kingfisher/crates/kingfisher-rules/data/rules/scalingo.yml

rules:
  - name: Scalingo API Token
    id: kingfisher.scalingo.1
    pattern: |
      (?xi)
      \b
      (
        tk-us-[\w-]{48}
      )
      \b
    pattern_requirements:
      min_digits: 2
    min_entropy: 3.0
    confidence: medium
    examples:
      - SCALINGO_TOKEN=tk-us-abcdefabcde12bcdefabcdefabcdefabcdefabcdefabcdef
      - '"scalingo": "tk-us-1234567890abcdef1234567890abcdef1234567890abcdef"'
    references:
      - https://developers.scalingo.com/index#authentication
    validation:
      type: Http
      content:
        request:
          method: GET
          url: https://api.scalingo.com/v1/users/self
          headers:
            Authorization: 'Bearer {{ TOKEN }}'
            Accept: application/json
          response_matcher:
            - report_response: true
            - type: StatusMatch
              status:
                - 200
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`rules:`
			`- name: Scalingo API Token`
			`id: kingfisher.scalingo.1`
			`pattern: \|`
			`(?xi)`
			`\b`
			`(`
			`tk-us-[\w-]{48}`
			`)`
preparing v1.74.0 2026-01-12 22:50:05 -08:00			`\b`
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean. 2025-11-04 13:55:31 -05:00			`pattern_requirements:`
			`min_digits: 2`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`min_entropy: 3.0`
			`confidence: medium`
			`examples:`
v1.81.0 2026-02-10 19:24:19 -08:00			`- SCALINGO_TOKEN=tk-us-abcdefabcde12bcdefabcdefabcdefabcdefabcdefabcdef`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`- '"scalingo": "tk-us-1234567890abcdef1234567890abcdef1234567890abcdef"'`
			`references:`
v1.81.0 2026-02-10 19:24:19 -08:00			`- https://developers.scalingo.com/index#authentication`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`validation:`
			`type: Http`
			`content:`
			`request:`
			`method: GET`
			`url: https://api.scalingo.com/v1/users/self`
			`headers:`
			`Authorization: 'Bearer {{ TOKEN }}'`
			`Accept: application/json`
			`response_matcher:`
			`- report_response: true`
			`- type: StatusMatch`
			`status:`
			`- 200`