residoo 0.4.6 → 0.4.7

package/README.md

@@ -98,7 +98,7 @@ precise about rather than lumping together:
   with an X, and states it is "fully offline, with zero network calls
   during scanning or redacting" apart from an optional PyPI version-check
   ping. residoo's `--verify` follows betterleaks' posture, not
-  trufflehog's: off by default, an explicit flag, and 27 vendors today
+  trufflehog's: off by default, an explicit flag, and 32 vendors today
   (still short of trufflehog's 700+) rather than every vendor its own
   detection can name, deduped the same way betterleaks dedupes, and gated
   the same way patterns.js's own detection rules are: only added where a
@@ -149,25 +149,36 @@ won't be built into the tool that writes it.
   discarded. See `src/jwtExpiry.js`.
 - **`--verify`** (opt-in, makes a real network call): asks a credential's own
   vendor whether it still authenticates, using the exact value found in your
-  transcript. 27 vendors today: **AWS** (an access key id found paired with
-  its secret, checked via `sts:get-caller-identity`, the same free,
-  read-only, permission-less call the AWS CLI and tools like aws-vault use
-  for exactly this; shells out to your own `aws` CLI rather than
-  reimplementing AWS request signing, since residoo ships zero runtime
-  dependencies and a subtly wrong signing implementation would silently
-  report real keys as invalid, worse than not checking), and **26 more via a
-  direct API call each, no CLI needed**: Slack, OpenAI, Anthropic, GitHub,
+  transcript. 32 vendors today. Two need a paired id+secret (see the
+  Rotation section below for what that means): **AWS** (checked via
+  `sts:get-caller-identity`, the same free, read-only, permission-less call
+  the AWS CLI and tools like aws-vault use for exactly this; shells out to
+  your own `aws` CLI rather than reimplementing AWS request signing, since
+  residoo ships zero runtime dependencies and a subtly wrong signing
+  implementation would silently report real keys as invalid, worse than not
+  checking) and **PlanetScale** (a direct API call, like every other
+  non-AWS vendor here, with the id/secret pairing found the same way AWS's
+  is, see `src/pairing.js`). The other **30 are a single credential each,
+  one direct API call, no CLI needed**: Slack, OpenAI, Anthropic, GitHub,
   Hugging Face, Replicate, DigitalOcean, Pinecone, SendGrid, Groq, xAI,
   OpenRouter, Stripe, npm, Notion, GitLab, Supabase (management tokens
   only, project-scoped anon/service_role keys need a project URL residoo
   doesn't have), ElevenLabs, CircleCI, Airtable, Cloudflare, Heroku,
-  Netlify, Linear, Telegram, and Discord webhooks. Every one of the 27 was
-  researched against that vendor's own current docs or a named open-source
-  scanner's real, running verifier code before being wired up, the same bar
-  as the first five; a real, sourced reason (no free endpoint, needs
-  external context the credential doesn't carry, or a paired credential
-  residoo doesn't yet detect together) is why some detected credential
-  types aren't wired to `--verify` at all, not an oversight. A
+  Netlify, Linear, Telegram, Discord webhooks, Vercel, Cerebras, Render,
+  and Fly.io's `fo1_` tokens (Fly.io's other token family, `fm1a_`/`fm1r_`/
+  `fm2_` "macaroons," is detected nowhere in residoo: caught on this
+  project's own real-machine testing, that shape's short prefix plus a
+  wide, unstructured base64 body produced over a dozen apparent matches
+  inside one real, unrelated job-queue log file that simply contained a lot
+  of embedded base64 data, a measured false-positive rate, not a
+  hypothetical one). Every one of the 32 was researched against that
+  vendor's own current docs or a
+  named open-source scanner's real, running verifier code before being
+  wired up, the same bar as the first five; a real, sourced reason (no free
+  endpoint, needs external context the credential doesn't carry, or a
+  credential format not confirmed specifically enough to detect safely in
+  the first place) is why some detected credential types aren't wired to
+  `--verify` at all, not an oversight. A
   verified-active credential is escalated to "rotate immediately"; a
   verified-invalid one is reported as already dead, no action needed, and
   sorted out of the way. Off by default; every environment variable the
@@ -184,10 +195,10 @@ won't be built into the tool that writes it.
   preview, never the real value, including in `--json` mode. A decoded or
   rejoined secret is redacted exactly like a plain one.
 - On an interactive terminal, prints who it is and where it lives before
-  scanning starts (`residoo v0.4.6 · find secrets your AI coding agent left
+  scanning starts (`residoo v0.4.7 · find secrets your AI coding agent left
   on disk` plus the repo URL), then a live spinner naming the current file
   as it scans. Every report also opens with the exact version and timestamp
-  it was run with (`residoo v0.4.6 · scanned 2026-01-01 12:00`; `--json`
+  it was run with (`residoo v0.4.7 · scanned 2026-01-01 12:00`; `--json`
   carries the same as `residooVersion`/`scannedAt`), so a report pasted or
   screenshotted later never leaves you guessing which build produced it.
