kingfisher/crates/kingfisher-rules/data/rules/shippo.yml

rules:
  - name: Shippo API Token
    id: kingfisher.shippo.1
    pattern: |
      (?xi)
      \b
      (
        shippo_(?:live|test)_[a-f0-9]{40}
      )
      \b
    pattern_requirements:
      min_digits: 2
    min_entropy: 3.3
    confidence: medium
    examples:
      - SHIPPO_TOKEN=shippo_test_1234567890abcdef1234567890abcdef12345678
      - 'Authorization: "ShippoToken shippo_live_abc12fabcdefabcdefabcdefabcdefabcdefabcd"'
    references:
      - https://goshippo.com/docs/reference
    validation:
      type: Http
      content:
        request:
          method: GET
          url: https://api.goshippo.com/shipments/
          headers:
            Authorization: 'ShippoToken {{ TOKEN }}'
            Accept: application/json
          response_matcher:
            - report_response: true
            - type: StatusMatch
              status:
                - 200
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`rules:`
			`- name: Shippo API Token`
			`id: kingfisher.shippo.1`
			`pattern: \|`
			`(?xi)`
			`\b`
			`(`
			`shippo_(?:live\|test)_[a-f0-9]{40}`
			`)`
			`\b`
pattern_requirements for rules — Post-regex character-class gating to cut false positives without lookarounds. Authors can now require minimum counts of digits, uppercase, lowercase, and special characters, with an optional custom special-char set. Why: Hyperscan doesn’t support lookaheads/behinds, so many “must contain X and Y” checks had to be baked into the regex (hurting readability) or were impossible. pattern_requirements applies lightweight, in-memory checks after a match is found, keeping patterns fast and clean. 2025-11-04 13:55:31 -05:00			`pattern_requirements:`
			`min_digits: 2`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`min_entropy: 3.3`
			`confidence: medium`
			`examples:`
			`- SHIPPO_TOKEN=shippo_test_1234567890abcdef1234567890abcdef12345678`
v1.81.0 2026-02-10 19:24:19 -08:00			`- 'Authorization: "ShippoToken shippo_live_abc12fabcdefabcdefabcdefabcdefabcdefabcd"'`
- Fixed kingfisher scan so that providing --branch without --since-commit now diffs the branch against the empty tree and scans every commit reachable from that branch. - Added rules for meraki, duffel, finnhub, frameio, freshbooks, gitter, infracost, launchdarkly, lob, maxmind, messagebird, nytimes, prefect, salingo, sendinblue, sentry, shippo, twitch, typeform 2025-10-20 18:23:12 -07:00			`references:`
			`- https://goshippo.com/docs/reference`
			`validation:`
			`type: Http`
			`content:`
			`request:`
			`method: GET`
			`url: https://api.goshippo.com/shipments/`
			`headers:`
			`Authorization: 'ShippoToken {{ TOKEN }}'`
			`Accept: application/json`
			`response_matcher:`
			`- report_response: true`
			`- type: StatusMatch`
			`status:`
			`- 200`