residoo 0.8.2 → 0.8.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/patterns.js

@@ -272,6 +272,31 @@ const PATTERNS = [
   // than a doc-confirmed exact count.
   { id: "posthog_key", label: "PostHog personal API key", confidence: "high",
     re: /\bphx_[A-Za-z0-9]{40,}\b/g },
+  // LangSmith personal access token (lsv2_pt_) / service key (lsv2_sk_).
+  // Found missing by cross-checking agentsweep's own open-issue tracker.
+  // The first segment (32 hex, UUID-shaped) is consistent across every
+  // real example checked (docs.langchain.com and independent citations of
+  // it); the trailing segment's exact length is NOT confirmed by any
+  // primary source found (two secondary citations of the same example
+  // key disagreed by one character), so it's a generous bound, not a
+  // doc-confirmed exact count -- same honesty standard as posthog_key
+  // above. "lsv2_" itself is distinctive enough that this bound doesn't
+  // meaningfully raise false-positive risk either way.
+  { id: "langsmith_key", label: "LangSmith API key", confidence: "high",
+    re: /\blsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{6,16}\b/g },
+  // Resend API key (re_). Found missing the same way. No primary source
+  // publishes an exact length spec; the one real example seen (Resend's
+  // own docs) is an 8-char id segment + a 24-char secret segment, both
+  // mixed-case alphanumeric, joined by one underscore. Bounded generously
+  // around that shape rather than pinned to it exactly. The two-segment,
+  // underscore-joined, both-high-entropy structure is deliberately what
+  // makes this safe as a DEFAULT (non-noisy) rule despite the short,
+  // otherwise-generic "re_" prefix: tested against realistic re_-prefixed
+  // code identifiers (re_try, re_send, re_connect, re_validate...) and
+  // none match, since none of them have a second underscore-delimited
+  // random-looking segment.
+  { id: "resend_key", label: "Resend API key", confidence: "high",
+    re: /\bre_[A-Za-z0-9]{6,12}_[A-Za-z0-9]{18,32}\b/g },
 ];
 
 /**

package/src/rotation.js

@@ -772,6 +772,32 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
   },
+  // Fetched docs.langchain.com/langsmith/create-account-api-key
+  // (2026-09-04): both personal access tokens and service keys are
+  // created and managed from the workspace's own API Keys settings page.
+  langsmith_key: {
+    label: "LangSmith API key",
+    consolePath: "smith.langchain.com > Settings > API Keys",
+    steps: [
+      "Open API Keys under the workspace's settings",
+      "Delete the leaked key (personal access token or service key)",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
+  },
+  // Fetched resend.com/docs/dashboard/api-keys/introduction (2026-09-04):
+  // keys are removed from the dashboard's API Keys list (More options ->
+  // Remove API key), or programmatically via the DELETE /api-keys endpoint.
+  resend_key: {
+    label: "Resend API key",
+    consolePath: "resend.com/api-keys",
+    steps: [
+      "Open the API Keys list in the Resend dashboard",
+      "Click More options on the leaked key, then Remove API key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {