Detection Engine Updates Version 2.163

  Release Date: May 12, 2026

This release adds detectors for Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials (replacing sap_ai_core_credentials). The Azure DevOps Personal Access Token, GitHub App Token, and Pagar.me API Key detectors gain support for new formats. A new checker ships for SAP OAuth Credentials and the Coralogix Personal Key checker now handles keys without granted permissions. The Datadog API Credentials and Azure OpenAI analyzers are also updated, with the latter now surfacing upstream HTTP status codes on failure.

Notable precision improvements (measured on internal benchmarks):

• azure_devops_personal_access_token: significant reduction in false positives.
• github_app_token: significant reduction in false positives.

New Detectors

• Aikido API OAuth2 Credentials: Add a new detector for Aikido API OAuth2 Credentials.
• Logflare Access Token: Add a new detector for Logflare Access Token.
• PolyAPI API Key: Add a new detector for PolyAPI API Key.
• Apollo.io API Key: Add a new detector for Apollo API Key.
• AES Cipher Key: Add a new detector for AES Cipher Key.
• SAP OAuth Credentials: Add the sap_oauth_credentials detector. This detector replaces the sap_ai_core_credentials detector.

Detector Updates

• Azure DevOps Personal Access Token: Improve precision and catch new formats of Azure DevOps PAT.
• GitHub App Token: Improve precision and catch new formats of GitHub Server-to-server Token.
• Pagar.me API Key: Update regex pattern to support Pagar.me API keys in sandbox environment.
• SAP OAuth Credentials: Add a checker for the sap_oauth_credentials detector.
• Coralogix Personal key: Update checker for Coralogix Personal Key to support keys without granted permissions.

Analyzer Updates

• Datadog API Credentials: Remove apm_api_catalog_write scope checker from Datadog API credentials analyzer.
• Azure Open AI API key: Surface upstream HTTP status codes when a request to Azure OpenAI fails instead of swallowing them as a generic invalid-secret error.