [
+      "Open Tokens under your organization in the Fly.io dashboard",
+      "Revoke the leaked token",
+      "Create a replacement (flyctl tokens create, or the dashboard)",
+    ],
+    revokeNote: "Revocation is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://inference-docs.cerebras.ai (2026-09-03): keys are
+  // managed and deleted from the Cerebras Cloud platform's API Keys page.
+  cerebras_key: {
+    label: "Cerebras API key",
+    consolePath: "cloud.cerebras.ai > API Keys",
+    steps: [
+      "Open API Keys in the Cerebras Cloud platform",
+      "Delete the leaked key",
+      "Create a replacement and update the applications using it",
+    ],
+    revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
+  },
+  // Fetched https://render.com's own docs (llms-full.txt dump, 2026-09-03):
+  // API keys are managed and revoked from Account Settings > API Keys.
+  render_key: {
+    label: "Render API key",
+    consolePath: "dashboard.render.com/u/settings#api-keys",
+    steps: [
+      "Open Account Settings > API Keys in the Render dashboard",
+      "Revoke the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Revocation is immediate; the key stops authenticating on the next request.",
+  },
 
   // ── Comms / SaaS ──────────────────────────────────────────────────────
   // The user-facing support article (support.discord.com article 228383668)
@@ -897,6 +1046,15 @@ function renderRotation(findings, acks, dismissed = {}) {
         // usable credential pair, not just that a secret exists somewhere.
         pairedSecretPreview: null,
         pairedAccessKeyPreview: null,
+        // Same idea, generic: for any OTHER paired-credential vendor (see
+        // pairing.js's findNearbyCandidate, generalized from the AWS
+        // mechanism above), pairedOtherPreview is the other half's redacted
+        // preview and pairedOtherLabel is a short noun for what that other
+        // half IS ("id", "secret", ...) — kept separate from the AWS-named
+        // fields above since "paired with access key" is wrong wording for,
+        // say, PlanetScale's id/secret pair.
+        pairedOtherPreview: null,
+        pairedOtherLabel: null,
         // A JWT's own `exp` claim, decoded locally (see jwtExpiry.js): the
         // one credential type residoo can say "still valid" or "expired"
         // about with zero network calls, since expiry is inside the signed
@@ -938,6 +1096,10 @@ function renderRotation(findings, acks, dismissed = {}) {
     if (e.pairedAccessKeyPreview === null && typeof f.pairedAccessKeyPreview === "string") {
       e.pairedAccessKeyPreview = f.pairedAccessKeyPreview;
     }
+    if (e.pairedOtherPreview === null && typeof f.pairedOtherPreview === "string") {
+      e.pairedOtherPreview = f.pairedOtherPreview;
+      e.pairedOtherLabel = typeof f.pairedOtherLabel === "string" ? f.pairedOtherLabel : null;
+    }
     if (e.jwtExpiresAtMs === null && typeof f.jwtExpiresAtMs === "number") {
       e.jwtExpiresAtMs = f.jwtExpiresAtMs;
     }
@@ -964,7 +1126,7 @@ function renderRotation(findings, acks, dismissed = {}) {
   const isConfirmedDead = (e) => e.verified === "invalid" || (e.jwtExpiresAtMs !== null && e.jwtExpiresAtMs < Date.now());
   const priorityScore = (e) => {
     if (e.verified === "active") return -2;
-    if (e.pairedSecretPreview !== null || e.pairedAccessKeyPreview !== null) return -1;
+    if (e.pairedSecretPreview !== null || e.pairedAccessKeyPreview !== null || e.pairedOtherPreview !== null) return -1;
     if (isConfirmedDead(e)) return 1;
     return 0;
   };

package/src/scan.js

@@ -3,14 +3,35 @@
 const path = require("path");
 const { PATTERNS, NOISY_PATTERNS, redact } = require("./patterns");
 const { findDecodedMatches, findBoundaryMatches, contentProjection } = require("./decode");
-const { findPairedSecret } = require("./pairing");
+const { findPairedSecret, findNearbyCandidate } = require("./pairing");
 const { looksRandom } = require("./rarity");
 const { decodeJwtExpiryMs } = require("./jwtExpiry");
 const {
   isAwsCliAvailable, verifyAwsCredential,
   verifySlackToken, verifyOpenAiKey, verifyAnthropicKey, verifyGithubToken,
+  verifyHuggingFaceToken, verifyReplicateToken, verifyDigitalOceanToken, verifyPineconeKey,
+  verifySendgridKey, verifyGroqKey, verifyXaiKey, verifyOpenRouterKey, verifyStripeKey, verifyNpmToken,
+  verifyNotionToken, verifyGitlabToken, verifySupabaseToken, verifyElevenLabsKey,
+  verifyCircleciToken, verifyAirtableToken, verifyCloudflareToken, verifyHerokuKey,
+  verifyNetlifyToken, verifyLinearKey, verifyTelegramToken, verifyDiscordWebhook,
+  verifyPlanetScaleToken, verifyVercelToken, verifyCerebrasKey, verifyRenderKey,
+  verifyFlyioBearerToken,
 } = require("./verify");
 
+// PlanetScale's id half: 12 lowercase alphanumeric characters, no prefix —
+// confirmed via planetscale.com/docs/api/reference/service-tokens. Searched
+// for near an already-confirmed planetscale_secret match the same way AWS's
+// secret is searched for near an access key id (see pairing.js).
+const PLANETSCALE_ID_RE = /\b[a-z0-9]{12}\b/g;
+// A tighter window than AWS's: PlanetScale's own docs show the id and
+// secret adjacent, joined by a colon ("<id>:<token>"), not spread across a
+// config file the way an AWS access key and secret often are. A 12-char
+// lowercase-alnum candidate is also a much more common shape to collide
+// with by accident (a hash fragment, a short id) than AWS's 40-char one, so
+// a smaller window reduces how often an unrelated nearby string creates a
+// false ambiguous match.
+const PLANETSCALE_PAIR_WINDOW = 100;
+
 // Never verify more than this many distinct credentials of ONE vendor in a
 // single scan: a pathological transcript with dozens of distinct
 // credentials should not turn --verify into a long burst of outbound calls.
@@ -20,17 +41,79 @@ const MAX_VERIFICATIONS_PER_VENDOR = 10;
 // Every vendor whose credential is a single, unpaired bearer token: no
 // AWS-style "two halves make one credential" pairing step, so these all
 // share one collection/verification path below (see pendingSimpleVerifications).
+// Deliberately NOT here despite being detected: google_api_key (a key can
+// belong to any Google product; testing it against one product's endpoint
+// would misreport a valid key for a DIFFERENT product as invalid) and
+// perplexity_key (no free, side-effect-free endpoint exists at all).
+// PlanetScale is ALSO not here despite being verified: it needs pairing
+// (see pendingPlanetScaleVerifications below), the same reason AWS isn't
+// here either. See verify.js's own header comment for the fuller
+// reasoning behind every vendor left out.
 const SIMPLE_VERIFY_FNS = {
   slack_token: verifySlackToken,
   openai_key: verifyOpenAiKey,
   anthropic_key: verifyAnthropicKey,
   github_pat: verifyGithubToken,
+  huggingface_token: verifyHuggingFaceToken,
+  replicate_token: verifyReplicateToken,
+  digitalocean_token: verifyDigitalOceanToken,
+  pinecone_key: verifyPineconeKey,
+  sendgrid_key: verifySendgridKey,
+  groq_key: verifyGroqKey,
+  xai_key: verifyXaiKey,
+  openrouter_key: verifyOpenRouterKey,
+  stripe_key: verifyStripeKey,
+  stripe_test_key: verifyStripeKey,
+  npm_token: verifyNpmToken,
+  notion_token: verifyNotionToken,
+  gitlab_pat: verifyGitlabToken,
+  supabase_token: verifySupabaseToken,
+  elevenlabs_key: verifyElevenLabsKey,
+  circleci_token: verifyCircleciToken,
+  airtable_token: verifyAirtableToken,
+  cloudflare_api_token: verifyCloudflareToken,
+  heroku_api_key: verifyHerokuKey,
+  netlify_token: verifyNetlifyToken,
+  linear_key: verifyLinearKey,
+  telegram_bot_token: verifyTelegramToken,
+  discord_webhook: verifyDiscordWebhook,
+  vercel_token: verifyVercelToken,
+  cerebras_key: verifyCerebrasKey,
+  render_key: verifyRenderKey,
+  flyio_bearer_token: verifyFlyioBearerToken,
 };
 const SIMPLE_VERIFY_VENDOR_LABEL = {
   slack_token: "Slack's auth.test",
   openai_key: "OpenAI's models endpoint",
   anthropic_key: "Anthropic's models endpoint",
   github_pat: "GitHub's user endpoint",
+  huggingface_token: "Hugging Face's whoami endpoint",
+  replicate_token: "Replicate's account endpoint",
+  digitalocean_token: "DigitalOcean's account endpoint",
+  pinecone_key: "Pinecone's indexes endpoint",
+  sendgrid_key: "SendGrid's scopes endpoint",
+  groq_key: "Groq's models endpoint",
+  xai_key: "xAI's api-key endpoint",
+  openrouter_key: "OpenRouter's key endpoint",
+  stripe_key: "Stripe's balance endpoint",
+  stripe_test_key: "Stripe's balance endpoint",
+  npm_token: "npm's whoami endpoint",
+  notion_token: "Notion's users endpoint",
+  gitlab_pat: "GitLab's user endpoint",
+  supabase_token: "Supabase's projects endpoint",
+  elevenlabs_key: "ElevenLabs' user endpoint",
+  circleci_token: "CircleCI's me endpoint",
+  airtable_token: "Airtable's whoami endpoint",
+  cloudflare_api_token: "Cloudflare's token-verify endpoint",
+  heroku_api_key: "Heroku's account endpoint",
+  netlify_token: "Netlify's sites endpoint",
+  linear_key: "Linear's GraphQL API",
+  telegram_bot_token: "Telegram's getMe endpoint",
+  discord_webhook: "Discord's webhook-info endpoint",
+  vercel_token: "Vercel's user endpoint",
+  cerebras_key: "Cerebras's models endpoint",
+  render_key: "Render's owners endpoint",
+  flyio_bearer_token: "Fly.io's GraphQL API",
 };
 
 // Rule ids that findPairedSecret's window search applies to (see pairing.js):
@@ -154,7 +237,7 @@ function safeName(file) { return path.basename(file); }
  * absolute path can itself carry a username or a project name the rest of
  * this report is careful never to print.
  */
-async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false } = {}) {
+async function scan({ sources, includeNoisy = false, includeSuppressed = false, onProgress = null, verify = false, onBeforeVerify = null } = {}) {
   const rules = includeNoisy ? PATTERNS.concat(NOISY_PATTERNS) : PATTERNS;
   // The decode pass (see decode.js) only applies high-confidence, vendor-
   // prefixed rules to decoded bytes: random binary that decodes to printable
@@ -184,11 +267,15 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // call; nothing in it is ever written to a finding until verification has
   // REPLACED the raw values with a status string.
   const pendingAwsVerifications = new Map();
+  // Same shape as pendingAwsVerifications, for PlanetScale's paired
+  // credential (see the planetscale_secret match branch below): keyed by
+  // the secret value (the confirmed, prefixed anchor) -> { idValue, refs }.
+  const pendingPlanetScaleVerifications = new Map();
   // --verify only (see verify.js): ruleId -> (token value -> { refs }), for
-  // every SIMPLE_VERIFY_FNS vendor. Unlike AWS, none of these need pairing
-  // (the token itself is the complete credential), so this is simpler: one
-  // entry per distinct value per rule, `refs` accumulating every finding
-  // object that value produced.
+  // every SIMPLE_VERIFY_FNS vendor. Unlike AWS/PlanetScale, none of these
+  // need pairing (the token itself is the complete credential), so this is
+  // simpler: one entry per distinct value per rule, `refs` accumulating
+  // every finding object that value produced.
   const pendingSimpleVerifications = new Map();
 
   // One place raw matched text turns into a recorded finding: counts the
@@ -286,6 +373,32 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
               }
             }
           }
+          // PlanetScale: the opposite pairing direction from AWS (see
+          // pairing.js's findNearbyCandidate) — the SECRET is the
+          // confirmed, prefixed anchor here, and the unprefixed id is the
+          // nearby candidate. Uses the generic pairedOtherPreview/
+          // pairedOtherLabel fields rather than AWS's pairedSecretPreview/
+          // pairedAccessKeyPreview, since neither of those names fits ("the
+          // secret is paired with an id", not a second secret or an access
+          // key) — a future paired vendor reuses these same generic fields
+          // rather than growing a new AWS-shaped pair each time.
+          let planetScaleIdFinding = null;
+          let rawPlanetScaleId = null;
+          if (!suppressedReason && rule.id === "planetscale_secret") {
+            const pairedId = findNearbyCandidate(line, m[0], m.index, PLANETSCALE_ID_RE, PLANETSCALE_PAIR_WINDOW);
+            if (pairedId) {
+              const idSuppressedReason = suppressionReason(pairedId, null);
+              if (idSuppressedReason && !includeSuppressed) {
+                suppressedCount++;
+              } else {
+                rawPlanetScaleId = pairedId;
+                planetScaleIdFinding = record({ id: "planetscale_id", label: "PlanetScale service token id (paired with secret)" },
+                  pairedId, relFile, file, lineNo, mtimeMs,
+                  idSuppressedReason ? "low" : "high", idSuppressedReason,
+                  { paired: true, pairedOtherPreview: redact(m[0]), pairedOtherLabel: "secret" });
+              }
+            }
+          }
           // Local, offline JWT expiry (see jwtExpiry.js): only ever reads
           // the `exp` claim out of the decoded payload, nothing else, and
           // only for the unsuppressed default `jwt` rule, since a
@@ -297,7 +410,11 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             mtimeMs,
             resolveConfidence(rule.id, m[0], rule.confidence, suppressedReason),
             suppressedReason,
-            { ...(pairedSecretPreview ? { pairedSecretPreview } : {}), ...(jwtExtra || {}) });
+            {
+              ...(pairedSecretPreview ? { pairedSecretPreview } : {}),
+              ...(planetScaleIdFinding ? { pairedOtherPreview: redact(rawPlanetScaleId), pairedOtherLabel: "id" } : {}),
+              ...(jwtExtra || {}),
+            });
 
           // --verify only, and only for a DEMONSTRATED pair (both halves
           // present, neither suppressed): queue it for the verification pass
@@ -314,6 +431,15 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             const entry = pendingAwsVerifications.get(m[0]);
             if (entry) entry.refs.push({ akiaFinding: primaryFinding, secretFinding });
           }
+          // --verify, PlanetScale: same dedup-by-anchor-value shape as AWS
+          // above, keyed by the secret (the confirmed anchor) this time.
+          if (verify && planetScaleIdFinding && rawPlanetScaleId) {
+            if (!pendingPlanetScaleVerifications.has(m[0]) && pendingPlanetScaleVerifications.size < MAX_VERIFICATIONS_PER_VENDOR) {
+              pendingPlanetScaleVerifications.set(m[0], { idValue: rawPlanetScaleId, refs: [] });
+            }
+            const psEntry = pendingPlanetScaleVerifications.get(m[0]);
+            if (psEntry) psEntry.refs.push({ secretFinding: primaryFinding, idFinding: planetScaleIdFinding });
+          }
           // --verify, single-token vendors (Slack, OpenAI, Anthropic,
           // GitHub): none of these need pairing (the value IS the complete
           // credential), so queue every unsuppressed match directly, same
@@ -492,6 +618,20 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // distinct credential, one at a time (not concurrent), so this is the one
   // place a scan's wall-clock time depends on something other than disk
   // I/O; that tradeoff only exists when a caller explicitly asked for it.
+  //
+  // onBeforeVerify exists so a caller with its own stderr chatter (the
+  // progress spinner) can clear it first: this pass writes its own stderr
+  // lines below, and the spinner's own stop() doesn't run until scan()
+  // fully returns, which is AFTER those lines have already printed. Without
+  // this, the last spinner frame sits uncleared on screen and the first
+  // --verify line gets appended directly onto the end of it with no
+  // separator, a real rendering bug caught live. Only called when there is
+  // actually something to verify, so a plain --verify with nothing to check
+  // never clears a spinner line for no reason.
+  const anyPending = pendingAwsVerifications.size > 0 || pendingPlanetScaleVerifications.size > 0 ||
+    [...pendingSimpleVerifications.values()].some((byValue) => byValue.size > 0);
+  if (verify && anyPending && typeof onBeforeVerify === "function") onBeforeVerify();
+
   // Same field names (verified/verifiedDetail) regardless of which vendor
   // produced the result: rotation.js and report.js render them identically,
   // and the finding's own ruleId already says which vendor answered.
@@ -527,6 +667,17 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       }
     }
   }
+  if (verify && pendingPlanetScaleVerifications.size > 0) {
+    process.stderr.write(
+      `residoo --verify: calling PlanetScale's organizations endpoint for ${pendingPlanetScaleVerifications.size} ` +
+      "credential(s) found in this scan. This is a real network request to PlanetScale, using the exact " +
+      "credential found in your transcript, one at a time.\n"
+    );
+    for (const [secretValue, { idValue, refs }] of pendingPlanetScaleVerifications) {
+      const result = await verifyPlanetScaleToken(idValue, secretValue);
+      for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
+    }
+  }
   if (verify) {
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;

package/src/verify.js

@@ -199,13 +199,25 @@ async function verifySlackToken(token, { fetchFn = fetch, timeoutMs = DEFAULT_TI
  * Shared implementation for every vendor below Slack: a plain GET to a
  * free, side-effect-free, already-authenticated endpoint (each vendor's own
  * "list what I can see" call), where the HTTP status code alone says
- * whether the credential authenticated. 200 is active; 401/403 is a real
- * rejection; anything else (429 rate limited, 5xx, a network failure) is
- * inconclusive, never guessed as either active or invalid. Slack needed its
- * own function above because its auth.test always returns HTTP 200 and
- * signals failure inside the JSON body instead.
