added posthog

CHANGELOG.md

@@ -3,7 +3,7 @@
 All notable changes to this project will be documented in this file.
 
 ## [v1.70.0]
-- Added new rules for AWS Bedrock, Voyage.ai
+- Added new rules for AWS Bedrock, Voyage.ai, Posthog
 
 ## [v1.69.0]
 - Reduced per-match memory usage by compacting stored source locations and interning repeated capture names.

Cargo.toml

@@ -10,7 +10,7 @@ publish = false
 
 [package]
 name = "kingfisher"
-version = "1.69.0"
+version = "1.70.0"
 description = "MongoDB's blazingly fast and accurate secret scanning and validation tool"
 edition.workspace = true
 rust-version.workspace = true

data/rules/aws.yml

@@ -81,7 +81,8 @@ rules:
         export AWS_SESSION_TOKEN="eyJhbGciOiJIUzUxMi53InR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJMDhCQ1gySkpWNDVFRDFET0M5SiIsImFjciI6Ij53LCJhdWQiOiJhY2NvdW50IiwiYXV0aF90aW1lIjowLCJhenAiOiJtaW5pbyIsImVtYWlsIjoiYWlkYW4uY29wZUBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImV4cCI6MTU4MDUwMDIzOCwiZmFtaWx5X25hbWUiOiJDb3BlIiwiZ2l2ZW5fbmFtZSI6IkFpZGFuIENvcGUiLCJpYXQiOjE1ODA0OTk5MzgsImlzcyI6Imh0dHBzOi8vYXV0aHN0Zy5wb3BkYXRhLmJjLmNhL2F1dGgvcmVhbG1zL3NhbXBsZSIsImp0aSI6IjU5ZTM5ODAxLWQxMmUtNDVhYS04NmQzLWVhMmNmZDU0NmE2MiIsIm1pbmlvX3BvbGljeSI6ImRhdGFzZXRfMV9ybyIsIm5hbWUiOiJBaWRhbiBDb3BlIENvcGUiLCJuYmYiOjAsInByZWZlcnJlZF91c2VybmFtZSI6ImFjb3BlLTk5LXQwNSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIiwic2Vzc2lvbl9zdGF0ZSI6IjcxYjczZWJjLThlMzMtNGMyMi04NmE2LWI0MzhhNDM4ZmI2MiIsInN1YiI6IjVkOTBlOTgzLTA1NDItNDYyYS1hZWIwLWYxZWVmNjcwYzdlNSIsInR5cCI6IkJlYXJlciJ9.J-a9PORJToz7MUrnPQlOywcqtVMNkXy53Gedp_V4PW-Gbf1_BAMjwuw_X7fKRd6hkNfEn43CKKju7muzi_d1Ig"
   - name: AWS Bedrock API Key (Long-lived)
     id: kingfisher.aws.bedrock.long_lived
-    pattern: (?x)
+    pattern: |
+      (?x)
       (
         ABSKQmVkcm9ja0FQSUtleS[A-Za-z0-9+/=]{110}
       )

data/rules/posthog.yml

@@ -0,0 +1,51 @@
+rules:
+  - name: PostHog Project API Key
+    id: kingfisher.posthog.1
+    pattern: | 
+      (?x)
+      (
+        phc_[a-zA-Z0-9_\-]{43}
+      )
+    min_entropy: 3.0
+    confidence: high
+    examples:
+      - "phc_E123456789012345678901234567890123456789012"
+    validation:
+      type: Http
+      content:
+        request:
+          method: POST
+          url: https://app.posthog.com/decide/?v=3
+          headers:
+            Content-Type: "application/json"
+          body: |
+            {"token": "{{ TOKEN }}", "distinct_id": "validation_check"}
+          response_matcher:
+            - type: StatusMatch
+              status: [200]
+  - name: PostHog Personal API Key
+    id: kingfisher.posthog.2
+    pattern: |
+      (?x)
+      (
+        phx_[a-zA-Z0-9_\-]{47}
+      )
+    min_entropy: 3.0
+    confidence: high
+    examples:
+      - "phx_FNKCx83Ko0JQMuZH1zz94xgK798TCUybkf79ZKYKwKQWbEw"
+    validation:
+      type: Http
+      content:
+        request:
+          method: GET
+          url: https://app.posthog.com/api/users/@me/
+          headers:
+            Authorization: "Bearer {{ TOKEN }}"
+            Content-Type: "application/json"
+          response_matcher:
+            - report_response: true
+            - type: WordMatch
+              words:
+                - "authentication_failed"
+              negative: true

data/rules/voyageai.yml

@@ -3,7 +3,8 @@ rules:
     id: kingfisher.voyageai.api_key
     description: Detects Voyage AI API keys used for embedding and retrieval models.
     # Matches keys starting with 'pa-' followed by 43 URL-safe base64 characters
-    pattern: (?x)
+    pattern: |
+      (?x)
       (
         pa-[a-zA-Z0-9\-_]{43}
       )