residoo 0.8.7 → 0.9.0

package/README.md

@@ -97,7 +97,7 @@ while losing rows, then fixed in public against the classes it was losing
 
 ## What it does
 
-- Scans your local AI-agent session transcripts for 67 high-confidence
+- Scans your local AI-agent session transcripts for 79 high-confidence
   secret patterns: cloud provider keys, private key blocks, OAuth/API
   tokens, database connection strings, and more. See
   [`src/patterns.js`](src/patterns.js).
@@ -116,6 +116,9 @@ while losing rows, then fixed in public against the classes it was losing
 - Redacts everything in its own output, including `--json`: you get a
   shape and a first/last-4 preview, never the real value.
 - `--sarif` emits SARIF 2.1.0 for GitHub code scanning.
+- `--html [path]` writes a self-contained, filterable HTML report with a
+  rotation guide per finding — same redaction guarantee as every other
+  output, no external CSS/JS, nothing to open it needs the network.
 - `--seal --keychain` encrypts every transcript with a finding into a
   local vault. See [docs/architecture.md](docs/architecture.md#sealing-what-it-finds).
 - Tells you how many **distinct** secrets it found versus how many times
@@ -186,6 +189,8 @@ faith.
 residoo scan [options]
 
   --json                  machine-readable output (full detail, still redacted)
+  --html [path]           also write a self-contained HTML report (default:
+                          residoo-report-<stamp>.html); combines with --json
   --project [dir]         scan a repository checkout instead of this machine
                           (committed transcripts, agent configs, root .env)
   --include-noisy         also run broad, false-positive-prone rules

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "residoo",
-  "version": "0.8.7",
+  "version": "0.9.0",
   "description": "Find secrets leaking through your AI coding agent's session history. Zero network calls in the scan path, zero dependencies.",
   "license": "MIT",
   "author": "CloudRoam (https://cloudroam.io)",

package/src/cli.js

@@ -5,7 +5,7 @@ const fs = require("fs");
 const crypto = require("crypto");
 const { availableSources, ALL_SOURCES } = require("./sources");
 const { scan, emptyResult } = require("./scan");
-const { render, renderIntegrity, renderJson, renderSarif, makeProgressReporter, printIntro } = require("./report");
+const { render, renderIntegrity, renderJson, renderSarif, renderHtml, makeProgressReporter, printIntro } = require("./report");
 const { checkIntegrity } = require("./integrity");
 const {
   ROTATION_GUIDANCE, guidanceFor, loadAcks, loadDismissed, ackFinding, dismissFinding, renderRotation,
@@ -78,6 +78,15 @@ Scan options:
                           GitHub code scanning's Security tab and inline PR
                           annotations. Use --json for the full picture
                           (findings + integrity + rotation) instead.
+  --html [path]           also write a self-contained HTML report (default:
+                          residoo-report-<timestamp>.html in the current
+                          directory) -- a filterable table with a rotation
+                          guide per finding, safe to screenshot or share:
+                          same redacted preview as every other output, no
+                          raw value in any code path, no external CSS/JS/
+                          fonts, no network access needed to open it.
+                          Independent of --json/--sarif; can combine with
+                          either.
   --project [dir]         scan a repository checkout instead of this machine
                           (default dir: current directory). Covers committed
                           agent transcripts, agent config/rules files, and
@@ -340,6 +349,23 @@ async function resolveUnsealSecret(args, vaultDir) {
   }
 }
 
+// --html [path]: writes the self-contained HTML report to disk (default
+// residoo-report-<timestamp>.html in the cwd, same naming convention as
+// --seal's default vault dir) and prints where it went. Independent of
+// which stdout format was chosen (text/--json/--sarif), same relationship
+// --seal already has to those — this is a side effect, not another
+// mutually-exclusive output mode.
+function writeHtmlReport(result, integrity, rotation, args) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  // Bare --html is valid (auto-named), so the next token is only taken as a
+  // path when it doesn't itself look like another flag — same guard --project
+  // uses for the same reason.
+  const next = argValue(args, "--html");
+  const out = next && !next.startsWith("--") ? path.resolve(next) : path.resolve(`residoo-report-${stamp}.html`);
+  fs.writeFileSync(out, renderHtml(result, integrity, rotation));
+  process.stdout.write(`HTML report written to ${out}\n`);
+}
+
 async function runSeal(result, args) {
   const { sealFindings, uploadVaultToCloudRoam } = require("./sealvault");
 
