residoo 0.8.6 → 0.8.8

package/README.md

@@ -97,7 +97,7 @@ while losing rows, then fixed in public against the classes it was losing
 
 ## What it does
 
-- Scans your local AI-agent session transcripts for 59 high-confidence
+- Scans your local AI-agent session transcripts for 79 high-confidence
   secret patterns: cloud provider keys, private key blocks, OAuth/API
   tokens, database connection strings, and more. See
   [`src/patterns.js`](src/patterns.js).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.8.6",
+  "version": "0.8.8",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/patterns.js

@@ -33,6 +33,17 @@ const PATTERNS = [
     re: /\b(?:gh[pousr]_|github_pat_)[A-Za-z0-9_.-]{20,600}\b/g },
   { id: "gitlab_pat", label: "GitLab personal access token", confidence: "high",
     re: /\bglpat-[A-Za-z0-9_-]{20,100}\b/g },
+  // GitLab's OTHER token kinds, beyond the personal access token above --
+  // deploy, runner, CI/CD job, trigger, feed, incoming-mail, agent,
+  // workspace, SCIM, feature-flags-client, and OAuth-app-secret tokens.
+  // All prefixes taken directly from GitLab's own published table
+  // (docs.gitlab.com/security/tokens/), which gives every prefix but no
+  // exact body length for any of them -- one bundled rule rather than
+  // eleven near-identical ones, since they share the same risk profile
+  // (repo/registry/CI access) and the same rotation path (Settings >
+  // Access Tokens for the relevant scope).
+  { id: "gitlab_other_token", label: "GitLab token (deploy/runner/CI/other)", confidence: "high",
+    re: /\bgl(?:oas|dt|rtr|rt|cbt|ptt|ft|imt|agent|wt|soat|ffct)-[A-Za-z0-9_-]{16,100}\b/g },
   { id: "slack_token", label: "Slack token", confidence: "high",
     re: /\bxox[baprs]-[0-9A-Za-z-]{10,500}\b/g },
   { id: "stripe_key", label: "Stripe API key (live mode)", confidence: "high",
@@ -84,6 +95,29 @@ const PATTERNS = [
   // already excluded for Weights & Biases' classic key format.
   { id: "azure_ad_client_secret", label: "Azure AD (Entra ID) client secret", confidence: "high",
     re: /(?<![A-Za-z0-9_.~-])[A-Za-z0-9_.~]{2,4}\dQ~[A-Za-z0-9_.~-]{28,36}(?![A-Za-z0-9_.~-])/g },
+  // Azure DevOps PAT. Microsoft's own current docs (learn.microsoft.com,
+  // .../use-personal-access-tokens-to-authenticate, updated 2026-07-08)
+  // state: "Tokens are 84 characters long, with 52 characters being
+  // randomized data... Tokens issued by Azure DevOps include a fixed AZDO
+  // signature at positions 76-80." That description is imprecise about
+  // the exact byte offset (a 4-char literal can't cleanly occupy a
+  // 5-position range), so rather than hard-code a single offset that
+  // might be off by one and never match a real token, this allows a
+  // window for where AZDO can sit while still requiring both the fixed
+  // literal anchor and a close-to-84 overall length -- the anchor is what
+  // actually carries the false-positive protection.
+  { id: "azure_devops_pat", label: "Azure DevOps personal access token", confidence: "high",
+    re: /\b[A-Za-z0-9]{65,75}AZDO[A-Za-z0-9]{5,15}\b/g },
+  // Atlassian Cloud API token (classic/scoped). Prefix and structure from
+  // noseyparker's own shipped rule; independently confirmed current via
+  // an Atlassian staff reply on Atlassian's own community forum naming
+  // the three current token families and their prefixes (API Token:
+  // ATAT, App Password: ATBB, Access Tokens: ATCT) -- this rule covers
+  // only the first, most common one. The newer Access Token family
+  // (ATCTT3xFfGN0...) exists per that same staff reply but with no
+  // length/charset spec found anywhere, so it isn't guessed at here.
