Detection Engine Updates Version 2.174

  Release Date: October 13, 2026

TODO

New Detectors

• Lago API Key: Add a new detector for Lago API keys.
• Composio API Key: Add a new detector for Composio project API keys.
• Composio Organization API Key: Add a new detector for Composio organization API keys.
• Codex API Key: Add a new detector for Codex API keys.
• CARTO Basemaps API Key: Add a new detector for CARTO Basemaps API keys.
• Google Chat Webhook URL: Add a new detector for Google Chat incoming webhook URLs.
• SFTP Credentials: Added an sftp_credentials_assignment detector.
• HubSpot Personal Access Key: Add a new detector for HubSpot CLI personal access keys.
• AmneziaWG Private Key: Add a new detector for AmneziaWG VPN private keys.
• Kubernetes Kubeconfig Bearer Token: Add a new detector for Kubernetes bearer tokens stored in kubeconfig files.

Detector Updates

• SMTP credentials: Enable the SMTP credentials validity checker.
• SMTP credentials: Enable the SMTP credentials validity checker.
• FTP Credentials: The ftp_credentials_assignment checker now handles secrets without a port.
• FTP Credentials: The ftp_credentials_assignment checker now handles secrets without a port.
• Algolia Keys: The algolia_monitoring checker now validates all Algolia keys with more permissions than the default search key.
• Snowflake Credentials: The snowpark_api_credentials checker now supports short account identifiers, hostnames, and full Snowflake URLs.
• Snowflake Credentials: The snowpark_api_credentials checker now supports short account identifiers, hostnames, and full Snowflake URLs.
• Azure Entra App Secret: The azure_entra_app_secret detector now detects credentials declared against Microsoft national cloud sign-in hosts.
• Azure Entra App Secret: The azure_entra_app_secret detector now detects credentials declared against Microsoft national cloud sign-in hosts.
• Azure Entra Access Token: The Azure Entra Access Token checker now accepts a custom host.
• Azure Entra ID Token: Azure Entra ID token checker can now reach custom hosts through a proxy.
• Azure Entra ID Token: Azure Entra ID token checker can now reach custom hosts through a proxy.
• Azure Active Directory API Keys: The Azure Active Directory API Keys checker now accepts a custom host.
• GitHub App Token: GitHub Server-to-server Tokens in the ghs_<app id>_<JWT> format are now detected with any number of scopes, including longer tokens previously missed.
• Docker Credentials: Update docker_credentials detector to support the new format.
• Generic High Entropy Secret: The generic_high_entropy_secret no longer reports secrets that are actually part of image names coming from known container registries.
• Midtrans API Key: Fix midtrans_apikey marking invalid secrets as failed_to_check because of change in midtrans API response
• SSH Credentials: The ssh_password detector now detects passwords sent in expect scripts after an SSH password prompt.
• MSSQL Credentials: The mssql_assignment detector now detects MSSQL credentials assigned without a port.
• AWS SES Keys: The checker of the aws_ses_keys detector now has a timeout. This should reduce the number of times it gets killed by apikey-checker.
• Open VSX Access Token: The checker for the ovsx_access_token has been updated following a behavior change of OpenVSX API.
• SFTP Credentials: The ftp_credentials_assignment detector now only captures FTP secrets, not SFTP.
• GitLab Deploy Token: GitLab Deploy Token checker can now reach custom hosts through a proxy.
• LiteLLM API Key Without Host: LiteLLM API key checker can now reach custom hosts through a proxy.
• Microsoft Azure Storage Account Key: The microsoft_azure_storage_account_key detector no longer matches JFrog secrets assigned to jfrog variables.
• Azure Event Grid Access Key: The azure_event_grid_access_key_with_host detector has been merged into azure_event_grid_access_key.
• Grafana Service Account Token: The grafana_service_account_token_with_host detector has been merged into grafana_service_account_token.
• Kubernetes Service Account Token: The kubernetes_jwt_with_host detector has been merged into kubernetes_jwt.
• PlanetScale Database Password: The planetscale_database_password_with_host_and_username detector has been merged into planetscale_database_password.
• Gemfury Deploy Or Push Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
• Gemfury Full Access Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
• Snyk Key: The snyk_key_v2 checker now supports the SNYK-US-02 region.
• Snyk Key: The snyk_key_v2 checker now supports the SNYK-US-02 region.
• PostgreSQL Credentials: The detectors postgres_assignment_attached_port and postgres_assignment_no_port have been merged into the postgres_assignment detector.
• n8n API Key: The n8n API key checker now checks keys found with a host written without its scheme.
• n8n MCP Access Token: The n8n MCP access token checker now checks tokens found with a host written without its scheme.
• Generic Database Assignment: Fixed generic_database_assignment reporting the --userns CLI flag as a username, and leading dots or dashes in hosts and usernames.

New Analyzers

• GoCardless API Key: Add a new analyzer for GoCardless API access tokens.
• Adobe Refresh Token: Add a new analyzer for Adobe refresh tokens.

Analyzer Updates

• GitLab Token: Fixed GitLab analyzer failing on fine-grained personal access tokens by updating the import scope checks to match GitLab's new API behavior.

Miscellaneous

• The line_notify_token detector and checker have been removed. The service for this detector is no longer available.