residoo 0.8.7 → 0.8.8

package/README.md

@@ -97,7 +97,7 @@ while losing rows, then fixed in public against the classes it was losing
 
 ## What it does
 
-- Scans your local AI-agent session transcripts for 67 high-confidence
+- Scans your local AI-agent session transcripts for 79 high-confidence
   secret patterns: cloud provider keys, private key blocks, OAuth/API
   tokens, database connection strings, and more. See
   [`src/patterns.js`](src/patterns.js).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.8.7",
+  "version": "0.8.8",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/patterns.js

@@ -228,6 +228,50 @@ const PATTERNS = [
   // collide with any of them.
   { id: "elevenlabs_key", label: "ElevenLabs API key", confidence: "high",
     re: /\bsk_[a-f0-9]{48}\b/g },
+  // Third batch from the 2026-09-04 competitor research pass. NVIDIA's own
+  // docs (docs.nvidia.com) confirm the nvapi- prefix ("Keys typically start
+  // with nvapi-") without stating an exact length.
+  { id: "nvidia_api_key", label: "NVIDIA API key", confidence: "high",
+    re: /\bnvapi-[A-Za-z0-9_-]{40,200}\b/g },
+  // Jina AI: prefix confirmed via Jina's own GitHub org/SDKs and broad
+  // ecosystem documentation; exact 60-char length taken from noseyparker's
+  // own shipped rule, not independently pinned by a Jina spec page.
+  { id: "jina_key", label: "Jina AI API key", confidence: "high",
+    re: /\bjina_[A-Za-z0-9]{60}\b/g },
+  // Tavily: tvly- prefix confirmed via Tavily's own official SDK repos
+  // (tavily-python, tavily-js); exact 32-char length not independently
+  // pinned by a dedicated format spec page.
+  { id: "tavily_key", label: "Tavily API key", confidence: "high",
+    re: /\btvly-[A-Za-z0-9]{32}\b/g },
+  // Firecrawl: fc- prefix appears in Firecrawl's own docs and SDKs, but
+  // only as illustrative placeholders -- no page independently confirms
+  // the exact 32-lowercase-hex body. Shipped anyway on the combination of
+  // the prefix plus a strict hex-only body requirement right after it.
+  { id: "firecrawl_key", label: "Firecrawl API key", confidence: "high",
+    re: /\bfc-[a-f0-9]{32}\b/g },
+  // Databricks PAT: Databricks' own docs deliberately show only placeholder
+  // tokens, no real format. Corroborated by two independent secondary
+  // sources instead -- Microsoft Purview's own Sensitive-Information-Type
+  // definition for Azure Databricks PATs, and TruffleHog's shipped OSS
+  // detector -- both agreeing on dapi + 32 lowercase hex, optionally a
+  // trailing -<digits>. Not Databricks-primary-sourced, so flagged medium
+  // rather than high like the rest of this file. The strict lowercase-hex
+  // body avoids the one real collision risk found during research: Binance
+  // also uses a "dapi" naming convention for its COIN-margined futures API
+  // (e.g. dapiDataGetTopLongShortPositionRatio), but that never matches
+  // since it isn't hex.
+  { id: "databricks_pat", label: "Databricks personal access token", confidence: "medium",
+    re: /\bdapi[a-f0-9]{32}(?:-[0-9]+)?\b/g },
+  // Sourcegraph: sgp_ prefix confirmed via Sourcegraph's own docs ("Access
+  // tokens now begin with the prefix sgp_"); exact body shape (an optional
+  // 16-hex instance-id infix, or a local_ marker, before the 40-hex body)
+  // taken from noseyparker's worked examples, not independently pinned.
+  // NOTE for future additions: Segment's own "Public API Token" also uses
+  // an sgp_ prefix (sgp_[a-zA-Z0-9]{64}) -- not added here, but if it ever
+  // is, the two rules are already mutually exclusive (hex-only 40 vs.
+  // mixed-case 64), just worth testing explicitly at that point.
+  { id: "sourcegraph_token", label: "Sourcegraph access token", confidence: "high",
+    re: /\bsgp_(?:[a-fA-F0-9]{16}_|local_)?[a-fA-F0-9]{40}\b/g },
 
