From e5a829a0a9e6d7294edab2b24ac0d940f93ffd13 Mon Sep 17 00:00:00 2001 From: bohdansolovie Date: Sun, 5 Jul 2026 01:52:58 +0200 Subject: [PATCH 1/2] feat(enrichment): detect Resend API keys and Mapbox secret tokens in secret-scan Add high-confidence patterns for Resend `re_` keys and Mapbox `sk.eyJ` secret tokens with fragment-based fixtures, truncation negatives, and Stripe parity. Co-authored-by: Cursor --- .../src/analyzers/secret-scan.ts | 12 ++++++++++ review-enrichment/test/secret-scan.test.ts | 24 +++++++++++++++++++ 2 files changed, 36 insertions(+) diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts index fbe56800d7..775f9c8120 100644 --- a/review-enrichment/src/analyzers/secret-scan.ts +++ b/review-enrichment/src/analyzers/secret-scan.ts @@ -187,6 +187,18 @@ const RULES: Rule[] = [ re: /\bSK[0-9a-fA-F]{32}(?![A-Za-z0-9_])/, confidence: "high", }, + { + // Resend API key: `re_` + >=24 base62 chars. + kind: "resend_api_key", + re: /\bre_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/, + confidence: "high", + }, + { + // Mapbox secret access token: `sk.eyJ` JWT-shaped token (distinct from Stripe `sk_live_` / `sk_test_`). + kind: "mapbox_secret_token", + re: /\bsk\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9_-])/, + confidence: "high", + }, { // Google OAuth 2.0 client secret: `GOCSPX-` + 28 base64url chars. kind: "google_oauth_client_secret", diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts index 13fcff694c..65ede3548e 100644 --- a/review-enrichment/test/secret-scan.test.ts +++ b/review-enrichment/test/secret-scan.test.ts @@ -471,6 +471,30 @@ test("scanPatch does not flag truncated Twilio SIDs or identifier continuation p ); }); +test("scanPatch flags Resend and Mapbox secret tokens with high confidence", () => { + const fakeResendKey = "re_" + "a".repeat(32); + const resendFindings = scanPatch("src/config.ts", hunk([`const resend = "${fakeResendKey}";`])); + assert.equal(resendFindings.length, 1); + assert.equal(resendFindings[0].kind, "resend_api_key"); + assert.equal(resendFindings[0].confidence, "high"); + + const fakeMapboxSecret = ["sk.", "eyJ", "a".repeat(20), ".", "b".repeat(20)].join(""); + const mapboxFindings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`])); + assert.equal(mapboxFindings.length, 1); + assert.equal(mapboxFindings[0].kind, "mapbox_secret_token"); + assert.equal(mapboxFindings[0].confidence, "high"); +}); + +test("scanPatch does not flag truncated Resend keys or classify Mapbox secrets as Stripe keys", () => { + const truncatedResend = "re_" + "a".repeat(23); + assert.equal(scanPatch("src/config.ts", hunk([`const resend = "${truncatedResend}";`])).length, 0); + + const fakeMapboxSecret = ["sk.", "eyJ", "c".repeat(20), ".", "d".repeat(20)].join(""); + const findings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`])); + assert.equal(findings.some((f) => f.kind === "stripe_secret_key"), false); + assert.equal(findings.some((f) => f.kind === "mapbox_secret_token"), true); +}); + test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => { const cases = [ ["google_oauth_client_secret", "GOCSPX-" + b62(28)], From 5aa057e4aa2e25e8d18085e26e7673701696e3c8 Mon Sep 17 00:00:00 2001 From: bohdansolovie Date: Sun, 5 Jul 2026 01:57:38 +0200 Subject: [PATCH 2/2] fix(enrichment): match production Mapbox secret token shape in secret-scan Use sk.eyJ + base64url body without a fabricated second dot segment per Orb feedback on #3266; add pk-token and truncation negatives. Co-authored-by: Cursor --- review-enrichment/src/analyzers/secret-scan.ts | 4 ++-- review-enrichment/test/secret-scan.test.ts | 14 ++++++++++++-- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts index 775f9c8120..2f5522265f 100644 --- a/review-enrichment/src/analyzers/secret-scan.ts +++ b/review-enrichment/src/analyzers/secret-scan.ts @@ -194,9 +194,9 @@ const RULES: Rule[] = [ confidence: "high", }, { - // Mapbox secret access token: `sk.eyJ` JWT-shaped token (distinct from Stripe `sk_live_` / `sk_test_`). + // Mapbox secret access token: `sk.eyJ` + base64url body (distinct from Stripe `sk_live_` / `sk_test_`). kind: "mapbox_secret_token", - re: /\bsk\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9_-])/, + re: /\bsk\.eyJ[A-Za-z0-9_-]{24,}(?![A-Za-z0-9_-])/, confidence: "high", }, { diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts index 65ede3548e..972850f755 100644 --- a/review-enrichment/test/secret-scan.test.ts +++ b/review-enrichment/test/secret-scan.test.ts @@ -478,7 +478,7 @@ test("scanPatch flags Resend and Mapbox secret tokens with high confidence", () assert.equal(resendFindings[0].kind, "resend_api_key"); assert.equal(resendFindings[0].confidence, "high"); - const fakeMapboxSecret = ["sk.", "eyJ", "a".repeat(20), ".", "b".repeat(20)].join(""); + const fakeMapboxSecret = ["sk.", "eyJ", "a".repeat(24)].join(""); const mapboxFindings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`])); assert.equal(mapboxFindings.length, 1); assert.equal(mapboxFindings[0].kind, "mapbox_secret_token"); @@ -489,12 +489,22 @@ test("scanPatch does not flag truncated Resend keys or classify Mapbox secrets a const truncatedResend = "re_" + "a".repeat(23); assert.equal(scanPatch("src/config.ts", hunk([`const resend = "${truncatedResend}";`])).length, 0); - const fakeMapboxSecret = ["sk.", "eyJ", "c".repeat(20), ".", "d".repeat(20)].join(""); + const fakeMapboxSecret = ["sk.", "eyJ", "c".repeat(24)].join(""); const findings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`])); assert.equal(findings.some((f) => f.kind === "stripe_secret_key"), false); assert.equal(findings.some((f) => f.kind === "mapbox_secret_token"), true); }); +test("scanPatch does not flag truncated Mapbox secrets or public pk tokens", () => { + const truncated = ["sk.", "eyJ", "a".repeat(23)].join(""); + assert.equal(scanPatch("src/config.ts", hunk([`const mapbox = "${truncated}";`])).length, 0); + const publicToken = ["pk.", "eyJ", "b".repeat(24)].join(""); + assert.equal( + scanPatch("src/config.ts", hunk([`const mapbox = "${publicToken}";`])).some((f) => f.kind === "mapbox_secret_token"), + false, + ); +}); + test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => { const cases = [ ["google_oauth_client_secret", "GOCSPX-" + b62(28)],