+  { id: "atlassian_api_token", label: "Atlassian Cloud API token", confidence: "high",
+    re: /\bATATT3xFfGF0[A-Za-z0-9_-]{20,200}=[0-9A-F]{8}\b/g },
   // Tailscale auth key. Found missing via gitleaks/gitleaks#1778 (still
   // open there too). No fully authoritative current spec found: Tailscale's
   // own kb/1085/auth-keys page shows an older bare "tskey-<hex>" example,
@@ -108,6 +142,32 @@ const PATTERNS = [
     re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
   { id: "npm_token", label: "npm access token", confidence: "high",
     re: /\bnpm_[A-Za-z0-9]{36}\b/g },
+  // Found via a competitor research pass mining noseyparker/ggshield/
+  // detect-secrets (2026-09-04). PyPI publishes its own regex directly
+  // (docs.pypi.org/api/secrets/): "pypi-[A-Za-z0-9-_]{85,}", no stated
+  // upper bound ("can be arbitrarily long") -- capped here at 700 as a
+  // practical ceiling, not a vendor limit.
+  { id: "pypi_token", label: "PyPI API token", confidence: "high",
+    re: /\bpypi-[A-Za-z0-9_-]{85,700}\b/g },
+  // Verified against crates.io's own current token-generation source
+  // (rust-lang/crates.io, crates/crates_io_database/src/utils/token.rs):
+  // TOKEN_PREFIX = "cio", TOKEN_LENGTH = 32, generated via
+  // rand::distr::Alphanumeric -- the strongest sourcing in this batch,
+  // read from the vendor's actual live code rather than its docs.
+  { id: "crates_io_key", label: "crates.io API token", confidence: "high",
+    re: /\bcio[A-Za-z0-9]{32}\b/g },
+  // Exact length independently counted against RubyGems' own guide
+  // (guides.rubygems.org/rubygems-org-api/), whose worked example shows
+  // the body as exactly 48 lowercase hex characters after the prefix.
+  { id: "rubygems_key", label: "RubyGems API key", confidence: "high",
+    re: /\brubygems_[a-f0-9]{48}\b/g },
+  // Docker's own OpenAPI spec (docker/docs, content/reference/api/
+  // ai-governance/api.yaml) names both prefixes explicitly -- Personal
+  // Access Token dckr_pat_*, Organization Access Token dckr_oat_* -- but
+  // gives no exact body length/charset for either, hence the generous
+  // bound already used elsewhere in this file for the same situation.
+  { id: "docker_hub_token", label: "Docker Hub access token", confidence: "high",
+    re: /\bdckr_(?:pat|oat)_[A-Za-z0-9_-]{20,200}\b/g },
   { id: "sendgrid_key", label: "SendGrid API key", confidence: "high",
     re: /\bSG\.[A-Za-z0-9_-]{16,100}\.[A-Za-z0-9_-]{16,100}\b/g },
   { id: "twilio_key", label: "Twilio API key", confidence: "high",
@@ -168,6 +228,50 @@ const PATTERNS = [
   // collide with any of them.
   { id: "elevenlabs_key", label: "ElevenLabs API key", confidence: "high",
     re: /\bsk_[a-f0-9]{48}\b/g },
+  // Third batch from the 2026-09-04 competitor research pass. NVIDIA's own
+  // docs (docs.nvidia.com) confirm the nvapi- prefix ("Keys typically start
+  // with nvapi-") without stating an exact length.
+  { id: "nvidia_api_key", label: "NVIDIA API key", confidence: "high",
+    re: /\bnvapi-[A-Za-z0-9_-]{40,200}\b/g },
+  // Jina AI: prefix confirmed via Jina's own GitHub org/SDKs and broad
+  // ecosystem documentation; exact 60-char length taken from noseyparker's
+  // own shipped rule, not independently pinned by a Jina spec page.
+  { id: "jina_key", label: "Jina AI API key", confidence: "high",
+    re: /\bjina_[A-Za-z0-9]{60}\b/g },
+  // Tavily: tvly- prefix confirmed via Tavily's own official SDK repos
+  // (tavily-python, tavily-js); exact 32-char length not independently
+  // pinned by a dedicated format spec page.
+  { id: "tavily_key", label: "Tavily API key", confidence: "high",
+    re: /\btvly-[A-Za-z0-9]{32}\b/g },
+  // Firecrawl: fc- prefix appears in Firecrawl's own docs and SDKs, but
+  // only as illustrative placeholders -- no page independently confirms
+  // the exact 32-lowercase-hex body. Shipped anyway on the combination of
+  // the prefix plus a strict hex-only body requirement right after it.