@@ -955,6 +981,7 @@ async function main(argv) {
       // a planted repo-level hook in the CWD is exactly as dangerous here.
       if (integrity) process.stdout.write(renderIntegrity(integrity, { noColor }) + "\n");
     }
+    if (args.includes("--html")) writeHtmlReport(empty, integrity, renderRotation([], acks, dismissed), args);
     return failOnFind && integrityWarnCount(integrity) > 0 ? 1 : 0;
   }
 
@@ -984,6 +1011,8 @@ async function main(argv) {
     if (sealExit !== 0) return sealExit;
   }
 
+  if (args.includes("--html")) writeHtmlReport(result, integrity, rotation, args);
+
   // --allow-acked narrows the SECRET gate only: an acknowledged rotation says
   // nothing about a planted hook, so integrity warnings always fail. Without
   // the flag, acks change what the report says, never what CI does — a gate

package/src/patterns.js

@@ -228,6 +228,50 @@ const PATTERNS = [
   // collide with any of them.
   { id: "elevenlabs_key", label: "ElevenLabs API key", confidence: "high",
     re: /\bsk_[a-f0-9]{48}\b/g },
+  // Third batch from the 2026-09-04 competitor research pass. NVIDIA's own
+  // docs (docs.nvidia.com) confirm the nvapi- prefix ("Keys typically start
+  // with nvapi-") without stating an exact length.
+  { id: "nvidia_api_key", label: "NVIDIA API key", confidence: "high",
+    re: /\bnvapi-[A-Za-z0-9_-]{40,200}\b/g },
+  // Jina AI: prefix confirmed via Jina's own GitHub org/SDKs and broad
+  // ecosystem documentation; exact 60-char length taken from noseyparker's
+  // own shipped rule, not independently pinned by a Jina spec page.
+  { id: "jina_key", label: "Jina AI API key", confidence: "high",
+    re: /\bjina_[A-Za-z0-9]{60}\b/g },
+  // Tavily: tvly- prefix confirmed via Tavily's own official SDK repos
+  // (tavily-python, tavily-js); exact 32-char length not independently
+  // pinned by a dedicated format spec page.
+  { id: "tavily_key", label: "Tavily API key", confidence: "high",
+    re: /\btvly-[A-Za-z0-9]{32}\b/g },
+  // Firecrawl: fc- prefix appears in Firecrawl's own docs and SDKs, but
+  // only as illustrative placeholders -- no page independently confirms
+  // the exact 32-lowercase-hex body. Shipped anyway on the combination of
+  // the prefix plus a strict hex-only body requirement right after it.
+  { id: "firecrawl_key", label: "Firecrawl API key", confidence: "high",
+    re: /\bfc-[a-f0-9]{32}\b/g },
+  // Databricks PAT: Databricks' own docs deliberately show only placeholder
+  // tokens, no real format. Corroborated by two independent secondary
+  // sources instead -- Microsoft Purview's own Sensitive-Information-Type
+  // definition for Azure Databricks PATs, and TruffleHog's shipped OSS
+  // detector -- both agreeing on dapi + 32 lowercase hex, optionally a
+  // trailing -<digits>. Not Databricks-primary-sourced, so flagged medium
+  // rather than high like the rest of this file. The strict lowercase-hex
+  // body avoids the one real collision risk found during research: Binance
+  // also uses a "dapi" naming convention for its COIN-margined futures API
+  // (e.g. dapiDataGetTopLongShortPositionRatio), but that never matches
+  // since it isn't hex.
+  { id: "databricks_pat", label: "Databricks personal access token", confidence: "medium",
+    re: /\bdapi[a-f0-9]{32}(?:-[0-9]+)?\b/g },
+  // Sourcegraph: sgp_ prefix confirmed via Sourcegraph's own docs ("Access
+  // tokens now begin with the prefix sgp_"); exact body shape (an optional
+  // 16-hex instance-id infix, or a local_ marker, before the 40-hex body)
+  // taken from noseyparker's worked examples, not independently pinned.
+  // NOTE for future additions: Segment's own "Public API Token" also uses
+  // an sgp_ prefix (sgp_[a-zA-Z0-9]{64}) -- not added here, but if it ever
+  // is, the two rules are already mutually exclusive (hex-only 40 vs.
+  // mixed-case 64), just worth testing explicitly at that point.
+  { id: "sourcegraph_token", label: "Sourcegraph access token", confidence: "high",
+    re: /\bsgp_(?:[a-fA-F0-9]{16}_|local_)?[a-fA-F0-9]{40}\b/g },
 
   // ── Cloud / infra ──────────────────────────────────────────────────────
   { id: "digitalocean_token", label: "DigitalOcean access token", confidence: "high",
@@ -452,6 +496,49 @@ const PATTERNS = [
   // random-looking segment.
   { id: "resend_key", label: "Resend API key", confidence: "high",
     re: /\bre_[A-Za-z0-9]{6,12}_[A-Za-z0-9]{18,32}\b/g },
+  // Shopify Admin API access token: shpat_/shppa_ prefixes confirmed via
+  // Shopify's own current developer docs. Exact body length not stated on
+  // that page (a since-404'd Shopify changelog described it, quoted only
+  // by secondary sources), hence a generous floor/ceiling bound. Legacy
+  // shpca_/shpss_/shpua_ prefixes are real (Shopify community forum) but
+  // not on the current primary page, so left out here.
+  { id: "shopify_admin_token", label: "Shopify Admin API access token", confidence: "high",
+    re: /\bshp(?:at|pa)_[A-Za-z0-9]{32,40}\b/g },
+  // HubSpot private app token: HubSpot's own docs show only a masked
+  // example (pat-**-***...), corroborated by real (redacted) examples on
+  // HubSpot's own community forum showing the pat-<region>-<UUID-shaped
+  // body> structure. Medium confidence: the shape is real but the exact
+  // per-segment lengths are inferred, not vendor-pinned.
+  { id: "hubspot_token", label: "HubSpot private app access token", confidence: "medium",
+    re: /\bpat-[a-z]{2}\d-[a-f0-9-]{30,60}\b/gi },
+  // Grafana service account token: exact shape read directly off Grafana's
+  // own docs example token (grafana.com/docs/grafana/latest/administration/service-accounts/),
+  // not inferred -- two independently-random underscore-delimited segments
+  // behind a distinctive 5-char prefix.
+  { id: "grafana_service_account_token", label: "Grafana service account token", confidence: "high",
+    re: /\bglsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}\b/g },
+  // New Relic: NRAK- prefix confirmed via New Relic's own migration-notice
+  // doc ("If your API key starts with NRAK, no update is required").
+  // Exact body length/charset not published; generously bounded.
+  { id: "new_relic_api_key", label: "New Relic API key", confidence: "high",
+    re: /\bNRAK-[A-Z0-9]{27,64}\b/g },
+  // Mailchimp: 32 lowercase hex + a literal -us<datacenter digits> suffix,
+  // read directly off a live example in Mailchimp's own docs. The suffix
+  // is what makes this safe as a default rule -- a bare 32-hex string
+  // alone would be indistinguishable from countless unrelated hashes, but
+  // the specific "-usN" tail is Mailchimp-specific.
+  { id: "mailchimp_key", label: "Mailchimp API key", confidence: "high",
+    re: /\b[0-9a-f]{32}-us[0-9]{1,2}\b/g },
+  // Akamai EdgeGrid access_token / client_token: akab- prefix and the
+  // hyphen-separated two-segment shape confirmed via Akamai's own current
+  // docs (literal examples shown), independently corroborated by a
+  // detect-secrets maintainer's own reproduction. Neither source states
+  // hard segment-length bounds, so the ranges here are a reasonable
+  // envelope, not vendor-pinned. Akamai's client_secret was investigated
+  // and NOT added: no distinctive prefix in Akamai's own examples, the
+  // same bare/opaque shape already excluded elsewhere in this file.
+  { id: "akamai_edgegrid_token", label: "Akamai EdgeGrid token", confidence: "high",
+    re: /\bakab-[a-z0-9]{16,32}-[a-z0-9]{6,32}\b/g },
 ];
 