+ * whether the credential authenticated. 200 is active by default; 401/403
+ * is a real rejection by default; anything else (429 rate limited, 5xx, a
+ * network failure) is inconclusive, never guessed as either active or
+ * invalid. Slack needed its own function above because its auth.test
+ * always returns HTTP 200 and signals failure inside the JSON body
+ * instead.
+ *
+ * invalidStatuses/activeExtra override the defaults for the handful of
+ * vendors whose docs document a DIFFERENT meaning for a given code: Discord
+ * signals a dead webhook with 404, not 401/403; Pinecone, SendGrid, and
+ * GitLab each document 403 as "the credential is real but this specific
+ * call is out of scope," not "dead" — treating that as invalid would be
+ * exactly the false-negative-in-the-dangerous-direction failure this
+ * module exists to avoid, so those three pass 403 in activeExtra instead.
  */
-async function verifyByStatusCode(vendorName, url, buildHeaders, { fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+async function verifyByStatusCode(vendorName, url, buildHeaders, {
+  fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS,
+  invalidStatuses = [401, 403], activeExtra = [],
+} = {}) {
   let res;
   try {
     res = await fetchFn(url, {
@@ -216,10 +228,10 @@ async function verifyByStatusCode(vendorName, url, buildHeaders, { fetchFn = fet
   } catch (e) {
     return { status: "error", detail: `could not reach ${vendorName} (${sanitizeDetail(e && e.message)})` };
   }
-  if (res.status === 200) {
+  if (res.status === 200 || activeExtra.includes(res.status)) {
     return { status: "active", detail: `${vendorName} accepted this key` };
   }
-  if (res.status === 401 || res.status === 403) {
+  if (invalidStatuses.includes(res.status)) {
     return { status: "invalid", detail: `${vendorName} rejected this key (HTTP ${res.status})` };
   }
   return { status: "error", detail: `could not verify: HTTP ${res.status} from ${vendorName}` };
@@ -260,7 +272,290 @@ function verifyGithubToken(token, opts) {
   return verifyByStatusCode("GitHub", githubUserUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
 }
 
+// ── The rest of this file: 18 more vendors added after researching ~65
+// candidates against real vendor docs and open-source scanner source (see
+// the project's verification coverage research). Each one below already
+// has a residoo detection rule (src/patterns.js) with a specific enough
+// prefix that wiring it to a vendor is safe; several confirmed-viable
+// vendors from that research are deliberately NOT here, for reasons worth
+// stating precisely rather than silently omitting:
+//   - google_api_key, perplexity_key: DETECTED, but not wired. A Google API
+//     key can belong to any Google product (Maps, Firebase, Gemini, ...),
+//     and residoo's detection can't tell which; testing it against
+//     Gemini's endpoint specifically would report a perfectly valid Maps
+//     key as "invalid" — the exact false-negative-in-the-dangerous-
+//     direction failure this file exists to avoid. Perplexity has no free,
+//     side-effect-free endpoint at all (only a paid /chat/completions).
+//   - Cohere, Mistral, Together AI, Fireworks, DeepSeek: not detected in
+//     the first place (see patterns.js's own comment on this), so wiring a
+//     verifier would be dead code — verification needs detection first.
+//   - Linode / Akamai Cloud: researched twice, ruled out both times, the
+//     second time more conclusively than the first: its own OpenAPI schema
+//     documents the token as a bare opaque string with no prefix
+//     whatsoever, not merely an undocumented one, so this is not something
+//     a future docs update could fix.
+// Two vendors that were deferred in an earlier pass are no longer on this
+// list, once their real formats or engineering were worked out: PlanetScale
+// (see verifyPlanetScaleToken below and pairing.js's findNearbyCandidate,
+// generalized from AWS's own pairing mechanism to cover its id/secret
+// pair) and Fly.io's fo1_ token family (see verifyFlyioBearerToken below).
+// Fly.io's OTHER token family, fm1a_/fm1r_/fm2_ "macaroons," stays
+// undetected: caught live on this project's own real-machine testing, that
+// shape's short prefix plus a wide, unstructured base64 body produced
+// dozens of apparent matches inside an unrelated real file that just
+// happened to contain a lot of embedded base64 data. See patterns.js's own
+// comment on flyio_bearer_token for the measured false-positive rate.
+
+function huggingfaceUrl() { return process.env.RESIDOO_TEST_HUGGINGFACE_API_URL || "https://huggingface.co/api/whoami-v2"; }
+function sendgridUrl() { return process.env.RESIDOO_TEST_SENDGRID_API_URL || "https://api.sendgrid.com/v3/scopes"; }
+function replicateUrl() { return process.env.RESIDOO_TEST_REPLICATE_API_URL || "https://api.replicate.com/v1/account"; }
+function digitaloceanUrl() { return process.env.RESIDOO_TEST_DIGITALOCEAN_API_URL || "https://api.digitalocean.com/v2/account"; }
+function pineconeUrl() { return process.env.RESIDOO_TEST_PINECONE_API_URL || "https://api.pinecone.io/indexes"; }
+function groqUrl() { return process.env.RESIDOO_TEST_GROQ_API_URL || "https://api.groq.com/openai/v1/models"; }
+function xaiUrl() { return process.env.RESIDOO_TEST_XAI_API_URL || "https://api.x.ai/v1/api-key"; }
+function openrouterUrl() { return process.env.RESIDOO_TEST_OPENROUTER_API_URL || "https://openrouter.ai/api/v1/key"; }
+function stripeUrl() { return process.env.RESIDOO_TEST_STRIPE_API_URL || "https://api.stripe.com/v1/balance"; }
+function npmUrl() { return process.env.RESIDOO_TEST_NPM_API_URL || "https://registry.npmjs.org/-/whoami"; }
+function notionUrl() { return process.env.RESIDOO_TEST_NOTION_API_URL || "https://api.notion.com/v1/users"; }
+function gitlabUrl() { return process.env.RESIDOO_TEST_GITLAB_API_URL || "https://gitlab.com/api/v4/user"; }
+function supabaseUrl() { return process.env.RESIDOO_TEST_SUPABASE_API_URL || "https://api.supabase.com/v1/projects"; }
+function elevenlabsUrl() { return process.env.RESIDOO_TEST_ELEVENLABS_API_URL || "https://api.elevenlabs.io/v1/user"; }
+function circleciUrl() { return process.env.RESIDOO_TEST_CIRCLECI_API_URL || "https://circleci.com/api/v2/me"; }
+function airtableUrl() { return process.env.RESIDOO_TEST_AIRTABLE_API_URL || "https://api.airtable.com/v0/meta/whoami"; }
+function cloudflareUrl() { return process.env.RESIDOO_TEST_CLOUDFLARE_API_URL || "https://api.cloudflare.com/client/v4/user/tokens/verify"; }
+function herokuUrl() { return process.env.RESIDOO_TEST_HEROKU_API_URL || "https://api.heroku.com/account"; }
+function netlifyUrl() { return process.env.RESIDOO_TEST_NETLIFY_API_URL || "https://api.netlify.com/api/v1/sites"; }
+function linearUrl() { return process.env.RESIDOO_TEST_LINEAR_API_URL || "https://api.linear.app/graphql"; }
+function telegramUrl(token) {
+  const base = process.env.RESIDOO_TEST_TELEGRAM_API_URL || "https://api.telegram.org";
+  return `${base}/bot${token}/getMe`;
+}
+
+function verifyHuggingFaceToken(token, opts) {
+  return verifyByStatusCode("Hugging Face", huggingfaceUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+function verifyReplicateToken(token, opts) {
+  return verifyByStatusCode("Replicate", replicateUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+function verifyDigitalOceanToken(token, opts) {
+  return verifyByStatusCode("DigitalOcean", digitaloceanUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+/** 403 from SendGrid's own /v3/scopes means the key is real but lacks the scope for this call, not that it's dead — trufflehog's own detector treats it identically. */
+function verifySendgridKey(key, opts) {
+  return verifyByStatusCode("SendGrid", sendgridUrl(), () => ({ Authorization: `Bearer ${key}` }), { ...opts, activeExtra: [403] });
+}
+/** 403 from Pinecone means the key is real but lacks control-plane permissions, not that it's dead. */
+function verifyPineconeKey(key, opts) {
+  return verifyByStatusCode("Pinecone", pineconeUrl(), () => ({ "Api-Key": key }), { ...opts, activeExtra: [403] });
+}
+function verifyGroqKey(key, opts) {
+  return verifyByStatusCode("Groq", groqUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+function verifyXaiKey(key, opts) {
+  return verifyByStatusCode("xAI", xaiUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+function verifyOpenRouterKey(key, opts) {
+  return verifyByStatusCode("OpenRouter", openrouterUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+/** Stripe: HTTP Basic auth, the key as username and an empty password — NOT a Bearer header. */
+function verifyStripeKey(key, opts) {
+  return verifyByStatusCode("Stripe", stripeUrl(), () => ({
+    Authorization: `Basic ${Buffer.from(`${key}:`).toString("base64")}`,
+  }), opts);
+}
+function verifyNpmToken(token, opts) {
+  return verifyByStatusCode("npm", npmUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+/** Notion requires an explicit API version header on every request, regardless of endpoint. */
+function verifyNotionToken(token, opts) {
+  return verifyByStatusCode("Notion", notionUrl(), () => ({
+    Authorization: `Bearer ${token}`,
+    "Notion-Version": "2022-06-28",
+  }), opts);
+}
+/**
+ * GitLab's own docs recommend PRIVATE-TOKEN over a Bearer header for
+ * personal access tokens. 403 there means valid token, wrong scope for
+ * this specific call (trufflehog's own detector treats it the same way,
+ * except when the response body says the account itself is blocked — a
+ * rare enough edge case, and one where reporting "active" instead of
+ * "invalid" is the safe direction to be wrong in, that this doesn't
+ * special-case it further).