+  { id: "firecrawl_key", label: "Firecrawl API key", confidence: "high",
+    re: /\bfc-[a-f0-9]{32}\b/g },
+  // Databricks PAT: Databricks' own docs deliberately show only placeholder
+  // tokens, no real format. Corroborated by two independent secondary
+  // sources instead -- Microsoft Purview's own Sensitive-Information-Type
+  // definition for Azure Databricks PATs, and TruffleHog's shipped OSS
+  // detector -- both agreeing on dapi + 32 lowercase hex, optionally a
+  // trailing -<digits>. Not Databricks-primary-sourced, so flagged medium
+  // rather than high like the rest of this file. The strict lowercase-hex
+  // body avoids the one real collision risk found during research: Binance
+  // also uses a "dapi" naming convention for its COIN-margined futures API
+  // (e.g. dapiDataGetTopLongShortPositionRatio), but that never matches
+  // since it isn't hex.
+  { id: "databricks_pat", label: "Databricks personal access token", confidence: "medium",
+    re: /\bdapi[a-f0-9]{32}(?:-[0-9]+)?\b/g },
+  // Sourcegraph: sgp_ prefix confirmed via Sourcegraph's own docs ("Access
+  // tokens now begin with the prefix sgp_"); exact body shape (an optional
+  // 16-hex instance-id infix, or a local_ marker, before the 40-hex body)
+  // taken from noseyparker's worked examples, not independently pinned.
+  // NOTE for future additions: Segment's own "Public API Token" also uses
+  // an sgp_ prefix (sgp_[a-zA-Z0-9]{64}) -- not added here, but if it ever
+  // is, the two rules are already mutually exclusive (hex-only 40 vs.
+  // mixed-case 64), just worth testing explicitly at that point.
+  { id: "sourcegraph_token", label: "Sourcegraph access token", confidence: "high",
+    re: /\bsgp_(?:[a-fA-F0-9]{16}_|local_)?[a-fA-F0-9]{40}\b/g },
 
   // ── Cloud / infra ──────────────────────────────────────────────────────
   { id: "digitalocean_token", label: "DigitalOcean access token", confidence: "high",
@@ -307,6 +411,17 @@ const PATTERNS = [
   // ── Comms / SaaS ───────────────────────────────────────────────────────
   { id: "discord_webhook", label: "Discord webhook URL", confidence: "high",
     re: /\bhttps:\/\/discord\.com\/api\/webhooks\/[0-9]{18,19}\/[0-9a-zA-Z_-]{68}\b/g },
+  // Discord BOT token -- a different, more sensitive credential than the
+  // webhook URL above (full bot API access vs. a single channel post).
+  // Three dot-separated base64url segments, first starting with M/N/O
+  // (the base64 encoding of a Discord user-id snowflake's leading byte
+  // range). Confirmed via Discord's own current developer docs
+  // (docs.discord.com/developers/reference, shows a live example token in
+  // this exact shape); same structure as detect-secrets' own shipped
+  // plugin. Never collides with the jwt rule below since a JWT's first two
+  // segments must start with the literal "eyJ", not M/N/O.
+  { id: "discord_bot_token", label: "Discord bot token", confidence: "high",
+    re: /\b[MNO][A-Za-z0-9_-]{23,25}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}\b/g },
   { id: "telegram_bot_token", label: "Telegram bot token", confidence: "high",
     re: /\b[0-9]{8,10}:[a-zA-Z0-9_-]{35}\b/g },
   { id: "mailgun_key", label: "Mailgun API key", confidence: "high",
@@ -381,6 +496,49 @@ const PATTERNS = [
   // random-looking segment.
   { id: "resend_key", label: "Resend API key", confidence: "high",
     re: /\bre_[A-Za-z0-9]{6,12}_[A-Za-z0-9]{18,32}\b/g },
+  // Shopify Admin API access token: shpat_/shppa_ prefixes confirmed via
+  // Shopify's own current developer docs. Exact body length not stated on
+  // that page (a since-404'd Shopify changelog described it, quoted only
+  // by secondary sources), hence a generous floor/ceiling bound. Legacy
+  // shpca_/shpss_/shpua_ prefixes are real (Shopify community forum) but
+  // not on the current primary page, so left out here.
+  { id: "shopify_admin_token", label: "Shopify Admin API access token", confidence: "high",
+    re: /\bshp(?:at|pa)_[A-Za-z0-9]{32,40}\b/g },
+  // HubSpot private app token: HubSpot's own docs show only a masked
+  // example (pat-**-***...), corroborated by real (redacted) examples on
+  // HubSpot's own community forum showing the pat-<region>-<UUID-shaped
+  // body> structure. Medium confidence: the shape is real but the exact
+  // per-segment lengths are inferred, not vendor-pinned.
