Version 2.174.0 adds ten new detectors, covering Lago API keys, Composio project and organization API keys, Codex API keys, CARTO Basemaps API keys, Google Chat incoming webhook URLs, SFTP credentials, HubSpot CLI personal access keys, AmneziaWG VPN private keys and Kubernetes kubeconfig bearer tokens. Two new analyzers are available, for GoCardless API access tokens and Adobe refresh tokens. A validity checker is now enabled for SMTP credentials, and existing checkers were improved across Algolia, Snowflake, Snyk (SNYK-US-02), Azure Entra, Azure Active Directory, GitLab Deploy Tokens, LiteLLM, n8n, Open VSX, Midtrans, AWS SES and FTP credentials, mainly to reach custom hosts and proxies, handle secrets without a port, and avoid spurious failed_to_check results. Detection coverage also grew for GitHub App server-to-server tokens, Docker credentials, Gemfury tokens, SSH passwords in expect scripts, MSSQL credentials without a port, and Azure Entra app secrets declared against Microsoft national cloud sign-in hosts. On the maintenance side, the _with_host variants of the Azure Event Grid, Grafana service account, Kubernetes service account and PlanetScale detectors were merged into their base detectors, the PostgreSQL port variants were merged into postgres_assignment, and the deprecated line_notify_token detector was removed.

Notable precision improvements (measured on internal benchmarks):

• generic_high_entropy_secret: significant reduction in false positives, with image names from known container registries no longer reported.
• generic_database_assignment: significant reduction in false positives from shell command substitutions, empty defaults, the --userns flag and malformed host or username values.
• microsoft_azure_storage_account_key: significant reduction in false positives caused by JFrog reference tokens assigned to jfrog variables.

New Detectors​

• Lago API Key: Add a new detector for Lago API keys.
• Composio API Key: Add a new detector for Composio project API keys.
• Composio Organization API Key: Add a new detector for Composio organization API keys.
• Codex API Key: Add a new detector for Codex API keys.
• CARTO Basemaps API Key: Add a new detector for CARTO Basemaps API keys.
• Google Chat Webhook URL: Add a new detector for Google Chat incoming webhook URLs.
• SFTP Credentials: Added an sftp_credentials_assignment detector.
• HubSpot Personal Access Key: Add a new detector for HubSpot CLI personal access keys.
• AmneziaWG Private Key: Add a new detector for AmneziaWG VPN private keys.
• Kubernetes Kubeconfig Bearer Token: Add a new detector for Kubernetes bearer tokens stored in kubeconfig files.

Detector Updates​

• SMTP credentials: Enable the SMTP credentials validity checker.
• FTP Credentials: The ftp_credentials_assignment checker now handles secrets without a port.
• Algolia Keys: The algolia_monitoring checker now validates all Algolia keys with more permissions than the default search key.
• Snowflake Credentials: The snowpark_api_credentials checker now supports short account identifiers, hostnames, and full Snowflake URLs.
• Azure Entra App Secret: The azure_entra_app_secret detector now detects credentials declared against Microsoft national cloud sign-in hosts.
• Azure Entra Access Token: The Azure Entra Access Token checker now accepts a custom host.
• Azure Entra ID Token: Azure Entra ID token checker can now reach custom hosts through a proxy.
• Azure Active Directory API Keys: The Azure Active Directory API Keys checker now accepts a custom host.
• GitHub App Token: GitHub Server-to-server Tokens in the ghs_<app id>_<JWT> format are now detected with any number of scopes, including longer tokens previously missed.
• Docker Credentials: Update docker_credentials detector to support the new format.
• Generic High Entropy Secret: The generic_high_entropy_secret no longer reports secrets that are actually part of image names coming from known container registries.
• Midtrans API Key: Fix midtrans_apikey marking invalid secrets as failed_to_check because of change in midtrans API response
• SSH Credentials: The ssh_password detector now detects passwords sent in expect scripts after an SSH password prompt.
• MSSQL Credentials: The mssql_assignment detector now detects MSSQL credentials assigned without a port.
• AWS SES Keys: The checker of the aws_ses_keys detector now has a timeout. This should reduce the number of times it gets killed by apikey-checker.
• Open VSX Access Token: The checker for the ovsx_access_token has been updated following a behavior change of OpenVSX API.
• SFTP Credentials: The ftp_credentials_assignment detector now only captures FTP secrets, not SFTP.
• GitLab Deploy Token: GitLab Deploy Token checker can now reach custom hosts through a proxy.
• LiteLLM API Key Without Host: LiteLLM API key checker can now reach custom hosts through a proxy.
• Microsoft Azure Storage Account Key: The microsoft_azure_storage_account_key detector no longer matches JFrog secrets assigned to jfrog variables.
• Azure Event Grid Access Key: The azure_event_grid_access_key_with_host detector has been merged into azure_event_grid_access_key.
• Grafana Service Account Token: The grafana_service_account_token_with_host detector has been merged into grafana_service_account_token.
• Kubernetes Service Account Token: The kubernetes_jwt_with_host detector has been merged into kubernetes_jwt.
• PlanetScale Database Password: The planetscale_database_password_with_host_and_username detector has been merged into planetscale_database_password.
• Gemfury Deploy Or Push Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
• Gemfury Full Access Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
• Snyk Key: The snyk_key_v2 checker now supports the SNYK-US-02 region.
• PostgreSQL Credentials: The detectors postgres_assignment_attached_port and postgres_assignment_no_port have been merged into the postgres_assignment detector.
• n8n API Key: The n8n API key checker now checks keys found with a host written without its scheme.
• n8n MCP Access Token: The n8n MCP access token checker now checks tokens found with a host written without its scheme.
• Generic Database Assignment: Fixed generic_database_assignment reporting the --userns CLI flag as a username, and leading dots or dashes in hosts and usernames.

New Analyzers​

• GoCardless API Key: Add a new analyzer for GoCardless API access tokens.
• Adobe Refresh Token: Add a new analyzer for Adobe refresh tokens.

Analyzer Updates​

• GitLab Token: Fixed GitLab analyzer failing on fine-grained personal access tokens by updating the import scope checks to match GitLab's new API behavior.

Miscellaneous​

• The line_notify_token detector and checker have been removed. The service for this detector is no longer available.

This release adds new detectors for Ory API keys, Kong Konnect personal access tokens, AppSignal API keys, PostHog OAuth access and refresh tokens, Datadog service access tokens, NinzaSMS API keys, TypeSafe AI API keys, and Mistral AI's new prefixed API key format. It also adds a new analyzer for Cohere API keys. The Okta Token with Host and Mistral AI checkers were updated, and the Databricks Authentication Token With Hostname detector now finds more tokens.