   When there are findings, the report closes with a "Next steps" pointer to
@@ -418,7 +429,7 @@ As a GitHub Action (this repository doubles as a composite action):
 ```yaml
 steps:
   - uses: actions/checkout@v4
-  - uses: dandovdub/residoo@v0.4.6
+  - uses: dandovdub/residoo@v0.4.7
 ```
 
 As a pre-commit hook:
@@ -426,7 +437,7 @@ As a pre-commit hook:
 ```yaml
 repos:
   - repo: https://github.com/dandovdub/residoo
-    rev: v0.4.6
+    rev: v0.4.7
     hooks:
       - id: residoo
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cli.js

@@ -57,7 +57,7 @@ const HELP = `residoo: find secrets leaking through your AI agent's session hist
   Scanning makes NO network calls by default and changes nothing on disk.
   Findings are redacted in every output format. The one opt-in exception is
   --verify, which asks a credential's own vendor whether it still
-  authenticates (27 vendors today, see below). Sealing (--seal) writes NEW
+  authenticates (32 vendors today, see below). Sealing (--seal) writes NEW
   encrypted files only. It never modifies or deletes anything that already
   exists.
 
@@ -102,23 +102,27 @@ Scan options:
   --verify                ask the credential's own vendor whether it still
                           authenticates, using the exact value found in
                           your transcript. THIS MAKES A REAL NETWORK CALL.
-                          Off by default. 27 vendors today: AWS (an access
-                          key id found paired with its secret, see Rotation
-                          below, checked via sts:get-caller-identity;
-                          needs the aws CLI on PATH, residoo shells out to
-                          it rather than reimplementing AWS request
-                          signing) and 26 more via a direct, dependency-
-                          free API call each, no CLI needed: Slack, OpenAI,
-                          Anthropic, GitHub, Hugging Face, Replicate,
-                          DigitalOcean, Pinecone, SendGrid, Groq, xAI,
-                          OpenRouter, Stripe, npm, Notion, GitLab, Supabase
-                          (management tokens only), ElevenLabs, CircleCI,
-                          Airtable, Cloudflare, Heroku, Netlify, Linear,
-                          Telegram, Discord webhooks. A verified-invalid
-                          credential is reported as already dead, not as
-                          something to rotate; a JWT's own signed exp claim
-                          is checked locally with no network call at all,
-                          on by default, not part of --verify.
+                          Off by default. 32 vendors today. Two need a
+                          paired id+secret (see Rotation below): AWS,
+                          checked via sts:get-caller-identity (needs the
+                          aws CLI on PATH, residoo shells out to it rather
+                          than reimplementing AWS request signing), and
+                          PlanetScale, checked via a direct API call like
+                          every other non-AWS vendor here. The other 30 are
+                          each a single credential, one direct,
+                          dependency-free API call, no CLI needed: Slack,
+                          OpenAI, Anthropic, GitHub, Hugging Face,
+                          Replicate, DigitalOcean, Pinecone, SendGrid,
+                          Groq, xAI, OpenRouter, Stripe, npm, Notion,
+                          GitLab, Supabase (management tokens only),
+                          ElevenLabs, CircleCI, Airtable, Cloudflare,
+                          Heroku, Netlify, Linear, Telegram, Discord
+                          webhooks, Vercel, Cerebras, Render, and Fly.io.
+                          A verified-invalid credential is reported as
+                          already dead, not as something to rotate; a
+                          JWT's own signed exp claim is checked locally
+                          with no network call at all, on by default, not
+                          part of --verify.
 
 Rotation:
   residoo explain <rule-id>     full rotation runbook for one detection rule

package/src/pairing.js

@@ -23,6 +23,11 @@
  * other mechanism here: no rule is added to the default set, and a bare
  * 40-char base64 string anywhere else on a line, with no access key nearby,
  * is still silently ignored exactly as before this feature existed.
+ *
+ * findNearbyCandidate below is the same mechanism generalized: PlanetScale
+ * (see scan.js) needs an identical pairing step, just with the anchor and
+ * candidate roles swapped (the SECRET is the prefixed, independently
+ * detected value; the unprefixed id is what gets found nearby).
  */
 
 const WINDOW = 400; // chars searched on each side of the access-key match
@@ -51,33 +56,48 @@ function looksZeroEntropy(value) {
 }
 
 /**
- * Find an AWS secret access key candidate paired with an already-matched
- * access key id or session token on this line. `akiaValue` and `akiaIndex`
- * locate the paired match so the search can be windowed around it and so
- * the access key's own text is never re-matched as its own pair.
+ * Find a candidate value paired with an already-matched anchor value on
+ * this line, within `window` characters on either side. `anchorValue` and
+ * `anchorIndex` locate the anchor so the search can exclude the anchor's
+ * own text from matching itself.
  *
  * Returns the candidate string, or null when there is none, or when more
  * than one distinct candidate sits in the window. Ambiguous pairing is
  * reported as nothing at all: for a finding whose whole point is "this is
  * high confidence because of what it's next to," guessing wrong is worse
  * than staying silent.
+ *
+ * Generic over which value is the anchor and which is the candidate: AWS
+ * anchors on the prefixed access key id and searches for the unprefixed
+ * secret; PlanetScale (see scan.js) anchors on the prefixed secret and
+ * searches for the unprefixed id — same mechanism, opposite roles, so one
+ * function serves both rather than two near-identical copies.