+  { id: "hubspot_token", label: "HubSpot private app access token", confidence: "medium",
+    re: /\bpat-[a-z]{2}\d-[a-f0-9-]{30,60}\b/gi },
+  // Grafana service account token: exact shape read directly off Grafana's
+  // own docs example token (grafana.com/docs/grafana/latest/administration/service-accounts/),
+  // not inferred -- two independently-random underscore-delimited segments
+  // behind a distinctive 5-char prefix.
+  { id: "grafana_service_account_token", label: "Grafana service account token", confidence: "high",
+    re: /\bglsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}\b/g },
+  // New Relic: NRAK- prefix confirmed via New Relic's own migration-notice
+  // doc ("If your API key starts with NRAK, no update is required").
+  // Exact body length/charset not published; generously bounded.
+  { id: "new_relic_api_key", label: "New Relic API key", confidence: "high",
+    re: /\bNRAK-[A-Z0-9]{27,64}\b/g },
+  // Mailchimp: 32 lowercase hex + a literal -us<datacenter digits> suffix,
+  // read directly off a live example in Mailchimp's own docs. The suffix
+  // is what makes this safe as a default rule -- a bare 32-hex string
+  // alone would be indistinguishable from countless unrelated hashes, but
+  // the specific "-usN" tail is Mailchimp-specific.
+  { id: "mailchimp_key", label: "Mailchimp API key", confidence: "high",
+    re: /\b[0-9a-f]{32}-us[0-9]{1,2}\b/g },
+  // Akamai EdgeGrid access_token / client_token: akab- prefix and the
+  // hyphen-separated two-segment shape confirmed via Akamai's own current
+  // docs (literal examples shown), independently corroborated by a
+  // detect-secrets maintainer's own reproduction. Neither source states
+  // hard segment-length bounds, so the ranges here are a reasonable
+  // envelope, not vendor-pinned. Akamai's client_secret was investigated
+  // and NOT added: no distinctive prefix in Akamai's own examples, the
+  // same bare/opaque shape already excluded elsewhere in this file.
+  { id: "akamai_edgegrid_token", label: "Akamai EdgeGrid token", confidence: "high",
+    re: /\bakab-[a-z0-9]{16,32}-[a-z0-9]{6,32}\b/g },
 ];
 
 /**

package/src/rotation.js

@@ -164,6 +164,19 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Rotate revokes the old token and issues its replacement in one step.",
   },
+  // docs.gitlab.com/security/tokens/ documents every token kind's own
+  // settings location; this rule bundles several, so the guidance points
+  // at the relevant scope's own settings rather than one fixed page.
+  gitlab_other_token: {
+    label: "GitLab token (deploy/runner/CI/other)",
+    consolePath: "GitLab > the relevant scope's Settings > Access Tokens (project Settings for deploy/CI-job/trigger tokens, group Settings for group-scoped ones, admin area for runner registration tokens)",
+    steps: [
+      "Identify which token kind leaked from its prefix (gldt- deploy, glrt-/glrtr- runner, glcbt- CI/CD job, glptt- trigger, and so on)",
+      "Revoke it from that scope's Access Tokens or Runners settings",
+      "Issue a replacement and update whatever used the old one (CI variable, deploy config, webhook)",
+    ],
+    revokeNote: "A CI/CD job token (glcbt-) is normally short-lived and scoped to a single pipeline run -- if this is one, confirm the run has already finished before treating it as urgent.",
+  },
   // Fetched https://docs.slack.dev/reference/methods/auth.revoke (2026-09-02):
   // "This method revokes an access token." (api.slack.com/methods/auth.revoke
   // now 302s here.) App-level management lives at api.slack.com/apps.
@@ -229,6 +242,32 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate. Prefer create-then-delete over delete-then-create if the app can tolerate two live secrets briefly -- it avoids an outage window for whatever depends on this secret.",
   },
+  // learn.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate
+  // (fetched 2026-09-04): PAT management lives under User settings in the
+  // Azure DevOps web UI, login-walled, hence the path in words.
+  azure_devops_pat: {
+    label: "Azure DevOps personal access token",
+    consolePath: "Azure DevOps > User settings (top right) > Personal access tokens",
+    steps: [
+      "Open Personal access tokens under User settings",
+      "Revoke the leaked token",
+      "Create a replacement with the narrowest scopes and a short expiry",
+    ],
+    revokeNote: "Revocation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // Atlassian's own community forum, staff reply (fetched 2026-09-04):
+  // confirms the token families and that revocation happens from the
+  // account's own API tokens page, login-walled.