New Detectors​

• Ory API Key: Add a new detector for Ory API keys.
• Kong Konnect Personal Access Token: Add a detector for Kong Konnect personal access tokens.
• AppSignal API Key: Add a new detector for AppSignal API keys.
• PostHog OAuth Access Token: Add a new detector for PostHog OAuth access tokens.
• PostHog OAuth Refresh Token: Add a new detector for PostHog OAuth refresh tokens.
• Datadog Service Access Token: Add a new detector for Datadog service access tokens.
• NinzaSMS API Key: Add a new detector for NinzaSMS API keys.
• TypeSafe AI API Key: Add a new detector for TypeSafe AI API keys.
• Mistral AI API Key: Added the mistralai_apikey_v2 detector for Mistral AI's new prefixed API key format.

Detector Updates​

• Azure Cache for Redis Access Key: Update regex to ensure secrets are not detected mid string.
• Databricks Authentication Token With Hostname: Increase max distance between matches and ban generic host.
• Databricks Authentication Token With Hostname: Increase max distance between matches and ban generic host.
• Okta Token with Host: The Okta Token with Host checker no longer validates tokens against non-organization Okta hosts.
• Mistral AI API Key: Made the Mistral AI checker more robust to API changes.
• Base64 Basic Authentication: Base64 Basic Authentication findings now take precedence over overlapping Base64 Generic High Entropy Secret findings.

New Analyzers​

• Cohere API Key: Add a new analyzer for Cohere API keys.

This release ships ten new detectors, including Brightcove OAuth credentials, Infor ION API credentials, Telnyx API keys, Bifrost virtual keys, Jira Data Center personal access tokens, and a generic Sanctum token detector. Several existing detectors gain recall: Scaleway Token now catches SCW_SECRET_KEY / SCALEWAY_SECRET_KEY assignments, Username Password understands Spanish, Portuguese, French, and Turkish keywords, and the Salesforce OAuth2 Keys and Splunk Authentication Token detectors now capture the instance host alongside the credential. On the validation side, new checkers ship for Splunk authentication tokens and Artifactory reference tokens, both with custom host support, and the Salesforce and Databricks checkers move to more reliable endpoints. Eight new secret analyzers cover AWS Cognito, Alibaba Cloud, Databricks, PyPI, Contentful, and the three DigitalOcean token variants.

New Detectors​

• Brightcove OAuth Credentials: Add a new detector for Brightcove OAuth credentials.
• Infor ION API Credentials: Add a detector for Infor ION API Gateway OAuth client credentials, and capture the authorization host and token endpoint when they are present.
• Generic Sanctum Token: Add a new detector for generic Sanctum tokens.
• Telnyx API Key: Add a new detector for Telnyx API keys.
• Bifrost Virtual Key: Add a new detector for Bifrost virtual keys, matched alone or together with the URL of the Bifrost deployment.
• Bitbucket HTTP Access Token with Prefix: Add a new detector for Bitbucket HTTP access tokens with the BBDC- prefix.
• Jira Data Center Personal Access Token: Add a new detector for Jira Data Center personal access tokens.
• MetaApi Cloud Token: Add a new detector for MetaApi cloud tokens.
• Appwrite Encryption Key: Add a new detector for Appwrite instance encryption keys.
• APIclub API Key: Add a new detector for APIclub API keys.

Detector Updates​

• Salesforce Oauth2 Keys: The detector now also captures the Salesforce instance host next to the keys, and the checker validates credentials against that instance's OAuth token endpoint (production or sandbox) instead of the unreliable token introspection endpoint; it returns failed_to_check when no host is found.
• Scaleway Token: Detect SCW_SECRET_KEY / SCALEWAY_SECRET_KEY assignments, including when the word "scaleway" is absent from the document.
• Databricks Authentication Token With Hostname: Switch the checker to use a more reliable endpoint.
• Username Password: Also match Spanish, Portuguese, French, and Turkish username/password assignment keywords.
• Google API Key: Detect Google API keys that contain only one digit.
• Generic Database Assignment: The generic_database_assignment_attached_port detector has been merged into the generic_database_assignment detector.
• Splunk Authentication Token: The detector now also matches an optional Splunk host alongside the token, and a new checker validates the token against it, with custom host support.
• Artifactory Reference Token: Add a checker for Artifactory reference tokens with custom host support.
• Generic High Entropy Secret: The generic_high_entropy_secret detector now reports secrets located near a localhost mention.
• Generic Encryption Key: The generic_encryption_key detector now reports keys located near a localhost mention.

New Analyzers​

• AWS Cognito OAuth 2.0 Credentials with Host: Add a new analyzer for AWS Cognito OAuth credentials with host.
• Alibaba Cloud Keys: Add a new secret analyzer for Alibaba Cloud IAM.
• Databricks Authentication Token With Hostname: Add a new analyzer for Databricks access token with hostname.
• Python Package Index Key: Add a secret analyzer for PyPI API tokens.
• Contentful Content Management API Key: Add a secret analyzer for Contentful Content Management API keys.
• DigitalOcean Personal Access Token v1: Add a new analyzer for DigitalOcean personal access tokens v1.
• DigitalOcean Token: Add a new analyzer for DigitalOcean tokens.
• DigitalOcean OAuth Application Token v1: Add a new analyzer for DigitalOcean OAuth application tokens v1.

Analyzer Updates​

• Figma Personal Access Token: The Figma personal access token analyzer now reports the folders:read scope, which replaces the deprecated projects:read scope.

This release brings improved n8n instance detection for the n8n API Key and n8n MCP Access Token detectors, along with better recall for Hashicorp Vault AppRole Authentication credentials. Three checkers were fixed: Scaleway Token, Workato API Key and Open VSX Access Token. We also added new analyzers for Akamai API Credentials and Docker Credentials, and updated the GitLab Token, Figma Personal Access Token and OpenAI API Key analyzers.

Notable precision improvements (measured on internal benchmarks):

• generic_high_entropy_secret: reduction in false positives, from no longer reporting secrets whose assigned variable ends with checksum, with no loss of recall.