  */
-function findPairedSecret(line, akiaValue, akiaIndex) {
-  const start = Math.max(0, akiaIndex - WINDOW);
-  const end = Math.min(line.length, akiaIndex + akiaValue.length + WINDOW);
+function findNearbyCandidate(line, anchorValue, anchorIndex, candidateRe, window) {
+  const start = Math.max(0, anchorIndex - window);
+  const end = Math.min(line.length, anchorIndex + anchorValue.length + window);
   const around = line.slice(start, end);
-  CANDIDATE_RE.lastIndex = 0;
+  candidateRe.lastIndex = 0;
   let m;
   let found = null;
-  while ((m = CANDIDATE_RE.exec(around)) !== null) {
+  while ((m = candidateRe.exec(around)) !== null) {
     const value = m[0];
-    if (value !== akiaValue && !looksZeroEntropy(value)) {
+    if (value !== anchorValue && !looksZeroEntropy(value)) {
       if (found !== null && found !== value) return null;
       found = value;
     }
-    if (m.index === CANDIDATE_RE.lastIndex) CANDIDATE_RE.lastIndex++;
+    if (m.index === candidateRe.lastIndex) candidateRe.lastIndex++;
   }
   return found;
 }
 
-module.exports = { findPairedSecret };
+/**
+ * Find an AWS secret access key candidate paired with an already-matched
+ * access key id or session token on this line. See findNearbyCandidate for
+ * the shared mechanism this wraps with AWS's own candidate shape and window.
+ */
+function findPairedSecret(line, akiaValue, akiaIndex) {
+  return findNearbyCandidate(line, akiaValue, akiaIndex, CANDIDATE_RE, WINDOW);
+}
+
+module.exports = { findPairedSecret, findNearbyCandidate };

package/src/patterns.js

@@ -117,6 +117,16 @@ const PATTERNS = [
     re: /\b(?:dop|doo|dor)_v1_[a-f0-9]{64}\b/g },
   { id: "supabase_token", label: "Supabase personal access token", confidence: "high",
     re: /\bsbp_[a-z0-9]{40}\b/g },
+  // Confirmed via planetscale.com/docs/api/reference/service-tokens: the
+  // secret half of a service token pair. The id half (12 lowercase
+  // alphanumeric characters, no prefix) is not a rule on its own for the
+  // same reason AWS's secret access key isn't: on its own it is
+  // indistinguishable from any other short id. Instead it is found the
+  // same way AWS's secret is (see pairing.js's findNearbyCandidate), just
+  // with the anchor and candidate roles swapped — this prefixed secret is
+  // the confirmed anchor, and the id is the nearby unprefixed candidate.
+  { id: "planetscale_secret", label: "PlanetScale service token", confidence: "high",
+    re: /\bpscale_tkn_[A-Za-z0-9_]{43}\b/g },
   // Current CircleCI PAT format only (CCIPAT_<22 alnum>_<40 hex>, confirmed
   // via circleci.com/docs/api/v2). The legacy format is a bare 40-char hex
   // string with no prefix at all — nowhere near specific enough to be a
@@ -143,6 +153,39 @@ const PATTERNS = [
   // opaque string with no prefix, left out for the same reason as above.
   { id: "netlify_token", label: "Netlify personal access token", confidence: "high",
     re: /\bnfp_[a-zA-Z0-9_]{36}\b/g },
+  // Confirmed via vercel.com/docs/accounts/access-tokens (updated 2026-08):
+  // "Personal access tokens begin with the prefix vcp_", 24-char alnum
+  // body shown in the docs' own example. A recent format rollout — an
+  // earlier research pass on this vendor found no confirmed prefix at all,
+  // since the vendor had not yet published this shape.
+  { id: "vercel_token", label: "Vercel personal access token", confidence: "high",
+    re: /\bvcp_[A-Za-z0-9]{24}\b/g },
+  // Fly.io issues a second token family too (fm1a_/fm1r_/fm2_
+  // "macaroons"), confirmed straight from Fly's own macaroon library
+  // source (github.com/superfly/macaroon, format.go). Deliberately NOT a
+  // rule here: caught live on this project's own real-machine testing, the
+  // macaroon shape (a short 4-5 char prefix plus a WIDE 100-700 char plain
+  // base64 body, no further structure) produced 16 distinct apparent
+  // matches inside a single real, unrelated job-queue log file that simply
+  // contained a lot of embedded base64 data — a real false-positive rate,
+  // not a hypothetical one, and exactly the noisy-shape case this file's
+  // own header says to leave out. fo1_ below did not show this problem
+  // (its body is a FIXED 43-char requirement, far less permissive), so
+  // that half of Fly.io's tokens is still covered.
+  { id: "flyio_bearer_token", label: "Fly.io API token", confidence: "high",
+    re: /\bfo1_[\w-]{43}\b/g },
+  // Prefix confirmed via Cerebras' own docs (inference-docs.cerebras.ai:
+  // "API Key (starts with csk-)"), but Cerebras has not published an exact
+  // body length — same situation as notion_token's ntn_ format above, so
+  // the bound here is a floor and a generous ceiling, not a verified exact
+  // count.
+  { id: "cerebras_key", label: "Cerebras API key", confidence: "high",
+    re: /\bcsk-[A-Za-z0-9]{20,200}\b/g },
+  // Prefix confirmed via Render's own docs (render.com, appears 6 times in
+  // the full-text docs dump), body length not published — same
+  // floor/ceiling treatment as Cerebras above.
+  { id: "render_key", label: "Render API key", confidence: "high",
+    re: /\brnd_[A-Za-z0-9]{20,200}\b/g },
   { id: "vault_token", label: "HashiCorp Vault service token", confidence: "high",
     // Vault 1.10+ format only (hvs.<90-120 chars>). The pre-1.10 legacy
     // format is a bare "s." + 18-40 chars — "s." is nowhere near specific

package/src/report.js

@@ -267,17 +267,19 @@ function renderRotationSection(rotation, { noColor = false, showAdvisory = false
       // downgrade it to "already dead": both come from a real answer from
       // AWS, not a guess, so they get their own wording rather than folding
       // into the generic pairing line.
-      if (e.pairedSecretPreview || e.pairedAccessKeyPreview) {
+      if (e.pairedSecretPreview || e.pairedAccessKeyPreview || e.pairedOtherPreview) {
         const otherHalf = e.pairedSecretPreview
           ? `paired with secret ${e.pairedSecretPreview}`
-          : `paired with access key ${e.pairedAccessKeyPreview}`;
-        if (e.awsVerified === "active") {
-          push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · VERIFIED ACTIVE: AWS accepted these credentials moments ago, rotate immediately`));
-        } else if (e.awsVerified === "invalid") {
-          push(paint(c.green, `               ✓ ${otherHalf} · already inactive: AWS rejected these credentials, no rotation needed`));
-        } else if (e.awsVerified === "error") {
+          : e.pairedAccessKeyPreview
+            ? `paired with access key ${e.pairedAccessKeyPreview}`
+            : `paired with ${e.pairedOtherLabel || "value"} ${e.pairedOtherPreview}`;
+        if (e.verified === "active") {
+          push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · VERIFIED ACTIVE: the vendor accepted these credentials moments ago, rotate immediately`));
+        } else if (e.verified === "invalid") {
+          push(paint(c.green, `               ✓ ${otherHalf} · already inactive: the vendor rejected these credentials, no rotation needed`));
+        } else if (e.verified === "error") {
           push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · full working credential, rotate this one first`) +
-            paint(c.dim, ` (could not verify: ${e.awsVerifiedDetail || "unknown error"})`));
+            paint(c.dim, ` (could not verify: ${e.verifiedDetail || "unknown error"})`));
         } else {
           push(paint(c.red + c.bold, `               ⚠ ${otherHalf} · full working credential, rotate this one first`));
         }

package/src/rotation.js

@@ -478,6 +478,29 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "This is the account-level token (sbp_); a project's anon and service_role keys rotate separately in that project's API settings.",
   },
+  // Fetched https://planetscale.com/docs/api/reference/service-tokens
+  // (2026-09-03): tokens are managed and revoked from the organization's
+  // Service tokens page in the PlanetScale dashboard.
+  planetscale_secret: {
+    label: "PlanetScale service token",
+    consolePath: "app.planetscale.com > organization Settings > Service tokens",
+    steps: [
+      "Open Service tokens under your organization's settings",
+      "Delete the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
+  },
+  planetscale_id: {
+    label: "PlanetScale service token id (paired with a leaked secret)",
+    consolePath: "app.planetscale.com > organization Settings > Service tokens",
+    steps: [
+      "This is the id half of the service token also found on this line",
+      "Delete the leaked token from Service tokens; the id dies with it",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "The id cannot be revoked on its own: deleting the paired token is what invalidates it.",
+  },
   // Fetched https://developer.hashicorp.com/vault/docs/commands/token/revoke
   // (2026-09-02): "token revoke revokes authentication tokens and their
   // children", -accessor and -mode flags.
@@ -568,6 +591,55 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
   },
+  // Fetched https://vercel.com/docs/accounts/access-tokens (2026-09-03):
+  // tokens are managed and deleted from Account Settings > Tokens.
+  vercel_token: {
+    label: "Vercel personal access token",
+    consolePath: "vercel.com/account/tokens",
+    steps: [
+      "Open Account Settings > Tokens",
+      "Delete the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://fly.io/docs/security/tokens/ (2026-09-03): tokens are
+  // managed via flyctl or the dashboard's Tokens page; revoking is
+  // immediate.
+  flyio_bearer_token: {
+    label: "Fly.io API token",
+    consolePath: "fly.io/dashboard > your organization > Tokens (or: flyctl tokens revoke)",
+    steps: [
+      "Open Tokens under your organization in the Fly.io dashboard",
+      "Revoke the leaked token",
+      "Create a replacement (flyctl tokens create, or the dashboard)",
+    ],
+    revokeNote: "Revocation is immediate; the token stops authenticating on the next request.",
+  },
+  // Fetched https://inference-docs.cerebras.ai (2026-09-03): keys are
+  // managed and deleted from the Cerebras Cloud platform's API Keys page.
+  cerebras_key: {
+    label: "Cerebras API key",
+    consolePath: "cloud.cerebras.ai > API Keys",
+    steps: [
+      "Open API Keys in the Cerebras Cloud platform",
+      "Delete the leaked key",
+      "Create a replacement and update the applications using it",
+    ],
+    revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
+  },
+  // Fetched https://render.com's own docs (llms-full.txt dump, 2026-09-03):
+  // API keys are managed and revoked from Account Settings > API Keys.
+  render_key: {
+    label: "Render API key",
+    consolePath: "dashboard.render.com/u/settings#api-keys",
+    steps: [
+      "Open Account Settings > API Keys in the Render dashboard",
+      "Revoke the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Revocation is immediate; the key stops authenticating on the next request.",
+  },
 
   // ── Comms / SaaS ──────────────────────────────────────────────────────
   // The user-facing support article (support.discord.com article 228383668)
@@ -974,6 +1046,15 @@ function renderRotation(findings, acks, dismissed = {}) {
         // usable credential pair, not just that a secret exists somewhere.
         pairedSecretPreview: null,
         pairedAccessKeyPreview: null,
+        // Same idea, generic: for any OTHER paired-credential vendor (see
+        // pairing.js's findNearbyCandidate, generalized from the AWS
+        // mechanism above), pairedOtherPreview is the other half's redacted
+        // preview and pairedOtherLabel is a short noun for what that other
+        // half IS ("id", "secret", ...) — kept separate from the AWS-named
+        // fields above since "paired with access key" is wrong wording for,
+        // say, PlanetScale's id/secret pair.
+        pairedOtherPreview: null,
+        pairedOtherLabel: null,
         // A JWT's own `exp` claim, decoded locally (see jwtExpiry.js): the
         // one credential type residoo can say "still valid" or "expired"
         // about with zero network calls, since expiry is inside the signed
@@ -1015,6 +1096,10 @@ function renderRotation(findings, acks, dismissed = {}) {
     if (e.pairedAccessKeyPreview === null && typeof f.pairedAccessKeyPreview === "string") {
       e.pairedAccessKeyPreview = f.pairedAccessKeyPreview;
     }
+    if (e.pairedOtherPreview === null && typeof f.pairedOtherPreview === "string") {
+      e.pairedOtherPreview = f.pairedOtherPreview;
+      e.pairedOtherLabel = typeof f.pairedOtherLabel === "string" ? f.pairedOtherLabel : null;
+    }
     if (e.jwtExpiresAtMs === null && typeof f.jwtExpiresAtMs === "number") {
       e.jwtExpiresAtMs = f.jwtExpiresAtMs;
     }
@@ -1041,7 +1126,7 @@ function renderRotation(findings, acks, dismissed = {}) {
   const isConfirmedDead = (e) => e.verified === "invalid" || (e.jwtExpiresAtMs !== null && e.jwtExpiresAtMs < Date.now());
   const priorityScore = (e) => {
     if (e.verified === "active") return -2;
-    if (e.pairedSecretPreview !== null || e.pairedAccessKeyPreview !== null) return -1;
+    if (e.pairedSecretPreview !== null || e.pairedAccessKeyPreview !== null || e.pairedOtherPreview !== null) return -1;
     if (isConfirmedDead(e)) return 1;
     return 0;
   };

package/src/scan.js

@@ -3,7 +3,7 @@
 const path = require("path");
 const { PATTERNS, NOISY_PATTERNS, redact } = require("./patterns");
 const { findDecodedMatches, findBoundaryMatches, contentProjection } = require("./decode");
-const { findPairedSecret } = require("./pairing");
+const { findPairedSecret, findNearbyCandidate } = require("./pairing");
 const { looksRandom } = require("./rarity");
 const { decodeJwtExpiryMs } = require("./jwtExpiry");
 const {
@@ -14,8 +14,24 @@ const {
   verifyNotionToken, verifyGitlabToken, verifySupabaseToken, verifyElevenLabsKey,
   verifyCircleciToken, verifyAirtableToken, verifyCloudflareToken, verifyHerokuKey,
   verifyNetlifyToken, verifyLinearKey, verifyTelegramToken, verifyDiscordWebhook,
+  verifyPlanetScaleToken, verifyVercelToken, verifyCerebrasKey, verifyRenderKey,
+  verifyFlyioBearerToken,
 } = require("./verify");
 
+// PlanetScale's id half: 12 lowercase alphanumeric characters, no prefix —
+// confirmed via planetscale.com/docs/api/reference/service-tokens. Searched
+// for near an already-confirmed planetscale_secret match the same way AWS's
+// secret is searched for near an access key id (see pairing.js).