 /**

package/src/report.js

@@ -643,4 +643,202 @@ function renderSarif(result) {
   }, null, 2);
 }
 
-module.exports = { render, renderIntegrity, renderRotationSection, renderJson, renderSarif, makeProgressReporter, printIntro };
+function escapeHtml(s) {
+  return String(s == null ? "" : s)
+    .replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+const HTML_REPORT_STYLE = `
+:root { color-scheme: dark; --bg:#0d1117; --panel:#161b22; --border:#30363d; --text:#c9d1d9;
+  --dim:#8b949e; --red:#f85149; --yellow:#d29922; --green:#3fb950; --cyan:#58a6ff; --accent:#238636; }
+* { box-sizing: border-box; }
+body { margin:0; padding:32px; background:var(--bg); color:var(--text);
+  font:14px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif; }
+.wrap { max-width: 1100px; margin: 0 auto; }
+h1 { font-size:20px; margin:0 0 4px; }
+.meta { color:var(--dim); font-size:12px; margin-bottom:24px; }
+.cards { display:flex; gap:12px; flex-wrap:wrap; margin-bottom:24px; }
+.card { background:var(--panel); border:1px solid var(--border); border-radius:8px;
+  padding:14px 18px; min-width:140px; }
+.card .n { font-size:24px; font-weight:700; }
+.card .l { color:var(--dim); font-size:12px; margin-top:2px; }
+.clean { background:var(--panel); border:1px solid var(--accent); border-radius:8px;
+  padding:20px; color:var(--green); font-weight:600; }
+input#filter { width:100%; padding:10px 12px; margin-bottom:14px; background:var(--panel);
+  border:1px solid var(--border); border-radius:8px; color:var(--text); font-size:14px; }
+input#filter:focus { outline:1px solid var(--cyan); }
+table { width:100%; border-collapse:collapse; background:var(--panel); border:1px solid var(--border);
+  border-radius:8px; overflow:hidden; margin-bottom:24px; }
+th, td { text-align:left; padding:10px 12px; border-bottom:1px solid var(--border); font-size:13px; }
+th { color:var(--dim); font-weight:600; font-size:11px; text-transform:uppercase; letter-spacing:.03em; }
+tr:last-child td { border-bottom:none; }
+tr.row:hover { background:#1c232c; cursor:pointer; }
+.conf-high { color:var(--red); font-weight:600; } .conf-medium { color:var(--yellow); font-weight:600; }
+.conf-low { color:var(--dim); }
+.status-pending { color:var(--yellow); } .status-acked { color:var(--green); } .status-dismissed { color:var(--dim); }
+code.preview { font-family:ui-monospace,SFMono-Regular,Menlo,monospace; background:#0000004d;
+  padding:1px 6px; border-radius:4px; }
+.guide { display:none; background:#0000004d; padding:12px 16px; }
+.guide.open { display:table-row; }
+.guide td { border-bottom:1px solid var(--border); }
+.guide ol { margin:6px 0; padding-left:20px; }
+.guide a { color:var(--cyan); }
+.note { color:var(--dim); font-size:12px; margin-top:2px; }
+.section-title { font-size:15px; font-weight:600; margin:24px 0 10px; }
+.warn-badge { display:inline-block; background:#f8514922; color:var(--red); border:1px solid var(--red);
+  border-radius:4px; padding:1px 8px; font-size:11px; font-weight:600; margin-left:8px; }
+.footer { color:var(--dim); font-size:12px; margin-top:32px; border-top:1px solid var(--border); padding-top:16px; }
+`;
+
+const HTML_REPORT_SCRIPT = `
+document.getElementById("filter")?.addEventListener("input", function (e) {
+  var q = e.target.value.toLowerCase();
+  document.querySelectorAll("tr.row").forEach(function (row) {
+    var hit = row.getAttribute("data-search").includes(q);
+    row.style.display = hit ? "" : "none";
+    var g = row.nextElementSibling;
+    if (g && g.classList.contains("guide") && !hit) g.classList.remove("open");
