From 42d07b7e7c46da70cd81d42d6c92d0785a029d06 Mon Sep 17 00:00:00 2001
From: Mick Grove <mick.grove@mongodb.com>
Date: Sat, 18 Apr 2026 08:27:51 -0700
Subject: [PATCH] performance improvements and rule improvements

---
 crates/kingfisher-rules/data/rules/falai.yml | 55 ++++++++++++++++++--
 1 file changed, 50 insertions(+), 5 deletions(-)

diff --git a/crates/kingfisher-rules/data/rules/falai.yml b/crates/kingfisher-rules/data/rules/falai.yml
index 662d1a8..09af8b6 100644
--- a/crates/kingfisher-rules/data/rules/falai.yml
+++ b/crates/kingfisher-rules/data/rules/falai.yml
@@ -2,17 +2,62 @@ rules:
   - name: Fal.ai API Key
     id: kingfisher.falai.1
     pattern: |
-      (?x)
+      (?xi)
+      \b
+      (?:
+        (?:fal(?:\.ai)?|falai)
+        (?:.|[\n\r]){0,32}?
+        (?:SECRET|PRIVATE|ACCESS|KEY|TOKEN|API)
+        |
+        fal-api
+      )
+      (?:.|[\n\r]){0,16}?
       \b
       (
-        fal_sk_[a-zA-Z0-9_-]{24,48}
+        (?P<key_id>
+          [a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}
+        )
+        :
+        (?P<key_secret>
+          [a-f0-9]{16}[a-f0-9]{16}
+        )
       )
       \b
     pattern_requirements:
-      min_digits: 1
-    min_entropy: 3.0
+      min_digits: 8
+    min_entropy: 3.5
     confidence: medium
     examples:
-      - 'FAL_KEY=fal_sk_a1B2c3D4e5F6g7H8i9J0k1L2m3N4'
+      - 'FAL_KEY=847c02a9-db27-42d5-b781-9cf5c72b3e0d:48299b8e125e5861715a35fc653a0855'
+      - 'fal.ai api key: 56673bfb-3727-48e1-a3c4-2297a7133693:f8ca0f7de94702dbe0b6797f3e8f4b42'
+      - 'falai token = 17b2a0a9-362e-4756-b981-c4ac07e77e2f:f88af09b578212a6ddc7503e314c1c94'
+      - 'fal-api = 6adacb14-1d60-4f64-85d7-b7624fa3e8e9:a30520804ec44185a563e107349cf7b7'
     references:
       - https://docs.fal.ai/platform-apis/v1/keys/create
+      - https://docs.fal.ai/platform-apis/v1/models/pricing
+    validation:
+      type: Http
+      content:
+        request:
+          method: GET
+          url: https://api.fal.ai/v1/models/pricing?endpoint_id=fal-ai/flux/dev
+          headers:
+            Authorization: "Key {{ TOKEN }}"
+            Accept: application/json
+          response_matcher:
+            - report_response: true
+            - type: StatusMatch
+              status: [200]
+            - type: JsonValid
+    revocation:
+      type: Http
+      content:
+        request:
+          method: DELETE
+          url: https://api.fal.ai/v1/keys/{{ KEY_ID }}
+          headers:
+            Authorization: "Key {{ TOKEN }}"
+          response_matcher:
+            - report_response: true
+            - type: StatusMatch
+              status: [204]