Detection Engine Updates Version 2.169

  Release Date: August 3, 2026

This release adds new detectors for Slack Workflow Builder webhook trigger URLs, n8n API keys, Atlassian auth keys, AWS Cognito User Pool access tokens, OpenAI platform access tokens, Vercel OIDC tokens, and OpenCode API keys. It also introduces a new checker for Supabase service_role JWTs, and hardens the Azure Event Hub and Azure Service Bus checkers so a key is only reported as valid when the response is a genuine Service Bus feed. On the analyzer side, the GitHub Personal Access Token, GitHub App Token, and GitHub OAuth Token analyzers now build the correct URL for GitHub Enterprise custom hosts, and the Google API Key analyzer correctly handles 403 responses. Recall is improved for PostgreSQL credentials whose usernames contain dashes. Finally, the grafbase_access_token detector and checker have been removed and the Amadeus OAuth credentials detector and checker disabled, as both services are no longer available.

Notable precision improvements (measured on internal benchmarks):

• github_access_token, github_app_token, github_oauth_token, npm_token: significant reduction in false positives.
• generic_password: significant reduction in false positives.
• base64_generic_high_entropy_secret: significant reduction in false positives.
• generic_high_entropy_secret: significant reduction in false positives.
• aws_iam: significant reduction in false positives.
• curl_username_password: significant reduction in false positives.
• generic_encryption_key: significant reduction in false positives.

New Detectors

• Slack Webhook Trigger URL: Add a new detector for Slack Workflow Builder webhook trigger URLs.
• n8n API Key: Add a new detector for n8n API keys.
• Atlassian Auth Key: Add a new detector for Atlassian auth keys (OAuth 2.0 access tokens issued by auth.atlassian.com).
• AWS Cognito Access Token: Add a new detector for AWS Cognito User Pool access tokens.
• OpenAI Access Token: Add a new detector for OpenAI platform access tokens.
• Vercel OIDC Token: Add a new detector for Vercel OIDC workload-identity tokens.
• OpenCode API Key: Add a new detector for OpenCode API keys.

Detector Updates

• GitHub Personal Access Token: Reject tokens that fail format validation, reducing false positives.
• GitHub App Token: Reject tokens that fail format validation, reducing false positives.
• GitHub OAuth Token: Reject tokens that fail format validation, reducing false positives.
• Generic Password: Ignore passwords in public proxy-subscription configs (shadowsocks/vmess/vless/trojan/hysteria URIs, Telegram MTProto links, clash/mihomo node lists).
• Generic High Entropy Secret: Stop flagging git-sha image tags on .war and .ear artifact references (e.g. imageName: oauth-helper.war:<sha>).
• Generic High Entropy Secret: Ignore secrets in public proxy-subscription configs (incl. clash/mihomo node lists) and URL-signing tokens (S3 presigned parameters, HLS stream tokens, booking/redirect tokens).
• Base64 Generic High Entropy Secret: Ignore secrets whose decoded context is a public proxy-subscription config or a URL-signing token.
• AWS IAM Keys: Ignore presigned-URL parameters and github avatar ids.
• Curl Username Password: Ignore crypto-miner pool credentials (wallet addresses passed as curl passwords).
• PostgreSQL Credentials: PostgreSQL credentials assignment detectors now match usernames containing dashes (e.g. workflow-prod-user), which were previously truncated at the first dash. The username length bound was also raised from 20 to 30 characters to fit longer dash-separated usernames.
• Amadeus OAuth Credentials: Disable detector and checker as the Amadeus self-service API has been discontinued.
• Azure Event Hub Key: Only report the key as valid when the 200 response is a genuine Service Bus Atom feed, preventing false valid results behind intercepting proxies.
• Azure Service Bus Key: Fix Service Bus namespace extraction that truncated some namespaces, and only report the key as valid when the 200 response is a genuine Service Bus Atom feed.
• Generic Database Assignment: Merged the attached-port variant into the Generic Database Assignment detector.
• Supabase Service Role JWT: Add a new checker for Supabase service_role JWTs.
• npm Token: Reject tokens that fail format validation, reducing false positives.
• Generic Encryption Key: Ignore Talend encrypted passwords (enc:system|routine.encryption.key.vN:...).

Analyzer Updates

• GitHub Personal Access Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom host.
• GitHub App Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• GitHub OAuth Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• Google API Key: Fixes validation of Google API keys that return 403 status code in addition to 400 status code.

Miscellaneous

• The Grafbase Access Token detector and checker have been removed. The service for this detector is no longer available.