Detector Updates​

• n8n MCP Access Token: Detect n8n hosts given as a container service name or as a scheme-less hostname, and reject unreachable private IP hosts.
• Scaleway Token: Fixed scaleway_basic_auth checker always returning INVALID.
• Workato API Key: Fixed workato_api_key checker always returning INVALID.
• Generic High Entropy Secret: The generic_high_entropy_secret no longer reports secrets whose assigned variable ends with checksum.
• Open VSX Access Token: Update ovsx_access_token checker to the new behavior of the service so that invalid secrets are not returned as failed to check.
• n8n API Key: Detect n8n hosts given as a container service name or as a scheme-less hostname, and reject unreachable private IP hosts.
• Hashicorp Vault AppRole Authentication: Improve recall.

New Analyzers​

• Akamai API Credentials: Add a secret analyzer for Akamai API credentials.
• Docker Credentials: Add a new analyzer for Docker Hub personal access tokens.

Analyzer Updates​

• GitLab Token: Updated GitLab secret analyzer to adapt to changes in GitLab API behavior.
• Figma Personal Access Token: Update expected response for a particular scope following changes in the Figma API.
• OpenAI API Key: Update scope checker endpoints following updates in the OpenAI API.

This release ships six new detectors — Firebase ID tokens, Coze access tokens, Keycloak access tokens, Keycloak refresh and offline tokens, Fish Audio API keys, and Azure Custom Vision Training keys — along with a new analyzer for Apify tokens. The Docker Credentials detector now catches Docker Hub personal access tokens used with docker login --username / -u. On the validation side, the three New Relic checkers can now identify revoked keys, the Bitbucket Keys checker no longer reports invalid credentials as valid, and the Google Cloud Keys analyzer no longer raises an error when a key has no scopes or metadata.

Notable precision improvements (measured on internal benchmarks):

• fastly_personal_token: significant reduction in false positives.
• scaleway_token: significant reduction in false positives.

New Detectors​

• Firebase ID Token: Add a new detector for Firebase ID tokens.
• Coze Access Token: Add a new detector for Coze access tokens.
• Keycloak Access Token: Add a new detector for Keycloak access tokens.
• Keycloak Refresh Token: Add a new detector for Keycloak refresh and offline tokens.
• Fish Audio API Key: Add a new detector for Fish Audio API Key.
• Azure Custom Vision Training Key: Add a new detector for Azure Custom Vision Training keys.

Detector Updates​

• Fastly Personal Token: Improve precision by rejecting proxy-subscription node passwords and 32-char prefixes of longer base64url values
• Google OAuth2 Keys: Banlist the public Firebase CLI OAuth client secret
• Docker Credentials: Detect Docker Hub PATs used with docker login --username / -u
• New Relic Key: use an empty post request to check for revoked keys
• New Relic Insights Insert Key: use an empty post request to check for revoked keys
• New Relic APM License Key: use an empty post request to check for revoked keys
• Scaleway Token: Improve precision by rejecting node UUIDs from proxy-subscription configs
• Bitbucket Keys: Fix checker returning valid for invalid credentials

New Analyzers​

• Apify Token: Add a new analyzer for Apify API tokens.

Analyzer Updates​

• Google Cloud Keys: No longer raise an InvalidSecretError when no scopes and metadata are found

This release adds new detectors for Lovable project access tokens and Lovable git tokens. It also improves precision for GitHub and npm tokens: values that fail format validation are no longer reported by generic detectors.

Notable precision improvements (measured on internal benchmarks):

• github_access_token: significant reduction in false positives.
• github_oauth_token: significant reduction in false positives.
• github_app_token: significant reduction in false positives.
• npm_token: significant reduction in false positives.

New Detectors​

• Lovable Access Token: Add a new detector for Lovable project access tokens.
• Lovable Git Token: Add a new detector for Lovable git tokens.

Detector Updates​

• GitHub Personal Access Token: Values that fail format validation are no longer reported by generic detectors.
• GitHub OAuth Token: Values that fail format validation are no longer reported by generic detectors.
• GitHub App Token: Values that fail format validation are no longer reported by generic detectors.
• npm Token: Values that fail format validation are no longer reported by generic detectors.

This release adds new detectors for Slack Workflow Builder webhook trigger URLs, n8n API keys, Atlassian auth keys, AWS Cognito User Pool access tokens, OpenAI platform access tokens, Vercel OIDC tokens, and OpenCode API keys. It also introduces a new checker for Supabase service_role JWTs, and hardens the Azure Event Hub and Azure Service Bus checkers so a key is only reported as valid when the response is a genuine Service Bus feed. On the analyzer side, the GitHub Personal Access Token, GitHub App Token, and GitHub OAuth Token analyzers now build the correct URL for GitHub Enterprise custom hosts, and the Google API Key analyzer correctly handles 403 responses. Recall is improved for PostgreSQL credentials whose usernames contain dashes. Finally, the grafbase_access_token detector and checker have been removed and the Amadeus OAuth credentials detector and checker disabled, as both services are no longer available.

Notable precision improvements (measured on internal benchmarks):

• github_access_token, github_app_token, github_oauth_token, npm_token: significant reduction in false positives.
• generic_password: significant reduction in false positives.
• base64_generic_high_entropy_secret: significant reduction in false positives.
• generic_high_entropy_secret: significant reduction in false positives.
• aws_iam: significant reduction in false positives.
• curl_username_password: significant reduction in false positives.
• generic_encryption_key: significant reduction in false positives.

New Detectors​

• Slack Webhook Trigger URL: Add a new detector for Slack Workflow Builder webhook trigger URLs.
• n8n API Key: Add a new detector for n8n API keys.
• Atlassian Auth Key: Add a new detector for Atlassian auth keys (OAuth 2.0 access tokens issued by auth.atlassian.com).
• AWS Cognito Access Token: Add a new detector for AWS Cognito User Pool access tokens.
• OpenAI Access Token: Add a new detector for OpenAI platform access tokens.
• Vercel OIDC Token: Add a new detector for Vercel OIDC workload-identity tokens.
• OpenCode API Key: Add a new detector for OpenCode API keys.

