Detection Engine Updates Version 2.176

  Release Date: November 9, 2026

This release adds new detectors for Supabase personal access tokens, Google OAuth2 refresh tokens, and Food Safety Korea API keys. The private key checkers (RSA, elliptic curve, OpenSSH, and generic, including their base64 variants) can now validate SSH keys against a custom host, such as a self-hosted GitLab or GitHub Enterprise instance, and the Azure DevOps checker now reports invalid tokens correctly instead of failing to check them. It also brings 23 new analyzers covering DeepSeek, Groq, Telegram, GitLab self-managed and runner tokens, New Relic, Amp, Sourcegraph, Gemfury, Mercado Pago, Cloudflare, Facebook, LlamaCloud, and Azure Entra, along with analyzer fixes for PostgreSQL, Google API keys, and GitLab. The Azure Subscription Key detector gains recall.

Notable precision improvements (measured on internal benchmarks):

• splunk_token: significant reduction in false positives.
• generic_password: significant reduction in false positives.
• generic_high_entropy_secret: significant reduction in false positives.
• base64_generic_high_entropy_secret: significant reduction in false positives.
• generic_encryption_key: significant reduction in false positives.

New Detectors

• Supabase Personal Access Token: Add a new detector for Supabase personal access tokens (classic, scoped and sbp_v0_).
• Google OAuth2 Refresh Token: Detect Google OAuth2 refresh tokens with their client ID and secret, such as gcloud application default credentials.
• Food Safety Korea API Key: Add a new detector to detect Food Safety Korea Open API keys.

Detector Updates

• RSA Private Key: The private_key_rsa and base64_private_key_rsa checkers can now check SSH keys against a custom host.
• Elliptic Curve Private Key: The private_key_elliptic and base64_private_key_elliptic checkers can now check SSH keys against a custom host.
• OpenSSH Private Key: The private_key_openssh and base64_private_key_openssh checkers can now check SSH keys against a custom host.
• Generic Private Key: The private_key_generic and base64_private_key_generic checkers can now check SSH keys against a custom host, such as a self-hosted GitLab or GitHub Enterprise instance.
• Splunk Authentication Token: The splunk_token detector no longer reports Snyk tokens as Splunk Authentication Tokens.
• Azure Subscription Key: Update the azure_subscription_key detector to improve recall.
• Generic Password: Generic Password detector no longer reports UI labels in XML and HTML files, such as translated strings in Android strings.xml.
• Azure DevOps Personal Access Token with Organization: Fixed Azure DevOps checker returning FAILED_TO_CHECK instead of INVALID for some invalid tokens.
• Generic High Entropy Secret: The generic_high_entropy_secret detector no longer reports AWS access key IDs as secrets.
• Base64 Generic High Entropy Secret: PostHog project tokens are no longer reported.
• Generic Encryption Key: PostHog project tokens are no longer reported.
• Hashicorp Vault AppRole Authentication: The hashicorp_vault_approle_auth detector now ignores low-entropy placeholder role and secret IDs.

New Analyzers

• DeepSeek API Key: Added an analyzer for DeepSeek API keys, reporting the account balance with its currency, whether it is available, and the models the key can use.
• Groq API Key: Added an analyzer for Groq API keys, reporting the models the key can use.
• Telegram Bot Token: Added an analyzer for Telegram bot tokens, reporting the bot username and name.
• GitLab Enterprise Token: Added an analyzer for GitLab self-managed personal access tokens.
• GitLab runner authentication token: Added an analyzer for GitLab runner authentication tokens.
• New Relic Admin Key: Added an analyzer for New Relic admin keys.
• New Relic API Key: Added an analyzer for New Relic REST API keys.
• New Relic API Service Key: Added an analyzer for New Relic user keys.
• AMP API User Token: Added an analyzer for Amp API tokens.
• Sourcegraph Access Token: Added an analyzer for Sourcegraph access tokens.
• Gemfury Deploy Or Push Token: Added an analyzer for Gemfury deploy and push tokens.
• Gemfury Deploy Or Push Token Without Username: Added an analyzer for Gemfury deploy and push tokens.
• Gemfury Full Access Token: Added an analyzer for Gemfury full access tokens.
• Gemfury Full Access Token Without Username: Added an analyzer for Gemfury full access tokens.
• Mercado Pago Access Token: Added an analyzer for Mercado Pago access tokens.
• Mercado Pago OAuth: Added an analyzer for Mercado Pago OAuth credentials.
• Cloudflare API Token: Added an analyzer for Cloudflare API tokens.
• Cloudflare R2 Token: Added an analyzer for Cloudflare R2 tokens.
• Cloudflare Authentication Credentials: Added an analyzer for Cloudflare global API keys.
• Facebook Access Token: Added an analyzer for Facebook access tokens.
• Facebook App Keys: Added an analyzer for Facebook app keys.
• Llama Cloud API Key: Added an analyzer for LlamaCloud API keys.
• Azure Entra App Secret: Added an analyzer for Azure Entra app secrets.

Analyzer Updates

• PostgreSQL Credentials: PostgreSQL analyzer now times out long queries.
• Google API Key: Fixed the Google API key analyzer failing on Firebase Auth projects by accepting a 200 from the Identity Toolkit password policy endpoint.
• GitLab Token: GitLab analyzer no longer checks the knowledge_graph:read scope.