+const PLANETSCALE_ID_RE = /\b[a-z0-9]{12}\b/g;
+// A tighter window than AWS's: PlanetScale's own docs show the id and
+// secret adjacent, joined by a colon ("<id>:<token>"), not spread across a
+// config file the way an AWS access key and secret often are. A 12-char
+// lowercase-alnum candidate is also a much more common shape to collide
+// with by accident (a hash fragment, a short id) than AWS's 40-char one, so
+// a smaller window reduces how often an unrelated nearby string creates a
+// false ambiguous match.
+const PLANETSCALE_PAIR_WINDOW = 100;
+
 // Never verify more than this many distinct credentials of ONE vendor in a
 // single scan: a pathological transcript with dozens of distinct
 // credentials should not turn --verify into a long burst of outbound calls.
@@ -28,9 +44,11 @@ const MAX_VERIFICATIONS_PER_VENDOR = 10;
 // Deliberately NOT here despite being detected: google_api_key (a key can
 // belong to any Google product; testing it against one product's endpoint
 // would misreport a valid key for a DIFFERENT product as invalid) and
-// perplexity_key (no free, side-effect-free endpoint exists at all). See
-// verify.js's own header comment for the fuller reasoning, including the
-// vendors deferred rather than rushed (PlanetScale, Fly.io).
+// perplexity_key (no free, side-effect-free endpoint exists at all).
+// PlanetScale is ALSO not here despite being verified: it needs pairing
+// (see pendingPlanetScaleVerifications below), the same reason AWS isn't
+// here either. See verify.js's own header comment for the fuller
+// reasoning behind every vendor left out.
 const SIMPLE_VERIFY_FNS = {
   slack_token: verifySlackToken,
   openai_key: verifyOpenAiKey,
@@ -59,6 +77,10 @@ const SIMPLE_VERIFY_FNS = {
   linear_key: verifyLinearKey,
   telegram_bot_token: verifyTelegramToken,
   discord_webhook: verifyDiscordWebhook,
+  vercel_token: verifyVercelToken,
+  cerebras_key: verifyCerebrasKey,
+  render_key: verifyRenderKey,
+  flyio_bearer_token: verifyFlyioBearerToken,
 };
 const SIMPLE_VERIFY_VENDOR_LABEL = {
   slack_token: "Slack's auth.test",
@@ -88,6 +110,10 @@ const SIMPLE_VERIFY_VENDOR_LABEL = {
   linear_key: "Linear's GraphQL API",
   telegram_bot_token: "Telegram's getMe endpoint",
   discord_webhook: "Discord's webhook-info endpoint",
+  vercel_token: "Vercel's user endpoint",
+  cerebras_key: "Cerebras's models endpoint",
+  render_key: "Render's owners endpoint",
+  flyio_bearer_token: "Fly.io's GraphQL API",
 };
 
 // Rule ids that findPairedSecret's window search applies to (see pairing.js):
@@ -241,11 +267,15 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // call; nothing in it is ever written to a finding until verification has
   // REPLACED the raw values with a status string.
   const pendingAwsVerifications = new Map();
+  // Same shape as pendingAwsVerifications, for PlanetScale's paired
+  // credential (see the planetscale_secret match branch below): keyed by
+  // the secret value (the confirmed, prefixed anchor) -> { idValue, refs }.
+  const pendingPlanetScaleVerifications = new Map();
   // --verify only (see verify.js): ruleId -> (token value -> { refs }), for
-  // every SIMPLE_VERIFY_FNS vendor. Unlike AWS, none of these need pairing
-  // (the token itself is the complete credential), so this is simpler: one
-  // entry per distinct value per rule, `refs` accumulating every finding
-  // object that value produced.
+  // every SIMPLE_VERIFY_FNS vendor. Unlike AWS/PlanetScale, none of these
+  // need pairing (the token itself is the complete credential), so this is
+  // simpler: one entry per distinct value per rule, `refs` accumulating
+  // every finding object that value produced.
   const pendingSimpleVerifications = new Map();
 
   // One place raw matched text turns into a recorded finding: counts the
@@ -343,6 +373,32 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
               }
             }
           }
+          // PlanetScale: the opposite pairing direction from AWS (see
+          // pairing.js's findNearbyCandidate) — the SECRET is the
+          // confirmed, prefixed anchor here, and the unprefixed id is the
+          // nearby candidate. Uses the generic pairedOtherPreview/
+          // pairedOtherLabel fields rather than AWS's pairedSecretPreview/
+          // pairedAccessKeyPreview, since neither of those names fits ("the
+          // secret is paired with an id", not a second secret or an access
+          // key) — a future paired vendor reuses these same generic fields
+          // rather than growing a new AWS-shaped pair each time.
+          let planetScaleIdFinding = null;
+          let rawPlanetScaleId = null;
+          if (!suppressedReason && rule.id === "planetscale_secret") {
+            const pairedId = findNearbyCandidate(line, m[0], m.index, PLANETSCALE_ID_RE, PLANETSCALE_PAIR_WINDOW);
+            if (pairedId) {
+              const idSuppressedReason = suppressionReason(pairedId, null);
+              if (idSuppressedReason && !includeSuppressed) {
+                suppressedCount++;
+              } else {
+                rawPlanetScaleId = pairedId;
+                planetScaleIdFinding = record({ id: "planetscale_id", label: "PlanetScale service token id (paired with secret)" },
+                  pairedId, relFile, file, lineNo, mtimeMs,
+                  idSuppressedReason ? "low" : "high", idSuppressedReason,
+                  { paired: true, pairedOtherPreview: redact(m[0]), pairedOtherLabel: "secret" });
+              }
+            }
+          }
           // Local, offline JWT expiry (see jwtExpiry.js): only ever reads
           // the `exp` claim out of the decoded payload, nothing else, and
           // only for the unsuppressed default `jwt` rule, since a
@@ -354,7 +410,11 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             mtimeMs,
             resolveConfidence(rule.id, m[0], rule.confidence, suppressedReason),
             suppressedReason,
-            { ...(pairedSecretPreview ? { pairedSecretPreview } : {}), ...(jwtExtra || {}) });
+            {
+              ...(pairedSecretPreview ? { pairedSecretPreview } : {}),
+              ...(planetScaleIdFinding ? { pairedOtherPreview: redact(rawPlanetScaleId), pairedOtherLabel: "id" } : {}),
+              ...(jwtExtra || {}),
+            });
 
           // --verify only, and only for a DEMONSTRATED pair (both halves
           // present, neither suppressed): queue it for the verification pass
@@ -371,6 +431,15 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
             const entry = pendingAwsVerifications.get(m[0]);
             if (entry) entry.refs.push({ akiaFinding: primaryFinding, secretFinding });
           }
+          // --verify, PlanetScale: same dedup-by-anchor-value shape as AWS
+          // above, keyed by the secret (the confirmed anchor) this time.
+          if (verify && planetScaleIdFinding && rawPlanetScaleId) {
+            if (!pendingPlanetScaleVerifications.has(m[0]) && pendingPlanetScaleVerifications.size < MAX_VERIFICATIONS_PER_VENDOR) {
+              pendingPlanetScaleVerifications.set(m[0], { idValue: rawPlanetScaleId, refs: [] });
+            }
+            const psEntry = pendingPlanetScaleVerifications.get(m[0]);
+            if (psEntry) psEntry.refs.push({ secretFinding: primaryFinding, idFinding: planetScaleIdFinding });
+          }
           // --verify, single-token vendors (Slack, OpenAI, Anthropic,
           // GitHub): none of these need pairing (the value IS the complete
           // credential), so queue every unsuppressed match directly, same
@@ -559,7 +628,7 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
   // separator, a real rendering bug caught live. Only called when there is
   // actually something to verify, so a plain --verify with nothing to check
   // never clears a spinner line for no reason.
-  const anyPending = pendingAwsVerifications.size > 0 ||
+  const anyPending = pendingAwsVerifications.size > 0 || pendingPlanetScaleVerifications.size > 0 ||
     [...pendingSimpleVerifications.values()].some((byValue) => byValue.size > 0);
   if (verify && anyPending && typeof onBeforeVerify === "function") onBeforeVerify();
 
@@ -598,6 +667,17 @@ async function scan({ sources, includeNoisy = false, includeSuppressed = false,
       }
     }
   }
+  if (verify && pendingPlanetScaleVerifications.size > 0) {
+    process.stderr.write(
+      `residoo --verify: calling PlanetScale's organizations endpoint for ${pendingPlanetScaleVerifications.size} ` +
+      "credential(s) found in this scan. This is a real network request to PlanetScale, using the exact " +
+      "credential found in your transcript, one at a time.\n"
+    );
+    for (const [secretValue, { idValue, refs }] of pendingPlanetScaleVerifications) {
+      const result = await verifyPlanetScaleToken(idValue, secretValue);
+      for (const ref of refs) applyVerifyResult([ref.secretFinding, ref.idFinding], result);
+    }
+  }
   if (verify) {
     for (const [ruleId, byValue] of pendingSimpleVerifications) {
       if (byValue.size === 0) continue;

package/src/verify.js

@@ -289,16 +289,22 @@ function verifyGithubToken(token, opts) {
 //   - Cohere, Mistral, Together AI, Fireworks, DeepSeek: not detected in
 //     the first place (see patterns.js's own comment on this), so wiring a
 //     verifier would be dead code — verification needs detection first.
-//   - PlanetScale, Fly.io: real, confirmed endpoints, deliberately deferred
-//     rather than rushed. PlanetScale's auth header needs BOTH the token
-//     id and the secret together, a paired-credential shape residoo has no
-//     detection rule for (only the secret's pscale_tkn_ prefix is
-//     detected). Fly.io needs one of two different Authorization header
-//     schemes depending on which of two token prefixes was found (a plain
-//     Bearer header for one, the literal string "FlyV1 <token>" for the
-//     other) layered on top of a GraphQL body check — real, but more
-//     engineering than the rest of this batch, better done as its own
-//     careful pass than folded in here.
+//   - Linode / Akamai Cloud: researched twice, ruled out both times, the
+//     second time more conclusively than the first: its own OpenAPI schema
+//     documents the token as a bare opaque string with no prefix
+//     whatsoever, not merely an undocumented one, so this is not something
+//     a future docs update could fix.
+// Two vendors that were deferred in an earlier pass are no longer on this
+// list, once their real formats or engineering were worked out: PlanetScale
+// (see verifyPlanetScaleToken below and pairing.js's findNearbyCandidate,
+// generalized from AWS's own pairing mechanism to cover its id/secret
+// pair) and Fly.io's fo1_ token family (see verifyFlyioBearerToken below).
+// Fly.io's OTHER token family, fm1a_/fm1r_/fm2_ "macaroons," stays
+// undetected: caught live on this project's own real-machine testing, that
+// shape's short prefix plus a wide, unstructured base64 body produced
+// dozens of apparent matches inside an unrelated real file that just
+// happened to contain a lot of embedded base64 data. See patterns.js's own
+// comment on flyio_bearer_token for the measured false-positive rate.
 
 function huggingfaceUrl() { return process.env.RESIDOO_TEST_HUGGINGFACE_API_URL || "https://huggingface.co/api/whoami-v2"; }
 function sendgridUrl() { return process.env.RESIDOO_TEST_SENDGRID_API_URL || "https://api.sendgrid.com/v3/scopes"; }
@@ -412,6 +418,67 @@ function verifyNetlifyToken(token, opts) {
   return verifyByStatusCode("Netlify", netlifyUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
 }
 
+function planetscaleUrl() { return process.env.RESIDOO_TEST_PLANETSCALE_API_URL || "https://api.planetscale.com/v1/organizations"; }
+/**
+ * PlanetScale: a paired credential (like AWS), not a single token — the
+ * Authorization header is the literal "<id>:<token>", no Bearer/Basic
+ * prefix, verbatim from PlanetScale's own docs' curl example.
+ */
+function verifyPlanetScaleToken(id, secret, opts) {
+  return verifyByStatusCode("PlanetScale", planetscaleUrl(), () => ({ Authorization: `${id}:${secret}` }), opts);
+}
+
+function vercelUrl() { return process.env.RESIDOO_TEST_VERCEL_API_URL || "https://api.vercel.com/v2/user"; }
+function verifyVercelToken(token, opts) {
+  return verifyByStatusCode("Vercel", vercelUrl(), () => ({ Authorization: `Bearer ${token}` }), opts);
+}
+
+function cerebrasUrl() { return process.env.RESIDOO_TEST_CEREBRAS_API_URL || "https://api.cerebras.ai/v1/models"; }
+function verifyCerebrasKey(key, opts) {
+  return verifyByStatusCode("Cerebras", cerebrasUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+
+function renderUrl() { return process.env.RESIDOO_TEST_RENDER_API_URL || "https://api.render.com/v1/owners"; }
+function verifyRenderKey(key, opts) {
+  return verifyByStatusCode("Render", renderUrl(), () => ({ Authorization: `Bearer ${key}` }), opts);
+}
+
+function flyioUrl() { return process.env.RESIDOO_TEST_FLYIO_API_URL || "https://api.fly.io/graphql"; }
+/**
+ * Fly.io: one GraphQL endpoint, Bearer header (the scheme flyctl-issued
+ * fo1_ tokens use; Fly's other token family, fm1a_/fm1r_/fm2_ "macaroons",
+ * uses a different literal "FlyV1 <token>" scheme instead, but that family
+ * is not detected — see patterns.js's own comment on why). Like Linear, a
+ * GraphQL 200 can still carry an auth failure in the body, so this checks
+ * for a populated data.viewer instead of trusting the status code alone,
+ * except for 401, which Fly's own API does use for an outright missing or
+ * malformed token.
+ */
+async function verifyFlyioBearerToken(token, { fetchFn = fetch, timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  let res;
+  try {
+    res = await fetchFn(flyioUrl(), {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ query: "{ viewer { email } }" }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (e) {
+    return { status: "error", detail: `could not reach Fly.io (${sanitizeDetail(e && e.message)})` };
+  }
+  if (res.status === 401) return { status: "invalid", detail: "Fly.io rejected this token (HTTP 401)" };
+  let body;
+  try {
+    body = await res.json();
+  } catch {
+    return { status: "error", detail: `Fly.io returned a non-JSON response (HTTP ${res.status})` };
+  }
+  if (body && body.data && body.data.viewer && body.data.viewer.email) {
+    return { status: "active", detail: "Fly.io accepted this token" };
+  }
+  return { status: "error", detail: `could not verify: ${sanitizeDetail(JSON.stringify(body && body.errors)).slice(0, 120) || `HTTP ${res.status}`}` };
+}
+
 /**
  * Linear: a GraphQL API, one POST endpoint for everything, not a plain GET.
  * A GraphQL server can answer HTTP 200 even for some authorization-level
@@ -489,4 +556,6 @@ module.exports = {
   verifyNotionToken, verifyGitlabToken, verifySupabaseToken, verifyElevenLabsKey,
   verifyCircleciToken, verifyAirtableToken, verifyCloudflareToken, verifyHerokuKey,
   verifyNetlifyToken, verifyLinearKey, verifyTelegramToken, verifyDiscordWebhook,
+  verifyPlanetScaleToken, verifyVercelToken, verifyCerebrasKey, verifyRenderKey,
+  verifyFlyioBearerToken,
 };