Detector Updates​

• GitHub Personal Access Token: Reject tokens that fail format validation, reducing false positives.
• GitHub App Token: Reject tokens that fail format validation, reducing false positives.
• GitHub OAuth Token: Reject tokens that fail format validation, reducing false positives.
• Generic Password: Ignore passwords in public proxy-subscription configs (shadowsocks/vmess/vless/trojan/hysteria URIs, Telegram MTProto links, clash/mihomo node lists).
• Generic High Entropy Secret: Stop flagging git-sha image tags on .war and .ear artifact references (e.g. imageName: oauth-helper.war:<sha>).
• Generic High Entropy Secret: Ignore secrets in public proxy-subscription configs (incl. clash/mihomo node lists) and URL-signing tokens (S3 presigned parameters, HLS stream tokens, booking/redirect tokens).
• Base64 Generic High Entropy Secret: Ignore secrets whose decoded context is a public proxy-subscription config or a URL-signing token.
• AWS IAM Keys: Ignore presigned-URL parameters and github avatar ids.
• Curl Username Password: Ignore crypto-miner pool credentials (wallet addresses passed as curl passwords).
• PostgreSQL Credentials: PostgreSQL credentials assignment detectors now match usernames containing dashes (e.g. workflow-prod-user), which were previously truncated at the first dash. The username length bound was also raised from 20 to 30 characters to fit longer dash-separated usernames.
• Amadeus OAuth Credentials: Disable detector and checker as the Amadeus self-service API has been discontinued.
• Azure Event Hub Key: Only report the key as valid when the 200 response is a genuine Service Bus Atom feed, preventing false valid results behind intercepting proxies.
• Azure Service Bus Key: Fix Service Bus namespace extraction that truncated some namespaces, and only report the key as valid when the 200 response is a genuine Service Bus Atom feed.
• Generic Database Assignment: Merged the attached-port variant into the Generic Database Assignment detector.
• Supabase Service Role JWT: Add a new checker for Supabase service_role JWTs.
• npm Token: Reject tokens that fail format validation, reducing false positives.
• Generic Encryption Key: Ignore Talend encrypted passwords (enc:system|routine.encryption.key.vN:...).

Analyzer Updates​

• GitHub Personal Access Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom host.
• GitHub App Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• GitHub OAuth Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• Google API Key: Fixes validation of Google API keys that return 403 status code in addition to 400 status code.

Miscellaneous​

• The Grafbase Access Token detector and checker have been removed. The service for this detector is no longer available.

This release adds new detectors for the Azure Immersive Reader Key and for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan and Token Plan API keys, along with Prefect Cloud API keys; new validity checkers for Alibaba Cloud (IAM) keys and for GitLab Deploy Tokens; and a batch of detector updates — broader credential key-name coverage for the Generic High Entropy Secret detector, updated Okta host matching for regional and preview domains, sturdier Auth0 and Microsoft Power Apps Webhook validation, and HTML/Markdown file scanning extended to npm, GitHub (Personal Access, OAuth and App) and Slack tokens.

Notable precision improvements (measured on internal benchmarks):

• okta_token_with_host: precision raised from ~0% to ~100% on a manually reviewed subset, dropping generic-host false matches while capturing regional and preview host domains.
• auth0_keys: significant reduction in false positives, requiring a JSON response so non-Auth0 domains are no longer reported as valid.
• microsoft_power_apps_webhook: significant reduction in false positives, treating WorkflowNotFound responses from deleted flows as invalid.
• bearer_token: significant reduction in false positives, dropping all expired JWT tokens that would otherwise be caught by this detector as false positives.

New Detectors​

• Azure Immersive Reader Key: Add a new detector for Azure Immersive Reader Key.
• DashScope Coding Plan API Key: Add a new detector for Coding Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• DashScope Token Plan API Key: Add a new detector for Token Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• Prefect Cloud API Key: Add a new detector for Prefect Cloud API keys.

Detector Updates​

• Generic High Entropy Secret: Detect more credential key names (access, app, vault, sign, dev, prod, staging key prefixes). Encryption keys are handled by generic_encryption_key.
• Alibaba Cloud Keys: Add validity checker for Alibaba IAM.
• Okta Token with Host: Update host pattern to match regional and preview host domains.
• GitLab Deploy Token: Add validity checker when username and host are present.
• GitLab Deploy Token: Add validity checker when username and host are present.
• npm Token: Scan HTML and Markdown files
• Auth0 Keys: require a JSON response to mark secrets valid, avoiding false valid statuses when the domain is not an Auth0 tenant
• Microsoft Power Apps Webhook: treat WorkflowNotFound responses as invalid (deleted flows)
• GitHub Personal Access Token: Scan HTML and Markdown files
• GitHub OAuth Token: Scan HTML and Markdown files
• GitHub App Token: Scan HTML and Markdown files
• Slack Application Credentials: Scan HTML and Markdown files

Version 2.167.0 introduces eleven new detectors, expanding coverage across Azure services (SQL Credentials, Machine Learning, Video Indexer, Health Insights, and Fluid Relay keys), AI and LLM platforms (LiteLLM and Alibaba Cloud Model Studio / DashScope), and developer tooling (Apify, Authress, and Gemfury). It also ships new and upgraded validity checkers for LiteLLM, LaunchDarkly, Llama Cloud, New Relic APM, npm, Hume AI, and Azure SQL, improves recall for the Datadog and Snyk detectors, and fixes team-library scope detection in the Figma Personal Access Token analyzer.

Notable precision improvements (measured on internal benchmarks):

• okta_token_with_host: significant reduction in false positives, by excluding generic Okta domains (e.g. login.okta.com) from host capture.

New Detectors​

• LiteLLM API Key: Add a new detector for LiteLLM API Key without catching host.
• Azure SQL Credentials: Add a new detector for Azure SQL Assignment.
• Azure Machine Learning Key: Add detector for Azure Machine Learning keys.
• Azure Video Indexer Key: Add a new detector for Azure Video Indexer Key.
• Apify Proxy Token: Add a new detector for Apify Proxy Token.
• DashScope API Key: Add a new detector for signed (workspace) Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• Authress Access Key: Add a new detector for Authress Service Client Access Key.
• Gemfury Deploy Or Push Token Without Username: Add a new detector for Gemfury Deploy Or Push Token Without Username.
• Gemfury Full Access Token Without Username: Add a new detector for Gemfury Full Access Token Without Username.
• Azure Health Insights Key: Add a new detector for Azure Health Insights Key.
• Azure Fluid Relay Key: Add a new detector for Azure Fluid Relay Key.

Detector Updates​

• Datadog API Credentials: Improve recall for datadog_api_key.
• Snyk Key: Improve recall for snyk_key.
• Okta Token with Host: Exclude generic Okta domains from host capture.
• Hume AI API key: Update the endpoint used by this checker to fix checker failures.
• LiteLLM API Key Without Host: Add a new checker for LiteLLM API Key without host with custom host support.
• LaunchDarkly SDK Key: Upgrade checker to use the correct endpoint.
• Llama Cloud API Key: Add validity checker for llama cloud apikey.
• New Relic APM License Key: Add validity checker for New Relic APM License Key.
• npm Token: Add validity checkers for npm token and npm token prefixed.