+  });
+});
+document.querySelectorAll("tr.row").forEach(function (row) {
+  row.addEventListener("click", function () {
+    var g = row.nextElementSibling;
+    if (g && g.classList.contains("guide")) g.classList.toggle("open");
+  });
+});
+`;
+
+/**
+ * Self-contained, single-file HTML report (residoo scan --html). Same data
+ * as renderJson (findings deduped by rotation.js into distinct-value rows,
+ * plus integrity), presented for the audience --json/--sarif don't serve
+ * well: a screenshot for an incident channel, or a non-CLI teammate.
+ *
+ * Every value shown is `f.preview`/`entry.preview` — already redacted by
+ * patterns.js's redact() before it ever reaches this function, the same
+ * guarantee every other output format has. Unlike a competitor's own HTML
+ * report (which explicitly notes only its HTML mode masks values, and its
+ * JSON mode ships full raw secrets "for incident response"), residoo has
+ * no output mode, in any format, that ever writes a raw value — this
+ * function has no code path that could regress that, since it never
+ * receives the raw value in the first place.
+ *
+ * No external CSS/JS/fonts/images: everything is inlined below, so the
+ * file opens correctly with no network access, matching residoo's own
+ * "no network calls in the default path" posture for the report itself,
+ * not just the scan that produced it.
+ */
+function renderHtml(result, integrity = null, rotation = null) {
+  const { version } = require("../package.json");
+  const findings = result.findings || [];
+  const scannedAt = localTimestamp(new Date());
+  const distinct = rotation && rotation.counts ? rotation.counts.distinct : 0;
+  const pending = rotation && rotation.counts ? rotation.counts.pending : 0;
+  const confirmedDead = rotation && rotation.counts ? rotation.counts.confirmedDead || 0 : 0;
+  const needsReview = Math.max(0, pending - confirmedDead);
+  const byFile = new Set(findings.map((f) => f.file)).size;
+  const integrityWarns = integrity ? integrity.findings.filter((f) => f.severity === "warn").length : 0;
+
+  const head =
+    `<!doctype html><html><head><meta charset="utf-8">` +
+    `<meta name="viewport" content="width=device-width, initial-scale=1">` +
+    `<meta name="robots" content="noindex">` +
+    `<title>residoo report -- ${escapeHtml(scannedAt)}</title>` +
+    `<style>${HTML_REPORT_STYLE}</style></head><body><div class="wrap">` +
+    `<h1>residoo report</h1>` +
+    `<div class="meta">v${escapeHtml(version)} &middot; scanned ${escapeHtml(scannedAt)} &middot; ` +
+    `generated locally, never uploaded &mdash; safe to share, values below are redacted</div>`;
+
+  if (findings.length === 0) {
+    const body =
+      `<div class="clean">&#10003; No exposed secrets found: ${filesScannedLine(result)}</div>` +
+      (integrity ? renderIntegrityHtml(integrity) : "") +
+      `</div></body></html>`;
+    return head + body;
+  }
+
+  const cards =
+    `<div class="cards">` +
+    card(String(findings.length), `finding${findings.length === 1 ? "" : "s"} across ${byFile} file${byFile === 1 ? "" : "s"}`) +
+    card(String(distinct), `distinct value${distinct === 1 ? "" : "s"}`) +
+    card(String(needsReview), `need${needsReview === 1 ? "s" : ""} review`) +
+    card(String(result.filesScanned), "files scanned") +
+    `</div>`;
+
+  const rows = (rotation && rotation.entries ? [...rotation.entries] : [])
+    .sort((a, b) => b.occurrences - a.occurrences)
+    .map((e) => rotationRowHtml(e))
+    .join("");
+
+  const table =
+    `<input id="filter" type="text" placeholder="Filter by rule, file, or preview...">` +
+    `<table><thead><tr><th>Rule</th><th>Status</th><th>Preview</th><th>Seen</th><th>Files</th></tr></thead>` +
+    `<tbody>${rows}</tbody></table>`;
+
+  const integritySection = integrity
+    ? `<div class="section-title">Integrity checks${integrityWarns > 0 ? `<span class="warn-badge">${integrityWarns} warning${integrityWarns === 1 ? "" : "s"}</span>` : ""}</div>` +
+      renderIntegrityHtml(integrity)
+    : "";
+
+  const footer =
+    `<div class="footer">Values are redacted (first/last 4 characters only). Nothing in this file, or in the scan` +
+    ` that produced it, ever left this machine. Generated by <code class="preview">residoo scan --html</code> --` +
+    ` github.com/dandovdub/residoo</div>`;
+
+  return head + cards + table + integritySection + footer + `<script>${HTML_REPORT_SCRIPT}</script></div></body></html>`;
+}
+
+function card(n, label) {
+  return `<div class="card"><div class="n">${escapeHtml(n)}</div><div class="l">${escapeHtml(label)}</div></div>`;
+}
+
+function filesScannedLine(result) {
+  return `${result.filesScanned} file${result.filesScanned === 1 ? "" : "s"} scanned across ${(result.sourcesScanned || []).join(", ") || "no sources"}`;
+}
+
+const HTML_STATUS_LABEL = { pending: "pending", acked: "rotated", dismissed: "dismissed" };
+
+function rotationRowHtml(e) {
+  const search = escapeHtml(`${e.label} ${e.ruleId} ${e.preview} ${(e.files || []).join(" ")}`.toLowerCase());
+  const filesShown = (e.files || []).slice(0, 3).map((f) => safeBasename(f));
+  const moreFiles = (e.files || []).length - filesShown.length;
+  const g = e.guidance || {};
+  const link = g.rotateUrl
+    ? `<a href="${escapeHtml(g.rotateUrl)}" target="_blank" rel="noopener">${escapeHtml(g.rotateUrl)}</a>`
+    : escapeHtml(g.consolePath || "");
+  const steps = (g.steps || []).map((s) => `<li>${escapeHtml(s)}</li>`).join("");
+  return (
+    `<tr class="row" data-search="${search}">` +
+    `<td>${escapeHtml(e.label)}</td>` +
+    `<td class="status-${escapeHtml(e.status)}">${escapeHtml(HTML_STATUS_LABEL[e.status] || e.status)}</td>` +
+    `<td><code class="preview">${escapeHtml(e.preview)}</code></td>` +
+    `<td>${e.occurrences}&times;</td>` +
+    `<td>${escapeHtml(filesShown.join(", "))}${moreFiles > 0 ? ` +${moreFiles} more` : ""}</td>` +
+    `</tr>` +
+    `<tr class="guide"><td colspan="5">` +
+    `<div><strong>${escapeHtml(g.label || e.label)}</strong></div>` +
+    (link ? `<div class="note">${link}</div>` : "") +
+    (steps ? `<ol>${steps}</ol>` : "") +
+    (g.revokeNote ? `<div class="note">${escapeHtml(g.revokeNote)}</div>` : "") +
+    `</td></tr>`
+  );
+}
+
+function renderIntegrityHtml(integrity) {
+  if (!integrity.findings || integrity.findings.length === 0) {
+    return `<div class="clean" style="margin-bottom:24px">&#10003; No integrity findings.</div>`;
+  }
+  const rows = integrity.findings.map((f) =>
+    `<tr><td class="status-${f.severity === "warn" ? "pending" : "dismissed"}">${escapeHtml(f.severity)}</td>` +
+    `<td>${escapeHtml(f.kind)}</td><td>${escapeHtml(safeBasename(f.file))}</td>` +
+    `<td>${escapeHtml(f.detail || "")}</td></tr>`
+  ).join("");
+  return (
+    `<table><thead><tr><th>Severity</th><th>Kind</th><th>File</th><th>Detail</th></tr></thead>` +
+    `<tbody>${rows}</tbody></table>` +
+    (integrity.scopeNote ? `<div class="note">${escapeHtml(integrity.scopeNote)}</div>` : "")
+  );
+}
+
+module.exports = { render, renderIntegrity, renderRotationSection, renderJson, renderSarif, renderHtml, makeProgressReporter, printIntro };