   // ── Cloud / infra ──────────────────────────────────────────────────────
   { id: "digitalocean_token", label: "DigitalOcean access token", confidence: "high",
@@ -452,6 +496,49 @@ const PATTERNS = [
   // random-looking segment.
   { id: "resend_key", label: "Resend API key", confidence: "high",
     re: /\bre_[A-Za-z0-9]{6,12}_[A-Za-z0-9]{18,32}\b/g },
+  // Shopify Admin API access token: shpat_/shppa_ prefixes confirmed via
+  // Shopify's own current developer docs. Exact body length not stated on
+  // that page (a since-404'd Shopify changelog described it, quoted only
+  // by secondary sources), hence a generous floor/ceiling bound. Legacy
+  // shpca_/shpss_/shpua_ prefixes are real (Shopify community forum) but
+  // not on the current primary page, so left out here.
+  { id: "shopify_admin_token", label: "Shopify Admin API access token", confidence: "high",
+    re: /\bshp(?:at|pa)_[A-Za-z0-9]{32,40}\b/g },
+  // HubSpot private app token: HubSpot's own docs show only a masked
+  // example (pat-**-***...), corroborated by real (redacted) examples on
+  // HubSpot's own community forum showing the pat-<region>-<UUID-shaped
+  // body> structure. Medium confidence: the shape is real but the exact
+  // per-segment lengths are inferred, not vendor-pinned.
+  { id: "hubspot_token", label: "HubSpot private app access token", confidence: "medium",
+    re: /\bpat-[a-z]{2}\d-[a-f0-9-]{30,60}\b/gi },
+  // Grafana service account token: exact shape read directly off Grafana's
+  // own docs example token (grafana.com/docs/grafana/latest/administration/service-accounts/),
+  // not inferred -- two independently-random underscore-delimited segments
+  // behind a distinctive 5-char prefix.
+  { id: "grafana_service_account_token", label: "Grafana service account token", confidence: "high",
+    re: /\bglsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}\b/g },
+  // New Relic: NRAK- prefix confirmed via New Relic's own migration-notice
+  // doc ("If your API key starts with NRAK, no update is required").
+  // Exact body length/charset not published; generously bounded.
+  { id: "new_relic_api_key", label: "New Relic API key", confidence: "high",
+    re: /\bNRAK-[A-Z0-9]{27,64}\b/g },
+  // Mailchimp: 32 lowercase hex + a literal -us<datacenter digits> suffix,
+  // read directly off a live example in Mailchimp's own docs. The suffix
+  // is what makes this safe as a default rule -- a bare 32-hex string
+  // alone would be indistinguishable from countless unrelated hashes, but
+  // the specific "-usN" tail is Mailchimp-specific.
+  { id: "mailchimp_key", label: "Mailchimp API key", confidence: "high",
+    re: /\b[0-9a-f]{32}-us[0-9]{1,2}\b/g },
+  // Akamai EdgeGrid access_token / client_token: akab- prefix and the
+  // hyphen-separated two-segment shape confirmed via Akamai's own current
+  // docs (literal examples shown), independently corroborated by a
+  // detect-secrets maintainer's own reproduction. Neither source states
+  // hard segment-length bounds, so the ranges here are a reasonable
+  // envelope, not vendor-pinned. Akamai's client_secret was investigated
+  // and NOT added: no distinctive prefix in Akamai's own examples, the
+  // same bare/opaque shape already excluded elsewhere in this file.
+  { id: "akamai_edgegrid_token", label: "Akamai EdgeGrid token", confidence: "high",
+    re: /\bakab-[a-z0-9]{16,32}-[a-z0-9]{6,32}\b/g },
 ];
 