Analyzer Updates​

• Figma Personal Access Token: Fix team library content scope detection.

This version adds nine new detectors — Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services (Maps, Mixed Reality, Service Bus, Quantum, and Bot Direct Line). It also introduces validity checkers for Gemfury Deploy/Push and Full Access tokens, refreshes the LiteLLM and GitLab runner authentication checkers, extends the Artifactory token detector to match longer host names, and updates the Google Cloud and GitLab token analyzers.

New Detectors​

• Amadeus OAuth Credentials: Add a new detector for Amadeus OAuth Credentials.
• Kinde OAuth Credentials: Add a new detector for Kinde OAuth Credentials.
• Azure Maps Key: Add a new detector for Azure Maps Key.
• Azure Mixed Reality Key: Add a new detector for Azure Mixed Reality Key.
• TomTom API Key: Add a new detector for TomTom API Key.
• Datadog Personal Access Token: Add a new detector for Datadog Personal Access Token.
• Azure Service Bus Key: Add a new detector for Azure Service Bus Key.
• Azure Quantum Key: Add a new detector for Azure Quantum Key.
• Azure Bot Direct Line Key: Add a new detector for Azure Bot Direct Line Key.

Detector Updates​

• Gemfury Deploy Or Push Token: Add a new checker for Gemfury Deploy Or Push Token.
• Gemfury Full Access Token: Add a new checker for Gemfury Full Access Token.
• LiteLLM API Key: Use the models endpoint and validate JSON response shape.
• LiteLLM API Key: Use the models endpoint and validate JSON response shape.
• GitLab runner authentication token: Fix the validity check for GitLab runner authentication tokens
• Artifactory Token With Host: Fixed artifactory_token_with_host detector to catch longer host names.

Analyzer Updates​

• Google Cloud Keys: Stop fetching project IAM members in analyzer metadata.
• GitLab Token: Fix fine-grained GitLab PAT analyzer by removing scope checkers that cannot be validated.

This release of the GitGuardian detection engine adds new detectors for Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWT Token, Kimi API Key, and Wiz OAuth Credentials. It also introduces new validity checkers — several with custom-host support — for Okta Token, Okta OAuth Credentials, Azure Communication Services Connection String, Azure Storage Account Key, AWS Cognito OAuth 2.0 Credentials, LaunchDarkly SDK Key, Pulumi Access Token, and the Python Package Index Key. A number of existing checkers were upgraded to keep pace with provider changes: AWS IAM Keys now check all AWS regions, Sumo Logic gains the Switzerland and Korea deployments (dropping the retired India endpoint), and Supabase, Vultr, Baidu AI, and SAP OAuth Credentials were updated for revised endpoints and validity handling.

Notable precision improvements (measured on internal benchmarks):

• azure_active_directory_api_keys: significant reduction in false positives.

New Detectors​

• Stitch Api Key: [Detector-builder] Add a detector for Stitch Api Key
• ActiveMQ Credentials: Add a new detector for ActiveMQ Assignment.
• Instantly API Key: Add a new detector for Instantly API Key.
• Gitea Access Token: Add a new detector for Gitea Access Token.
• Fal.ai API Key: Add a new detector for Fal.ai API Key.
• SurrealDB Cloud JWT Token: Add a new detector for SurrealDB Cloud JWT Token.
• Kimi API Key: Add a new detector for Kimi API Key.
• Wiz OAuth Credentials: Add a new detector for Wiz OAuth Credentials.

Detector Updates​

• AWS IAM Keys: Update the AWS IAM checker to check all AWS regions.
• Okta Token: Add a new checker for Okta Token with custom_host_support.
• Okta Keys: Add a new checker for Okta OAuth Credentials with custom_host_support.
• Okta Keys: Add a new checker for Okta OAuth Credentials with custom_host_support.
• Azure Communication Services Connection String: Add a new checker for Azure Communication Services Connection String.
• Microsoft Azure Storage Account Key: Add a new checker for Azure Storage Account Key with custom_host_support.
• AWS Cognito OAuth 2.0 Credentials: Add a new checker for AWS Cognito OAuth credentials with custom host support.
• LaunchDarkly SDK Key: Add a new checker for LaunchDarkly SDK Key.
• Azure Active Directory API Keys: Update the matchers to improve detection accuracy.
• Pulumi Access Token: Add a new checker for Pulumi Access Token.
• Sumo Logic Keys: Remove the non-existent India endpoint and add the Switzerland and Korea deployments.
• Supabase API Key: Return invalid when the project no longer exists, while keeping failed to check on a transient outage.
• Python Package Index Key: Add a checker validating PyPI API tokens against pypi.org and test.pypi.org
• Vultr Key: Migrate the checker to the Vultr v2 API as the v1 endpoint was removed.
• Baidu AI API Key: Use the chat/completions endpoint as the model listing endpoint no longer authenticates API keys.
• SAP OAuth Credentials: Treat a 404 from a non-existent tenant as invalid instead of failed to check.

This release of the GitGuardian detection engine adds six new detectors — for Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, and Open VSX Access Token — together with new checkers for Google OAuth2 Keys and a new analyzer for Adafruit IO API Key.

Notable precision improvements (measured on internal benchmarks):

• snyk_key: precision raised from ~40% to ~90%.
• finicity_authentication_keys: precision raised from ~67% to ~98%.
• hunter_api_key: precision raised from ~9% to ~100%.
• datadog_api_credentials: significant reduction in false positives.
• github_access_token: significant reduction in false positives.
• heroku_platform_key: significant reduction in false positives.

New Detectors​

• Authentik API Token: Add a new detector for Authentik API Token.
• Pagar.me Encryption Key: Add a new detector for Pagar.me Encryption Key.
• Adobe Refresh Token: Add a new detector for Adobe Refresh Token.
• LiteLLM API Key: Add a new detector for LiteLLM API Key.
• brapi.dev API Key: Add a new detector for brapi.dev API Key.
• Open VSX Access Token: Add a new detector for Open VSX Access Token.

Detector Updates​

• Google OAuth2 Keys: Add checkers for Google OAuth2 Keys.
• Datadog API Credentials: Improve datadog_api_key precision.
• Finicity Authentication Keys: Improve finicity_auth_keys detector precision.
• Snyk Key: Improve snyk_key detector precision.
• GitHub Personal Access Token: Improve github_token detector precision.
• Hunter API Key: Improve hunter_api_key detector precision.
• Heroku Platform Key: Improve heroku_token detector precision.