package/src/rotation.js

@@ -572,6 +572,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "A key grants full account access (voices, generations, billing); deletion is immediate.",
   },
+  // docs.nvidia.com's own key-management pages point at build.nvidia.com
+  // for personal keys; login-walled, hence the path in words.
+  nvidia_api_key: {
+    label: "NVIDIA API key",
+    consolePath: "build.nvidia.com > your profile > API Keys",
+    steps: [
+      "Open API Keys under your NVIDIA Build profile",
+      "Delete the leaked key",
+      "Generate a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  jina_key: {
+    label: "Jina AI API key",
+    consolePath: "jina.ai > API keys (jina.ai/api-dashboard/key-manager)",
+    steps: [
+      "Open the API key manager",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  tavily_key: {
+    label: "Tavily API key",
+    consolePath: "app.tavily.com > API Keys",
+    steps: [
+      "Open API Keys in the Tavily dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  firecrawl_key: {
+    label: "Firecrawl API key",
+    consolePath: "firecrawl.dev dashboard > API Keys",
+    steps: [
+      "Open API Keys in the Firecrawl dashboard",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // Format is not Databricks-primary-sourced (see the comment in
+  // src/patterns.js), but the rotation location itself is confirmed
+  // directly from Databricks' own docs (docs.databricks.com/aws/en/dev-tools/auth/pat).
+  databricks_pat: {
+    label: "Databricks personal access token",
+    consolePath: "Databricks workspace > User Settings > Developer > Access tokens",
+    steps: [
+      "Open Access tokens under Developer settings in the workspace",
+      "Revoke the leaked token",
+      "Create a replacement with the shortest lifetime that works for your use case",
+    ],
+    revokeNote: "Revocation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  sourcegraph_token: {
+    label: "Sourcegraph access token",
+    rotateUrl: "https://sourcegraph.com/docs/cli/how-tos/creating_an_access_token",
+    steps: [
+      "Sourcegraph instance > user menu > Settings > Access tokens",
+      "Delete the leaked token",
+      "Create a replacement with the narrowest scopes it needs",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
 
   // ── Cloud / infra ─────────────────────────────────────────────────────
   // docs.digitalocean.com/reference/api/create-personal-access-token/
@@ -963,6 +1028,71 @@ const ROTATION_GUIDANCE = {
     ],
     revokeNote: "Deletion is immediate; the key stops authenticating on the next request.",
   },
+  // shopify.dev/docs/apps/build/authentication-authorization/access-tokens
+  shopify_admin_token: {
+    label: "Shopify Admin API access token",
+    rotateUrl: "https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens",
+    steps: [
+      "For a custom app: Shopify admin > Settings > Apps and sales channels > the app > uninstall/reinstall to reissue",
+      "For a public/private app: revoke access from the Partner Dashboard and reinstall",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "This token can read/write store data (orders, customers, products) depending on its scopes -- review recent admin activity, not just API logs.",
+  },
+  hubspot_token: {
+    label: "HubSpot private app access token",
+    consolePath: "HubSpot account > Settings > Integrations > Private Apps",
+    steps: [
+      "Open Private Apps under Integrations",
+      "Open the relevant app and rotate or delete its access token",
+      "Update whatever used the old token",
+    ],
+    revokeNote: "Deletion/rotation is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // grafana.com/docs/grafana/latest/administration/service-accounts/
+  grafana_service_account_token: {
+    label: "Grafana service account token",
+    rotateUrl: "https://grafana.com/docs/grafana/latest/administration/service-accounts/",
+    steps: [
+      "Administration > Users and access > Service accounts",
+      "Open the relevant service account and delete the leaked token",
+      "Add a replacement token and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old token starts failing authentication at once.",
+  },
+  // docs.newrelic.com's own migration notice confirms the NRAK prefix;
+  // key management itself is login-walled.
+  new_relic_api_key: {
+    label: "New Relic API key",
+    consolePath: "one.newrelic.com > API keys (under your user menu)",
+    steps: [
+      "Open API keys",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  mailchimp_key: {
+    label: "Mailchimp API key",
+    consolePath: "Mailchimp account > Profile > Extras > API keys",
+    steps: [
+      "Open API keys under Extras in your account profile",
+      "Delete the leaked key",
+      "Create a replacement and update whatever used the old one",
+    ],
+    revokeNote: "Deletion is immediate; anything still using the old key starts failing authentication at once.",
+  },
+  // techdocs.akamai.com/developer/docs/authenticate-with-edgegrid
+  akamai_edgegrid_token: {
+    label: "Akamai EdgeGrid token",
+    rotateUrl: "https://techdocs.akamai.com/developer/docs/authenticate-with-edgegrid",
+    steps: [
+      "Akamai Control Center > Identity & access management > API clients",
+      "Open the relevant API client and deactivate/delete the leaked credential",
+      "Create a replacement client credential and update whatever used the old one",
+    ],
+    revokeNote: "Deactivation is immediate; anything still using the old credential starts failing authentication at once.",
+  },
 
   // ── NOISY_PATTERNS (only reachable via --include-noisy) ───────────────
   generic_password_assignment: {