Detection Engine Updates Version 2.178

  Release Date: November 11, 2026

This release adds eight new detectors, mostly around Google and AWS: Google OAuth2 refresh tokens found without their client ID, Google Cloud Storage HMAC keys, AWS AppSync API keys, AWS CodeArtifact authorization tokens, and base64-encoded variants of four Google detectors (API keys, OAuth2 keys, OAuth2 refresh tokens, and Cloud OAuth2 access tokens). The HashiCorp Vault token, AppRole, and unseal key detectors now also report the host of the Vault instance when it appears next to the credentials, and AWS Bedrock long-term API key detection now covers keys created outside the console. Several checkers were fixed: base64 AWS IAM, AWS SES, and Midtrans keys embedded in a larger base64 string, Cloudant IAM credentials, and AWS Cognito access tokens, which are no longer reported as invalid before they expire. New analyzers cover Grafana service account tokens and Cloudinary API keys, and the Google API key analyzer now supports base64-encoded keys. Two detectors were renamed: Google Cloud Express API Key is now Google Gemini API Key, and the former Google Gemini API Key is now Google Bard Session Cookie.

Notable precision improvements (measured on internal benchmarks):

• google_oauth2_keys: significant reduction in false positives.

New Detectors

• Google OAuth2 Refresh Token Without Client: Detect Google OAuth2 refresh tokens found without their client ID.
• Google Cloud OAuth2 Access Token: Added the base64_googlecloud_access_token detector for base64-encoded Google Cloud OAuth2 access tokens.
• Google OAuth2 Keys: Added the base64_google_oauth2 detector for base64-encoded Google OAuth2 keys.
• Google OAuth2 Refresh Token: Added the base64_google_oauth2_refresh_token detector for base64-encoded Google OAuth2 refresh tokens.
• Google Cloud Storage HMAC Key: Added the googlecloud_storage_hmac_key detector for Google Cloud Storage HMAC keys.
• Google API Key: Added the base64_googleaiza detector for base64-encoded Google API keys.
• AWS AppSync API Key: Add a new detector for AWS AppSync API keys.
• AWS CodeArtifact Authorization Token: Added detector for AWS codeartifact authorization tokens.

Detector Updates

• Hashicorp Vault Token: HashiCorp Vault token detector now also reports the host of the Vault instance when it appears next to the token.
• Hashicorp Vault AppRole Authentication: HashiCorp Vault AppRole detector now also reports the host of the Vault instance when it appears next to the credentials.
• HashiCorp Vault Unseal Key: HashiCorp Vault unseal key detector now also reports the host of the Vault instance when it appears next to the key.
• Base64 AWS keys: Fixed base64_aws_iam checker and revoker failing on keys embedded in a larger base64 string.
• AWS Cognito Access Token: AWS Cognito access tokens without the user admin scope are no longer reported as invalid while they have not expired.
• AWS Bedrock Long-term API key: Improved detection of AWS Bedrock long-term API keys.
• Google OAuth2 Keys: Banlist the public OAuth client secret of Antigravity.
• Google OAuth2 Refresh Token: Skip truncated refresh tokens: require at least 95 characters after the 1//0 prefix.
• Cloudant IAM: Fixed checker for cloudant_iam detector: test all domain names, return INVALID instead of FAILED_TO_CHECK for invalid credentials.
• Google Gemini API Key: Renamed the Google Cloud Express API Key detector to Google Gemini API Key.
• Google Bard Session Cookie: Renamed the Google Gemini API Key detector to Google Bard Session Cookie.
• Base64 AWS SES keys: Fixed base64_aws_ses_keys checker failing on keys embedded in a larger base64 string.
• Midtrans API Key: Fixed base64_midtrans_apikey checker failing on keys embedded in a larger base64 string.

New Analyzers

• Grafana Service Account Token: Added an analyzer for Grafana service account tokens.
• Cloudinary API keys: Added an analyzer for Cloudinary API keys.

Analyzer Updates

• Google API Key: Google API key analyzer now supports base64-encoded keys.