+ */
+function verifyGitlabToken(token, opts) {
+  return verifyByStatusCode("GitLab", gitlabUrl(), () => ({ "PRIVATE-TOKEN": token }), { ...opts, activeExtra: [403] });
+}
+/** The Supabase Management API personal access token (sbp_ prefix) only — project-scoped anon/service_role keys need a project URL residoo doesn't have and are not verifiable this way. */
+function verifySupabaseToken(token, opts) {
+  return verifyByStatusCode("Supabase", supabaseUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+function verifyElevenLabsKey(key, opts) {
+  return verifyByStatusCode("ElevenLabs", elevenlabsUrl(), () => ({ "xi-api-key": key }), opts);
+}
+function verifyCircleciToken(token, opts) {
+  return verifyByStatusCode("CircleCI", circleciUrl(), () => ({ "Circle-Token": token }), opts);
+}
+function verifyAirtableToken(token, opts) {
+  return verifyByStatusCode("Airtable", airtableUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+/**
+ * Cloudflare's own /user/tokens/verify endpoint exists for exactly this
+ * check (its whole purpose, per Cloudflare's docs, is confirming a
+ * token's validity), so treating any HTTP 200 from THIS SPECIFIC endpoint
+ * as active is a documented guarantee, not an approximation the way it
+ * would be for a generic "list resources" endpoint.
+ */
+function verifyCloudflareToken(token, opts) {
+  return verifyByStatusCode("Cloudflare", cloudflareUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+function verifyHerokuKey(key, opts) {
+  return verifyByStatusCode("Heroku", herokuUrl(), () => ({
+    Authorization: `Bearer ${key}`,
+    Accept: "application/vnd.heroku+json; version=3",
+  }), opts);
+}
+function verifyNetlifyToken(token, opts) {
+  return verifyByStatusCode("Netlify", netlifyUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+
+function planetscaleUrl() { return process.env.RESIDOO_TEST_PLANETSCALE_API_URL || "https://api.planetscale.com/v1/organizations"; }
+/**
+ * PlanetScale: a paired credential (like AWS), not a single token — the
+ * Authorization header is the literal "<id>:<token>", no Bearer/Basic
+ * prefix, verbatim from PlanetScale's own docs' curl example.
+ */
+function verifyPlanetScaleToken(id, secret, opts) {
+  return verifyByStatusCode("PlanetScale", planetscaleUrl(), () => ({ Authorization: `${id}:${secret}` }), opts);
+}
+
+function vercelUrl() { return process.env.RESIDOO_TEST_VERCEL_API_URL || "https://api.vercel.com/v2/user"; }
+function verifyVercelToken(token, opts) {
+  return verifyByStatusCode("Vercel", vercelUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+
+function cerebrasUrl() { return process.env.RESIDOO_TEST_CEREBRAS_API_URL || "https://api.cerebras.ai/v1/models"; }
+function verifyCerebrasKey(key, opts) {
+  return verifyByStatusCode("Cerebras", cerebrasUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+
+function renderUrl() { return process.env.RESIDOO_TEST_RENDER_API_URL || "https://api.render.com/v1/owners"; }
+function verifyRenderKey(key, opts) {
+  return verifyByStatusCode("Render", renderUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+
+function flyioUrl() { return process.env.RESIDOO_TEST_FLYIO_API_URL || "https://api.fly.io/graphql"; }
+/**
+ * Fly.io: one GraphQL endpoint, Bearer header (the scheme flyctl-issued
+ * fo1_ tokens use; Fly's other token family, fm1a_/fm1r_/fm2_ "macaroons",
+ * uses a different literal "FlyV1 <token>" scheme instead, but that family
+ * is not detected — see patterns.js's own comment on why). Like Linear, a
+ * GraphQL 200 can still carry an auth failure in the body, so this checks
+ * for a populated data.viewer instead of trusting the status code alone,
+ * except for 401, which Fly's own API does use for an outright missing or
+ * malformed token.