+  atlassian_api_token: {
+    label: "Atlassian Cloud API token",
+    consolePath: "id.atlassian.com > Security > API tokens",
+    steps: [
+      "Open the API tokens page under account Security settings",
+      "Revoke the leaked token",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "This is a personal API token tied to the account that created it -- check that account's recent activity across every Atlassian product it has access to (Jira, Confluence, Bitbucket), not just one.",
+  },
   // Fetched tailscale.com/kb/1085/auth-keys (2026-09-04): exact console
   // path and the important revoke-vs-deauthorize distinction are quoted
   // from that page, not inferred.
@@ -294,6 +333,52 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Check your packages' recent publishes afterward: a leaked npm token is a supply-chain foothold, not just an account problem.",
   },
+  // docs.pypi.org/api/secrets/ (fetched 2026-09-04): PyPI documents its own
+  // token format on this page and links account management from there.
+  pypi_token: {
+    label: "PyPI API token",
+    rotateUrl: "https://docs.pypi.org/api/secrets/",
+    steps: [
+      "pypi.org > Account settings > API tokens",
+      "Remove the leaked token",
+      "Add a replacement scoped to a single project rather than the whole account, if possible",
+    ],
+    revokeNote: "Check the project's recent releases afterward: a leaked PyPI token is a supply-chain foothold, the same risk class as a leaked npm token.",
+  },
+  // crates.io's own token settings page; management is login-walled.
+  crates_io_key: {
+    label: "crates.io API token",
+    consolePath: "crates.io > Account Settings > API Tokens",
+    steps: [
+      "Open API Tokens under Account Settings",
+      "Revoke the leaked token",
+      "Create a replacement scoped as narrowly as crates.io's scope options allow",
+    ],
+    revokeNote: "Check the account's recent publishes afterward: a leaked crates.io token is a supply-chain foothold for every crate it can publish to.",
+  },
+  // RubyGems' own API dashboard; management is login-walled.
+  rubygems_key: {
+    label: "RubyGems API key",
+    consolePath: "rubygems.org > Edit Profile > API Keys",
+    steps: [
+      "Open API Keys under your profile",
+      "Revoke the leaked key",
+      "Create a replacement with the narrowest scopes (e.g. push-only, not yank/owner)",
+    ],
+    revokeNote: "Check the account's recent gem pushes afterward: a leaked RubyGems key is a supply-chain foothold for every gem it can publish to.",
+  },
+  // Docker's own OpenAPI docs name the two token kinds; management pages
+  // are login-walled.
+  docker_hub_token: {
+    label: "Docker Hub access token",
+    consolePath: "hub.docker.com > Account Settings > Security (or Organization Settings > Access Tokens for an OAT)",
+    steps: [
+      "Open the Security / Access Tokens page for the relevant account or organization",
+      "Delete the leaked token",
+      "Create a replacement with the narrowest read/write/delete permissions it needs",
+    ],
+    revokeNote: "An Organization Access Token (dckr_oat_) can reach every repo in that org -- treat a leak of one as broader than a leaked personal token.",
+  },
   // Fetched https://www.twilio.com/docs/sendgrid/ui/account-and-settings/api-keys
   // (2026-09-02): Settings > API Keys, action menu > Delete API Key,
   // delete-then-recreate as the regeneration flow.
@@ -487,6 +572,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "A key grants full account access (voices, generations, billing); deletion is immediate.",
   },
+  // docs.nvidia.com's own key-management pages point at build.nvidia.com
+  // for personal keys; login-walled, hence the path in words.
+  nvidia_api_key: {
+    label: "NVIDIA API key",
+    consolePath: "build.nvidia.com > your profile > API Keys",
+    steps: [
+      "Open API Keys under your NVIDIA Build profile",
+      "Delete the leaked key",
+      "Generate a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  jina_key: {
+    label: "Jina AI API key",
+    consolePath: "jina.ai > API keys (jina.ai/api-dashboard/key-manager)",
+    steps: [
+      "Open the API key manager",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  tavily_key: {
+    label: "Tavily API key",
+    consolePath: "app.tavily.com > API Keys",
+    steps: [
+      "Open API Keys in the Tavily dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  firecrawl_key: {
+    label: "Firecrawl API key",
+    consolePath: "firecrawl.dev dashboard > API Keys",
+    steps: [
+      "Open API Keys in the Firecrawl dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // Format is not Databricks-primary-sourced (see the comment in
+  // src/patterns.js), but the rotation location itself is confirmed
+  // directly from Databricks' own docs (docs.databricks.com/aws/en/dev-tools/auth/pat).