New Analyzers​

• Adafruit IO API Key: Add a new analyzer for Adafruit IO API Key.

This release adds detectors for Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials (replacing sap_ai_core_credentials). The Azure DevOps Personal Access Token, GitHub App Token, and Pagar.me API Key detectors gain support for new formats. A new checker ships for SAP OAuth Credentials and the Coralogix Personal Key checker now handles keys without granted permissions. The Datadog API Credentials and Azure OpenAI analyzers are also updated, with the latter now surfacing upstream HTTP status codes on failure.

Notable precision improvements (measured on internal benchmarks):

• azure_devops_personal_access_token: significant reduction in false positives.
• github_app_token: significant reduction in false positives.

New Detectors​

• Aikido API OAuth2 Credentials: Add a new detector for Aikido API OAuth2 Credentials.
• Logflare Access Token: Add a new detector for Logflare Access Token.
• PolyAPI API Key: Add a new detector for PolyAPI API Key.
• Apollo.io API Key: Add a new detector for Apollo API Key.
• AES Cipher Key: Add a new detector for AES Cipher Key.
• SAP OAuth Credentials: Add the sap_oauth_credentials detector. This detector replaces the sap_ai_core_credentials detector.

Detector Updates​

• Azure DevOps Personal Access Token: Improve precision and catch new formats of Azure DevOps PAT.
• GitHub App Token: Improve precision and catch new formats of GitHub Server-to-server Token.
• Pagar.me API Key: Update regex pattern to support Pagar.me API keys in sandbox environment.
• SAP OAuth Credentials: Add a checker for the sap_oauth_credentials detector.
• Coralogix Personal key: Update checker for Coralogix Personal Key to support keys without granted permissions.

Analyzer Updates​

• Datadog API Credentials: Remove apm_api_catalog_write scope checker from Datadog API credentials analyzer.
• Azure Open AI API key: Surface upstream HTTP status codes when a request to Azure OpenAI fails instead of swallowing them as a generic invalid-secret error.

This release ships 16 new detectors (Baidu AI Cloud API Key, Baidu Cloud API Keys, HashiCorp Consul ACL Token, ElevenLabs API Key, Datadog Application Key, Volcengine API Key, QQ Robot API Keys, Canva Integration OAuth 2.0, Bitrise Personal Access Token, Bitrise Workspace API Token, MaxMind License Key, Snyk Key V2, Cloudflare API Token V2, CockroachDB API Key, Coder Session Token, Aikido CI Scanning Token), updated detectors for Azure OpenAI (new key format), GitLab (fine-grained personal access tokens), Google Cloud (lower memory on secret-dense files), PayPal Braintree and Slack Bot Token (more accurate check statuses), new analyzers for Azure AI Search and Azure OpenAI, and analyzer updates for GitLab (fine-grained PATs), PostgreSQL Credentials and Anthropic Admin Key. The grafbase_access_token checker is also disabled ahead of the detector's removal in the next release.

Notable precision improvements (measured on internal benchmarks):

• paypal_braintree_keys: significant reduction in false positives.

New Detectors​

• Aikido CI Scanning Token: Add a new detector for Aikido CI Scanning Token.
• Baidu AI API Key: Add a new detector for Baidu AI Cloud API Key.
• Baidu Cloud API Keys: Add a new detector for Baidu Cloud API Keys.
• Bitrise Personal Access Token: Add a new detector for Bitrise Personal Access Token.
• Bitrise Workspace API Token: Add a new detector for Bitrise Workspace API Token.
• Canva Integration OAuth2: Add a new detector for Canva Integration OAuth 2.0.
• Cloudflare API Token: Add a new detector for Cloudflare API Token V2 with new token format.
• CockroachDB API Key: Add a new detector for CockroachDB API Key.
• Coder Session Token: Add a new detector for Coder Session Token.
• Datadog Application Key: Add a new detector for Datadog Application Key.
• ElevenLabs API Key: Add a new detector for ElevenLabs API Key.
• Hashicorp Consul ACL Token: Add a new detector for HashiCorp Consul ACL Token.
• MaxMind License Key: Add a new detector for MaxMind License Key.
• QQ Robot API Keys: Add a new detector for QQ Robot API Keys.
• Snyk Key: Add a new detector for Snyk Key V2.
• Volcengine API Key: Add a new detector for Volcengine API Key.

Detector Updates​

• Azure Open AI API key: Update the azure_open_ai_api_key detector to support the new key format.
• GitLab Token: Update GitLab checker to support fine-grained personal access tokens.
• Google Cloud Keys: The googlecloud detector now uses less memory on files full of secrets.
• Grafbase Access Token: Disabled checker for the grafbase_access_token: the service has been discontinued.
• PayPal Braintree Keys: Improve precision of PayPal Braintree Keys detector.
• Slack Bot Token: Some tokens that could have been wrongly reported as "Invalid" before are now reported as "Failed to check".

New Analyzers​

• Azure AI Search Key: Add a new analyzer for Azure AI Search Key.
• Azure Open AI API key: Add analyzer for Azure Open AI API key.

Analyzer Updates​

• Anthropic Admin Key: Only check workspace members endpoint accessibility.
• GitLab Token: Update GitLab analyzer to support fine-grained personal access tokens.
• PostgreSQL Credentials: The postgresql_credentials secret analyzer no longer fails on instances that do not support ORDER BY for ARRAY_AGG.

This release introduces new detectors for Payhere, HubSpot, Birdeye, Datadog, and GitGuardian access tokens, a new Azure SignalR checker, analyzers for Intercom, Notion, and Azure Cosmos DB, plus precision improvements to several existing detectors.

Notable precision improvements (measured on internal benchmarks):

• open_weather_map_token: precision raised from ~2.7% to ~91.7%.
• npm_token: precision raised from ~50.7% to ~99%.
• atlassian_oauth2: significant reduction in false positives.

New Detectors​

• Payhere App Credentials: Add a new detector for Payhere App Credentials with its corresponding checker.
• HubSpot API Key: Add a new detector for Hubspot API Key with its corresponding checker.
• Birdeye API Key: Add a new detector for Birdeye API Key with its corresponding checker.
• Datadog API Credentials: Add a new detector for Datadog API Keys with its corresponding checker.
• Payhere Merchant Secret: Add a new detector for Payhere Merchant Secret.
• GitGuardian Personal Access Token: Add detector and checker for GitGuardian Personal Access Token
• GitGuardian Service Access Token: Add detector and checker for GitGuardian Service Access Token

Detector Updates​

• Azure SignalR Connection String: Add a new checker for Azure SignalR Connection String.
• Jira Basic Auth: Improve jira_basic_auth content whitelist pre-validator pattern.
• Atlassian Oauth2 Keys: Improved precision by restricting the regex pattern.
• npm Token: Improve precision by updating assignment name keywords.
• OpenWeatherMap Token: Improve detector precision.

New Analyzers​

• Intercom Access Token: Add a new analyzer for Intercom Access Token.
• GitGuardian Personal Access Token: Add analyzer for GitGuardian Personal Access Token.
• GitGuardian Service Access Token: Add analyzer for GitGuardian Service Access Token.
• Notion Integration Token: Add a new analyzer for Notion Integration Token.
• Azure Cosmos DB Credentials: Add a new analyzer for Azure Cosmos DB Credentials.

This release introduces new detectors for Paymob and ConvertTo-SecureString, analyzers for Sentry, Figma, Datadog, and Google Cloud, plus various detector and checker fixes.

The highlight of this release is a new family of private key checkers. For generic PKCS#8, OpenSSH, RSA, and elliptic curve private keys, GitGuardian can now verify whether the key is registered with GitLab or GitHub, letting you distinguish live, account-linked keys from unused ones and prioritize remediation accordingly.

Notable precision improvements:

• gitlab_token: improved precision.
• azure_subscription_key: improved precision.

New Detectors and Checkers​

• Paymob API Key: Add a new detector for Paymob API Key.
• Paymob Secret Key: Add a new detector for Paymob Secret Key.

New Detectors​

• ConvertTo-SecureString Password: Add a new detector for ConvertTo-SecureString Password.
• Paymob HMAC Secret: Add a new detector for Paymob HMAC Secret.

New Checkers​

• Kubernetes Docker Secret: Add custom checkers to handle individual secrets stored in the base64-encoded string.
• Generic Private Key: Check whether a PKCS#8 private key is registered with GitLab or GitHub.
• OpenSSH Private Key: Check whether an OpenSSH private key is registered with GitLab or GitHub.
• RSA Private Key: Check whether an RSA private key is registered with GitLab or GitHub.
• Elliptic Curve Private Key: Check whether an EC private key is registered with GitLab or GitHub.

New Analyzers​

• Sentry User Auth Token: Add a new analyzer for Sentry Token.
• Figma Personal Access Token: Add a new analyzer for Figma Personal Access Token.
• Datadog API Credentials: Add a new analyzer for Datadog API credentials.
• Google Cloud Keys: Add a new analyzer for Google Cloud Keys.

Detector Upgrades​

• GitLab Token: Fix false positive matching passwords in user:pass context
• Azure Subscription Key: azure_subscription_key detector no longer mistakenly reports ServiceNow sys ID as secrets.

Checker Upgrades​

• Supabase API Key: Fix checker to correctly return INVALID for revoked keys.

This release introduces 19 new detectors and checkers including Azure, DeepL, Oracle, SAP, and Polar tokens, 4 new analyzers, and improved detection precision and checker reliability across multiple existing secrets.

Notable Detection Changes​

Starting with this release, we'll highlight notable detector changes that may affect your scan results. In this release, all detectors remain stable - you can expect minimal changes to detection accuracy. Future releases with significant changes will be called out here.

New Detectors and Checkers​

• Polar Organization Access Token: Add a detector for Polar Organization Access Token.
• Google Cloud Express API Key: Add a detector for Google Cloud Express API Key
• Microsoft Azure Storage Account Key: Add a new detector for Microsoft Azure Storage Account Key with Account Name.
• Azure Language API Key: Add a new detector for Azure Language API Key.
• Azure IoT Hub Connection String: Add a new detector for Azure IoT Hub Connection String.
• DeepL Free API Keys: Implemented detector for DeepL Free API keys
• DeepL Pro API Keys: Implemented detector for DeepL Pro API keys
• Azure Document Intelligence Key: Add a new detector for Azure Document Intelligence Key.
• Azure Speech Services Key: Add a new detector for Azure Speech Services Key.
• Azure Computer Vision Key: Add a new detector for Azure Computer Vision API Key.
• Azure Text Translation Key: Add a new detector for Azure Text Translation Key.
• Oracle Credentials: Add a new detector for Oracle JDBC credentials.
• GitGuardian Public Monitoring API Key: Add detector for new GitGuardian Public Monitoring API Key format
• GitGuardian Internal Monitoring Key: Add detector for new GitGuardian Internal Monitoring Key format
• SAP AI Core Credentials: Add a new detector for SAP AI Core Credentials.
• Odoo External API Key: Add a new detector for Odoo External API Key.

New Detectors​

• K3s Token: Add a detector for K3s tokens
• Zoho API Key: Add a detector for Zoho API Key
• ServiceNow Generic Password: Add a new detector for passwords in ServiceNow configuration files.

New Analyzers​

• Azure App Configuration Connection String: Add a new analyzer for Azure App Configuration Connection String.
• Google API Key: Add a new analyzer for Google API Key.
• Azure Speech Services Key: Add a new analyzer for Azure Speech Services Key.
• FTP Credentials: Add a new analyzer for FTP credentials.

Detector Upgrades​

• Oracle Credentials: Improve the Oracle JDBC connection string detector by updating the regex.
• AWS IAM STS Keys: Reduce false positives by requiring assignment context for client_secret match
• GitLab incoming mail token: Improve precision by updating the regex pattern.
• Pusher Channels Keys: Remove unneeded CWPV pattern
• Jina API Key: Pin key length according to empirical evidence.

Checker Upgrades​

• SMTP credentials: hard-coded well-known SMTP services parameters
• MongoDB Credentials: Fix false positives by using authenticated operation instead of server_info()
• Langfuse Credentials: Add custom host support for langfuse_credentials checker
• GitLab Agent Kubernetes Token: Add custom host support for gitlab_agent_kubernetes_token checker
• GitLab CI/CD Job Token: Add custom host support for gitlab_ci_cd_job_token checker
• GitLab SCIM Token: Add custom host support for gitlab_scim_token checker
• Microsoft Power Apps Webhook: Return invalid check status for deleted webhooks.
• Jina API Key: Interpret 402 low credit status as a sign of a valid key.
• Snowflake Credentials: Refactor snowflake_uri checker to use Snowflake's REST login endpoint.

Analyzer Upgrades​

• GitLab Token: The gitlab_token analyzer now includes more info about the token, and if available, about the token owner.
• PostgreSQL Credentials: Handle connection timeout errors gracefully with a proper AnalyzerFailed exception

This release introduces 4 new detectors for MiniMax, Retell, Azure Storage Account Key, and curl credentials, along with a 12% scanning speed improvement.

New Detectors and Checkers​

• MiniMax API Key: Added a detector and checker for MiniMax API keys.
• Retell API Key: Added a detector and checker for Retell API keys.
• Microsoft Azure Storage Account Key: Added a detector and checker for Microsoft Azure Storage Account Key with Account Name.

New Detectors​

• Curl Username Password: Added a new detector for curl username and password credentials.

Detector Improvements​

• Azure Container Registry Key: Updated detector to catch more token lengths.
• MongoDB Credentials: Fixed false positives in checker by using authenticated operation instead of server_info().

Engine Enhancements​

• Scanning speed improved by 12% as a result of optimizations to the scanner's internal logic.

Engine Performance​

This new version nearly doubles scanning speed, meaning significantly reduced scan times. Self-hosted customers will also benefit from lower resource consumption.

This release also introduces a significant expansion of detection capabilities with over 20 new detectors, particularly for Azure cloud services and payment platforms, along with new revokers and analyzer upgrades.

New Detectors and Checkers​

• WooCommerce Keys: Added a detector and checker for WooCommerce keys.
• Iyzico API Keys: Added a detector and checker for Iyzico API credentials.
• Mercado Pago OAuth: Added a detector and checker for Mercado Pago OAuth credentials.
• Kie AI API Key: Added a detector and checker for Kie AI API keys.
• Momo Credentials: Added a detector and checker for Momo credentials.
• Bitbucket HTTP Access Token: Added a detector and checker for Bitbucket HTTP access tokens.
• Cartesia API Key: Added a detector and checker for Cartesia API keys.
• PostgreSQL Credentials: Added a detector and checker for PostgreSQL assignment credentials without port.
• MariaDB Credentials: Added a detector and checker for MariaDB assignment credentials without port.
• Azure Event Hub Key: Added a detector and checker for Azure Event Hub keys.
• Azure Container Registry Key: Added a detector and checker for Azure Container Registry keys.
• Coralogix Personal Key: Added a detector and checker for Coralogix Personal keys.
• Coralogix Send-Your-Data Key: Added a detector and checker for Coralogix Send-Your-Data keys.
• Azure Web PubSub Connection String: Added a detector and checker for Azure Web PubSub connection strings.
• Azure Batch Credentials: Added a detector and checker for Azure Batch credentials.
• Azure APIM Gateway Key: Added a detector and checker for Azure APIM Gateway keys.
• Azure IoT Provisioning Connection String: Added a detector and checker for Azure IoT Provisioning connection strings.
• Azure AI Search Key: Added a detector and checker for Azure AI Search keys.
• GitLab CI/CD Job Token: Added a detector and checker for GitLab CI/CD Job tokens.
• Pagar.me API Key: Added a detector and checker for Pagar.me API keys.
• PostHog Personal API Key: Added a detector and checker for PostHog Personal API keys.

New Detectors​

• Yookassa API Key: Added a new detector for Yookassa API keys.
• WireGuard Credentials: Added a new detector for WireGuard credentials.
• Nuclei Private Key: Added a new detector for Nuclei signing keys.
• PostHog Project API Key: Added a new detector for PostHog Project API keys.
• OpenClaw Auth Token: Added a new detector for OpenClaw Auth tokens.

Detector Improvements​

• MongoDB Credentials: Improved the precision of the MongoDB Assignment No Port detector by removing false positives.
• MySQL Credentials: Improved detection precision for MySQL assignment no port by removing false positives.
• Oracle Credentials: Improved the Oracle JDBC connection string detector by increasing the minimum match length for the password.
• Username Password: Improved recall of the password regex.
• Neo4j Credentials: Fixed catastrophic backtracking when matching host.
• Generic High Entropy Secret: The detector now catches secrets assigned to variables like SECURITY_KEY.
• Databricks Authentication Token: Added support for optional single digit postfix in Databricks tokens.
• FTP Credentials: Improved recall of the FTP credentials assignment detector.
• Postman API Key: Checker now reports 403 response status code as invalid.
• Cloudflare CA Key: Updated checker to properly report 401 status code as invalid.
• Google API Key: The checker now detects more valid keys.
• Alchemy API Key: Updated deprecated base URL and request parameters in checker.
• LDAP Credentials: Added a connect timeout to the checker.

New Analyzers​

• Anthropic Admin Key: Added a new analyzer for Anthropic Admin keys.
• Azure DevOps PAT With Org: Added a new analyzer for Azure DevOps PAT with Organization.

Analyzer Upgrades​

• PostgreSQL Credentials: The analyzer now properly reports the error message instead of raising an unexpected error upon access denied for database.
• SendGrid Key: The analyzer now properly reports when no scopes are found.

New Revokers​

• SendGrid Key: Added revoker for SendGrid API keys.
• Slack User Token: Added revoker for Slack user tokens.
• Slackbot Token: Added revoker for Slackbot tokens.
• Heroku Platform Key: Added revoker for Heroku platform keys.

This release adds 7 new detectors for AI, cloud, and communication platforms including Modelscope, Deepgram, and ZegoCloud, along with enhanced Azure SAS URL detection.

New Detectors and Checkers​

• Modelscope API Key: Added a detector and checker for Modelscope API keys.
• Proxmox API Token: Added a detector and checker for Proxmox API tokens.
• ZegoCloud Secret: Added a detector and checker for ZegoCloud secrets.
• Deepgram API Key: Added a detector and checker for Deepgram API keys.
• Microsoft Power Apps Webhook: Added a detector and checker for Microsoft Power Apps Webhook URLs.
• Mem0 API Key: Added a detector and checker for Mem0 API keys.

New Detectors​

• Obsidian API Key: Added a new detector for Obsidian API keys.

Detector Improvements​

• Azure SAS URL: Widened the regex to catch more types of Azure SAS URLs.
• Okta OAuth Credentials With Host: Adjusted detector to catch more client secrets.
• Azure Entra Access Token: Fixed a crash that occurred on invalid JWT tokens.
• Azure OpenAI API Key: Improved precision of detector.
• Azure Logic App Sig Key: Deprecated detector as it caused false positives and caught secrets already detected by the Azure SAS URL detector.

Analyzer Upgrades​

• Azure SAS URL: The azure_sas_url checker now verifies the expiration date of SAS tokens.