kingfisher/crates/kingfisher-rules/data/rules/duffel.yml

rules:
  - name: Duffel API Token
    id: kingfisher.duffel.1
    pattern: |
      (?x)
      \b
      (
        duffel_(?:test|live)_[a-zA-Z0-9_\-=]{43}
      )
      \b
    pattern_requirements:
      min_digits: 2
    min_entropy: 3.2
    confidence: high
    examples:
      - DUFFEL_TOKEN=duffel_test_qwertyuiopasdfghjklzxcvbnm123456789abcdefgh
      - 'Authorization: "Bearer duffel_live_abcd1234efgh5678ijkl9012mnop3456qrstuvwxyza"'
    references:
      - https://duffel.com/docs/api
    validation:
      type: Http
      content:
        request:
          method: GET
          url: https://api.duffel.com/airlines
          headers:
            Authorization: 'Bearer {{ TOKEN }}'
            Accept: application/json
            Duffel-Version: v1
          response_matcher:
            - report_response: true
            - type: StatusMatch
              status:
                - 200
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`rules:`
			`- name: Duffel API Token`
			`id: kingfisher.duffel.1`
			`pattern: \|`
v1.87.0 2026-03-09 20:11:58 -07:00			`(?x)`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`\b`
			`(`
v1.87.0 2026-03-09 20:11:58 -07:00			`duffel_(?:test\|live)_[a-zA-Z0-9_\-=]{43}`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`)`
			`\b`
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean. 2025-11-04 13:55:31 -05:00			`pattern_requirements:`
			`min_digits: 2`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`min_entropy: 3.2`
v1.87.0 2026-03-09 20:11:58 -07:00			`confidence: high`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`examples:`
			`- DUFFEL_TOKEN=duffel_test_qwertyuiopasdfghjklzxcvbnm123456789abcdefgh`
			`- 'Authorization: "Bearer duffel_live_abcd1234efgh5678ijkl9012mnop3456qrstuvwxyza"'`
			`references:`
			`- https://duffel.com/docs/api`
			`validation:`
			`type: Http`
			`content:`
			`request:`
			`method: GET`
			`url: https://api.duffel.com/airlines`
			`headers:`
			`Authorization: 'Bearer {{ TOKEN }}'`
			`Accept: application/json`
			`Duffel-Version: v1`
			`response_matcher:`
			`- report_response: true`
			`- type: StatusMatch`
			`status:`
			`- 200`