+  databricks_pat: {
+    label: "Databricks personal access token",
+    consolePath: "Databricks workspace > User Settings > Developer > Access tokens",
+    steps: [
+      "Open Access tokens under Developer settings in the workspace",
+      "Revoke the leaked token",
+      "Create a replacement with the shortest lifetime that works for your use case",
+    ],
+    revokeNote: "Revocation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  sourcegraph_token: {
+    label: "Sourcegraph access token",
+    rotateUrl: "https://sourcegraph.com/docs/cli/how-tos/creating_an_access_token",
+    steps: [
+      "Sourcegraph instance > user menu > Settings > Access tokens",
+      "Delete the leaked token",
+      "Create a replacement with the narrowest scopes it needs",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
 
   // ── Cloud / infra ─────────────────────────────────────────────────────
   // docs.digitalocean.com/reference/api/create-personal-access-token/
@@ -746,6 +896,18 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "The URL is the entire credential: anyone holding it can post to the channel until the webhook is deleted.",
   },
+  // docs.discord.com/developers/reference (fetched 2026-09-04): bot tokens
+  // are regenerated from the same Developer Portal page as the bot itself.
+  discord_bot_token: {
+    label: "Discord bot token",
+    rotateUrl: "https://docs.discord.com/developers/reference",
+    steps: [
+      "Discord Developer Portal > Applications > your app > Bot",
+      "Click Reset Token to invalidate the old one and issue a new one",
+      "Update whatever hosts the bot with the new token",
+    ],
+    revokeNote: "This is full bot API access, not a single-channel webhook -- resetting immediately disconnects the bot everywhere it's running until redeployed with the new token.",
+  },
   // Fetched https://core.telegram.org/bots/features (2026-09-02): "If your
   // existing token is compromised or you lost it for some reason, use the
   // /token command to generate a new one."
@@ -866,6 +1028,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
   },
+  // shopify.dev/docs/apps/build/authentication-authorization/access-tokens
+  shopify_admin_token: {
+    label: "Shopify Admin API access token",
+    rotateUrl: "https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens",
+    steps: [
+      "For a custom app: Shopify admin > Settings > Apps and sales channels > the app > uninstall/reinstall to reissue",
+      "For a public/private app: revoke access from the Partner Dashboard and reinstall",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "This token can read/write store data (orders, customers, products) depending on its scopes -- review recent admin activity, not just API logs.",
+  },
+  hubspot_token: {
+    label: "HubSpot private app access token",
+    consolePath: "HubSpot account > Settings > Integrations > Private Apps",
+    steps: [
+      "Open Private Apps under Integrations",
+      "Open the relevant app and rotate or delete its access token",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "Deletion/rotation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // grafana.com/docs/grafana/latest/administration/service-accounts/
+  grafana_service_account_token: {
+    label: "Grafana service account token",
+    rotateUrl: "https://grafana.com/docs/grafana/latest/administration/service-accounts/",
+    steps: [
+      "Administration > Users and access > Service accounts",
+      "Open the relevant service account and delete the leaked token",
+      "Add a replacement token and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // docs.newrelic.com's own migration notice confirms the NRAK prefix;
+  // key management itself is login-walled.
+  new_relic_api_key: {
+    label: "New Relic API key",
+    consolePath: "one.newrelic.com > API keys (under your user menu)",
+    steps: [
+      "Open API keys",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  mailchimp_key: {
+    label: "Mailchimp API key",
+    consolePath: "Mailchimp account > Profile > Extras > API keys",
+    steps: [
+      "Open API keys under Extras in your account profile",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // techdocs.akamai.com/developer/docs/authenticate-with-edgegrid
+  akamai_edgegrid_token: {
+    label: "Akamai EdgeGrid token",
+    rotateUrl: "https://techdocs.akamai.com/developer/docs/authenticate-with-edgegrid",
+    steps: [
+      "Akamai Control Center > Identity & access management > API clients",
+      "Open the relevant API client and deactivate/delete the leaked credential",
+      "Create a replacement client credential and update whatever used the old one",
+    ],
+    revokeNote: "Deactivation is immediate; anything still using the old credential starts failing authentication at once.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {