Detection Engine Updates Version 2.175

  Release Date: October 27, 2026

Version 2.175.0 adds a new detector for Portainer API keys, which can also match the URL of the Portainer instance. It adds checkers for Weights & Biases API keys and for ODBC connection strings (SQL Server, MySQL, PostgreSQL, Oracle and DB2). Eight checkers that need a custom host are now available: JFrog Artifactory tokens and reference tokens, AWS Cognito OAuth 2.0 credentials, Bitbucket Data Center HTTP access tokens, Jira Data Center personal access tokens, Microsoft Azure Storage account keys, and Okta keys and tokens. Recall improves for json_web_token, which now finds tokens split across several string literals, and for sentry_org_auth_token. jenkins_api_token can now also match the Jenkins instance URL. The Keycloak access token checker no longer reports revoked or logged-out tokens as valid. microsoft_azure_storage_account_key_with_account_name moves to its own detector group. On the analyzer side, there is a new analyzer for Weights & Biases API keys, and the Google Cloud analyzer no longer fails on service account keys without project permissions.

Notable precision improvements (measured on internal benchmarks):

• generic_password: significant reduction in false positives.
• generic_high_entropy_secret: significant reduction in false positives.

New Detectors

• Portainer API Key: Add a new detector for Portainer API keys, matched alone or together with the URL of the Portainer instance.

Detector Updates

• Weights & Biases API Key: Add a checker for Weights & Biases API keys.
• Artifactory Reference Token: The JFrog Artifactory reference token checker is now available, and requires a custom host.
• Artifactory Token: The JFrog Artifactory token checker is now available, and requires a custom host.
• AWS Cognito OAuth 2.0 Credentials: The AWS Cognito OAuth credentials checker is now available, and requires a custom host.
• Bitbucket HTTP Access Token with Prefix: The Bitbucket Data Center HTTP access token checker is now available, and requires a custom host.
• Jira Data Center Personal Access Token: The Jira Data Center personal access token checker is now available, and requires a custom host.
• Microsoft Azure Storage Account Key: The Microsoft Azure Storage account key checker is now available, and requires a custom host.
• Okta Keys: The Okta OAuth credentials checker is now available, and requires a custom host.
• Okta Token: The Okta token checker is now available, and requires a custom host.
• Microsoft Azure Storage Account Key with Account Name: The microsoft_azure_storage_account_key_with_account_name detector has been moved to its own detector group.
• ODBC Connection String: Added a checker for ODBC connection strings, which supports SQL Server, MySQL, PostgreSQL, Oracle and DB2 databases.
• Generic Password: The generic_password detector no longer reports character sets used to generate passwords.
• JSON Web Token: The json_web_token detector now detects JSON Web Tokens split across several string literals on consecutive lines.
• Generic High Entropy Secret: The generic_high_entropy_secret detector no longer reports Confluence CSRF tokens as secrets.
• Authentication Tuple: The authentication tuple detector no longer reports underscore-prefixed all-caps constant names as credentials.
• Jenkins API token: Add an optional host match that detects the Jenkins instance URL.
• OpenCode API Key: Update the endpoint used by the checker.
• Sentry Org Auth Token: The sentry_org_auth_token detector now catches more secrets.
• Keycloak Access Token: The keycloak_access_token checker no longer reports revoked or logged-out tokens as valid.

New Analyzers

• Weights & Biases API Key: Add a secret analyzer for Weights & Biases API keys.

Analyzer Updates

• Google Cloud Keys: The Google Cloud analyzer no longer fails on service account keys without project permissions.