+ */
+async function verifyFlyioBearerToken(token, { fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetchFn(flyioUrl(), {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ query: "{ viewer { email } }" }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    return { status: "error", detail: `could not reach Fly.io (${sanitizeDetail(e && e.message)})` };
+  }
+  if (res.status === 401) return { status: "invalid", detail: "Fly.io rejected this token (HTTP 401)" };
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { status: "error", detail: `Fly.io returned a non-JSON response (HTTP ${res.status})` };
+  }
+  if (body && body.data && body.data.viewer && body.data.viewer.email) {
+    return { status: "active", detail: "Fly.io accepted this token" };
+  }
+  return { status: "error", detail: `could not verify: ${sanitizeDetail(JSON.stringify(body && body.errors)).slice(0, 120) || `HTTP ${res.status}`}` };
+}
+
+/**
+ * Linear: a GraphQL API, one POST endpoint for everything, not a plain GET.
+ * A GraphQL server can answer HTTP 200 even for some authorization-level
+ * failures (the error lives in the response body's `errors` field, not the
+ * status code), so this checks for a populated `data.viewer` instead of
+ * trusting status code alone — the same reasoning that gave Slack its own
+ * function above. Linear's own docs confirm no "Bearer" prefix on personal
+ * API keys (Bearer is reserved for OAuth tokens).
+ */
+async function verifyLinearKey(key, { fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetchFn(linearUrl(), {
+      method: "POST",
+      headers: { Authorization: key, "Content-Type": "application/json" },
+      body: JSON.stringify({ query: "{ viewer { id } }" }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    return { status: "error", detail: `could not reach Linear (${sanitizeDetail(e && e.message)})` };
+  }
+  if (res.status === 401) return { status: "invalid", detail: "Linear rejected this key (HTTP 401)" };
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { status: "error", detail: `Linear returned a non-JSON response (HTTP ${res.status})` };
+  }
+  if (body && body.data && body.data.viewer && body.data.viewer.id) {
+    return { status: "active", detail: "Linear accepted this key" };
+  }
+  return { status: "error", detail: `could not verify: ${sanitizeDetail(JSON.stringify(body && body.errors)).slice(0, 120) || `HTTP ${res.status}`}` };
+}
+
+/**
+ * Telegram: the token is embedded directly in the URL path, not a header,
+ * and (like Slack) the response is always HTTP 200 with an `ok` boolean in
+ * the body signaling success or failure — never a 401.
+ */
+async function verifyTelegramToken(token, { fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetchFn(telegramUrl(token), { method: "GET", signal: AbortSignal.timeout(timeoutMs) });
+  } catch (e) {
+    return { status: "error", detail: `could not reach Telegram (${sanitizeDetail(e && e.message)})` };
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { status: "error", detail: `Telegram returned a non-JSON response (HTTP ${res.status})` };
+  }
+  if (body && body.ok === true) return { status: "active", detail: "Telegram accepted this bot token (getMe)" };
+  if (body && body.ok === false && typeof body.error_code === "number") {
+    return { status: "invalid", detail: `Telegram rejected this token (${sanitizeDetail(body.description) || body.error_code})` };
+  }
+  return { status: "error", detail: `could not verify: HTTP ${res.status} from Telegram` };
+}
+
+/**
+ * Discord webhooks: the credential IS a full URL, not a token to attach to
+ * a fixed endpoint elsewhere. A plain GET on that URL is Discord's own
+ * documented read-only "fetch webhook info" call, distinct from POSTing to
+ * it (which would send a real, visible message — never done here).
+ */
+function verifyDiscordWebhook(webhookUrl, opts) {
+  return verifyByStatusCode("Discord", webhookUrl, () => ({}), { ...opts, invalidStatuses: [404] });
+}
+
 module.exports = {
   isAwsCliAvailable, verifyAwsCredential, verifySlackToken,
   verifyOpenAiKey, verifyAnthropicKey, verifyGithubToken,
+  verifyHuggingFaceToken, verifyReplicateToken, verifyDigitalOceanToken, verifyPineconeKey,
+  verifySendgridKey, verifyGroqKey, verifyXaiKey, verifyOpenRouterKey, verifyStripeKey, verifyNpmToken,
+  verifyNotionToken, verifyGitlabToken, verifySupabaseToken, verifyElevenLabsKey,
+  verifyCircleciToken, verifyAirtableToken, verifyCloudflareToken, verifyHerokuKey,
+  verifyNetlifyToken, verifyLinearKey, verifyTelegramToken, verifyDiscordWebhook,
+  verifyPlanetScaleToken, verifyVercelToken, verifyCerebrasKey, verifyRenderKey,
+  verifyFlyioBearerToken,
 };