 /**

package/src/rotation.js

@@ -572,6 +572,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "A key grants full account access (voices, generations, billing); deletion is immediate.",
   },
+  // docs.nvidia.com's own key-management pages point at build.nvidia.com
+  // for personal keys; login-walled, hence the path in words.
+  nvidia_api_key: {
+    label: "NVIDIA API key",
+    consolePath: "build.nvidia.com > your profile > API Keys",
+    steps: [
+      "Open API Keys under your NVIDIA Build profile",
+      "Delete the leaked key",
+      "Generate a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  jina_key: {
+    label: "Jina AI API key",
+    consolePath: "jina.ai > API keys (jina.ai/api-dashboard/key-manager)",
+    steps: [
+      "Open the API key manager",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  tavily_key: {
+    label: "Tavily API key",
+    consolePath: "app.tavily.com > API Keys",
+    steps: [
+      "Open API Keys in the Tavily dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  firecrawl_key: {
+    label: "Firecrawl API key",
+    consolePath: "firecrawl.dev dashboard > API Keys",
+    steps: [
+      "Open API Keys in the Firecrawl dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // Format is not Databricks-primary-sourced (see the comment in
+  // src/patterns.js), but the rotation location itself is confirmed
+  // directly from Databricks' own docs (docs.databricks.com/aws/en/dev-tools/auth/pat).
+  databricks_pat: {
+    label: "Databricks personal access token",
+    consolePath: "Databricks workspace > User Settings > Developer > Access tokens",
+    steps: [
+      "Open Access tokens under Developer settings in the workspace",
+      "Revoke the leaked token",
+      "Create a replacement with the shortest lifetime that works for your use case",
+    ],
+    revokeNote: "Revocation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  sourcegraph_token: {
+    label: "Sourcegraph access token",
+    rotateUrl: "https://sourcegraph.com/docs/cli/how-tos/creating_an_access_token",
+    steps: [
+      "Sourcegraph instance > user menu > Settings > Access tokens",
+      "Delete the leaked token",
+      "Create a replacement with the narrowest scopes it needs",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
 
   // ── Cloud / infra ─────────────────────────────────────────────────────
   // docs.digitalocean.com/reference/api/create-personal-access-token/
@@ -963,6 +1028,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
   },
+  // shopify.dev/docs/apps/build/authentication-authorization/access-tokens
+  shopify_admin_token: {
+    label: "Shopify Admin API access token",
+    rotateUrl: "https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens",
+    steps: [
+      "For a custom app: Shopify admin > Settings > Apps and sales channels > the app > uninstall/reinstall to reissue",
+      "For a public/private app: revoke access from the Partner Dashboard and reinstall",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "This token can read/write store data (orders, customers, products) depending on its scopes -- review recent admin activity, not just API logs.",
+  },
+  hubspot_token: {
+    label: "HubSpot private app access token",
+    consolePath: "HubSpot account > Settings > Integrations > Private Apps",
+    steps: [
+      "Open Private Apps under Integrations",
+      "Open the relevant app and rotate or delete its access token",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "Deletion/rotation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // grafana.com/docs/grafana/latest/administration/service-accounts/
+  grafana_service_account_token: {
+    label: "Grafana service account token",
+    rotateUrl: "https://grafana.com/docs/grafana/latest/administration/service-accounts/",
+    steps: [
+      "Administration > Users and access > Service accounts",
+      "Open the relevant service account and delete the leaked token",
+      "Add a replacement token and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // docs.newrelic.com's own migration notice confirms the NRAK prefix;
+  // key management itself is login-walled.
+  new_relic_api_key: {
+    label: "New Relic API key",
+    consolePath: "one.newrelic.com > API keys (under your user menu)",
+    steps: [
+      "Open API keys",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  mailchimp_key: {
+    label: "Mailchimp API key",
+    consolePath: "Mailchimp account > Profile > Extras > API keys",
+    steps: [
+      "Open API keys under Extras in your account profile",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // techdocs.akamai.com/developer/docs/authenticate-with-edgegrid
+  akamai_edgegrid_token: {
+    label: "Akamai EdgeGrid token",
+    rotateUrl: "https://techdocs.akamai.com/developer/docs/authenticate-with-edgegrid",
+    steps: [
+      "Akamai Control Center > Identity & access management > API clients",
+      "Open the relevant API client and deactivate/delete the leaked credential",
+      "Create a replacement client credential and update whatever used the old one",
+    ],
+    revokeNote: "Deactivation is immediate; anything still using the old credential starts failing authentication at once.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {