diff --git a/CHANGELOG.md b/CHANGELOG.md index 6eec405..ddf8171 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ All notable changes to this project will be documented in this file. ## [v1.70.0] -- Added new rules for AWS Bedrock, Voyage.ai +- Added new rules for AWS Bedrock, Voyage.ai, Posthog ## [v1.69.0] - Reduced per-match memory usage by compacting stored source locations and interning repeated capture names. diff --git a/Cargo.toml b/Cargo.toml index 6798ed7..471be4b 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -10,7 +10,7 @@ publish = false [package] name = "kingfisher" -version = "1.69.0" +version = "1.70.0" description = "MongoDB's blazingly fast and accurate secret scanning and validation tool" edition.workspace = true rust-version.workspace = true diff --git a/data/rules/aws.yml b/data/rules/aws.yml index 6332692..818881f 100644 --- a/data/rules/aws.yml +++ b/data/rules/aws.yml @@ -81,7 +81,8 @@ rules: export AWS_SESSION_TOKEN="eyJhbGciOiJIUzUxMi53InR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJMDhCQ1gySkpWNDVFRDFET0M5SiIsImFjciI6Ij53LCJhdWQiOiJhY2NvdW50IiwiYXV0aF90aW1lIjowLCJhenAiOiJtaW5pbyIsImVtYWlsIjoiYWlkYW4uY29wZUBnbWFpbC5jb20iLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImV4cCI6MTU4MDUwMDIzOCwiZmFtaWx5X25hbWUiOiJDb3BlIiwiZ2l2ZW5fbmFtZSI6IkFpZGFuIENvcGUiLCJpYXQiOjE1ODA0OTk5MzgsImlzcyI6Imh0dHBzOi8vYXV0aHN0Zy5wb3BkYXRhLmJjLmNhL2F1dGgvcmVhbG1zL3NhbXBsZSIsImp0aSI6IjU5ZTM5ODAxLWQxMmUtNDVhYS04NmQzLWVhMmNmZDU0NmE2MiIsIm1pbmlvX3BvbGljeSI6ImRhdGFzZXRfMV9ybyIsIm5hbWUiOiJBaWRhbiBDb3BlIENvcGUiLCJuYmYiOjAsInByZWZlcnJlZF91c2VybmFtZSI6ImFjb3BlLTk5LXQwNSIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIiwic2Vzc2lvbl9zdGF0ZSI6IjcxYjczZWJjLThlMzMtNGMyMi04NmE2LWI0MzhhNDM4ZmI2MiIsInN1YiI6IjVkOTBlOTgzLTA1NDItNDYyYS1hZWIwLWYxZWVmNjcwYzdlNSIsInR5cCI6IkJlYXJlciJ9.J-a9PORJToz7MUrnPQlOywcqtVMNkXy53Gedp_V4PW-Gbf1_BAMjwuw_X7fKRd6hkNfEn43CKKju7muzi_d1Ig" - name: AWS Bedrock API Key (Long-lived) id: kingfisher.aws.bedrock.long_lived - pattern: (?x) + pattern: | + (?x) ( ABSKQmVkcm9ja0FQSUtleS[A-Za-z0-9+/=]{110} ) diff --git a/data/rules/posthog.yml b/data/rules/posthog.yml new file mode 100644 index 0000000..7b701c1 --- /dev/null +++ b/data/rules/posthog.yml @@ -0,0 +1,51 @@ +rules: + - name: PostHog Project API Key + id: kingfisher.posthog.1 + pattern: | + (?x) + ( + phc_[a-zA-Z0-9_\-]{43} + ) + min_entropy: 3.0 + confidence: high + examples: + - "phc_E123456789012345678901234567890123456789012" + validation: + type: Http + content: + request: + method: POST + url: https://app.posthog.com/decide/?v=3 + headers: + Content-Type: "application/json" + body: | + {"token": "{{ TOKEN }}", "distinct_id": "validation_check"} + response_matcher: + - type: StatusMatch + status: [200] + - name: PostHog Personal API Key + id: kingfisher.posthog.2 + pattern: | + (?x) + ( + phx_[a-zA-Z0-9_\-]{47} + ) + min_entropy: 3.0 + confidence: high + examples: + - "phx_FNKCx83Ko0JQMuZH1zz94xgK798TCUybkf79ZKYKwKQWbEw" + validation: + type: Http + content: + request: + method: GET + url: https://app.posthog.com/api/users/@me/ + headers: + Authorization: "Bearer {{ TOKEN }}" + Content-Type: "application/json" + response_matcher: + - report_response: true + - type: WordMatch + words: + - "authentication_failed" + negative: true \ No newline at end of file diff --git a/data/rules/voyageai.yml b/data/rules/voyageai.yml index 04ee2a1..942ab40 100644 --- a/data/rules/voyageai.yml +++ b/data/rules/voyageai.yml @@ -3,7 +3,8 @@ rules: id: kingfisher.voyageai.api_key description: Detects Voyage AI API keys used for embedding and retrieval models. # Matches keys starting with 'pa-' followed by 43 URL-safe base64 characters - pattern: (?x) + pattern: | + (?x) ( pa-[a-zA-Z0-9\-_]{43} )