From 1ac413bbeedbe4be04d31e4811b3ccbc5018e806 Mon Sep 17 00:00:00 2001
From: Mick Grove <mick.grove@mongodb.com>
Date: Fri, 25 Jul 2025 10:31:17 -0700
Subject: [PATCH] Added ElevenLabs rule

---
 CHANGELOG.md              |  3 +++
 Cargo.toml                |  2 +-
 data/rules/elevenlabs.yml | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 data/rules/elevenlabs.yml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d89083c..7198eca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.26.0]
+- Added rule for ElevenLabs
+
 ## [1.25.0]
 - Fixed GitLab authentication bug
 - Added pre-commit and pre-receive installation hooks
diff --git a/Cargo.toml b/Cargo.toml
index 930056a..0146316 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 
 [package]
 name = "kingfisher"
-version = "1.25.0"
+version = "1.26.0"
 description = "MongoDB's blazingly fast secret scanning and validation tool"
 edition.workspace = true
 rust-version.workspace = true
diff --git a/data/rules/elevenlabs.yml b/data/rules/elevenlabs.yml
new file mode 100644
index 0000000..ade342c
--- /dev/null
+++ b/data/rules/elevenlabs.yml
@@ -0,0 +1,36 @@
+rules:
+  - name: ElevenLabs API Key
+    id: kingfisher.elevenlabs.1
+    pattern: |       
+      (?xi)           
+      \b
+      (               
+        sk_           
+        [0-9a-f]{48}  
+      )
+      \b
+    min_entropy: 3.5
+    confidence: medium
+    examples:
+      - sk_2a30e5a0d39d5f2c5f6a9d2f95cd016049a6323985479bfd
+      - sk_da9c0613fdeecfab10b302d6f39a3e371f774feb9eafed56
+      - sk_82a331629e2128ef70396600809b6a2ff4e433154fa27e1b
+    references:
+      - https://elevenlabs.io/docs/api-reference/authentication
+      - https://elevenlabs.io/docs/api-reference/user/subscription/get
+
+    validation:
+      type: Http
+      content:
+        request:
+          method: GET
+          url: https://api.elevenlabs.io/v1/user/subscription  
+          headers:
+            xi-api-key: '{{ TOKEN }}'
+          response_matcher:
+            - report_response: true
+            - type: WordMatch
+              match_all_words: false
+              words:
+                - '"tier"'
+                - '"missing_permissions"'