Detection Engine Updates Version 2.168

  Release Date: July 20, 2026

This release adds new detectors for the Azure Immersive Reader Key and for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan and Token Plan API keys, along with Prefect Cloud API keys; new validity checkers for Alibaba Cloud (IAM) keys and for GitLab Deploy Tokens; and a batch of detector updates — broader credential key-name coverage for the Generic High Entropy Secret detector, updated Okta host matching for regional and preview domains, sturdier Auth0 and Microsoft Power Apps Webhook validation, and HTML/Markdown file scanning extended to npm, GitHub (Personal Access, OAuth and App) and Slack tokens.

Notable precision improvements (measured on internal benchmarks):

• okta_token_with_host: precision raised from ~0% to ~100% on a manually reviewed subset, dropping generic-host false matches while capturing regional and preview host domains.
• auth0_keys: significant reduction in false positives, requiring a JSON response so non-Auth0 domains are no longer reported as valid.
• microsoft_power_apps_webhook: significant reduction in false positives, treating WorkflowNotFound responses from deleted flows as invalid.
• bearer_token: significant reduction in false positives, dropping all expired JWT tokens that would otherwise be caught by this detector as false positives.

New Detectors

• Azure Immersive Reader Key: Add a new detector for Azure Immersive Reader Key.
• DashScope Coding Plan API Key: Add a new detector for Coding Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• DashScope Token Plan API Key: Add a new detector for Token Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• Prefect Cloud API Key: Add a new detector for Prefect Cloud API keys.

Detector Updates

• Generic High Entropy Secret: Detect more credential key names (access, app, vault, sign, dev, prod, staging key prefixes). Encryption keys are handled by generic_encryption_key.
• Alibaba Cloud Keys: Add validity checker for Alibaba IAM.
• Okta Token with Host: Update host pattern to match regional and preview host domains.
• GitLab Deploy Token: Add validity checker when username and host are present.
• GitLab Deploy Token: Add validity checker when username and host are present.
• npm Token: Scan HTML and Markdown files
• Auth0 Keys: require a JSON response to mark secrets valid, avoiding false valid statuses when the domain is not an Auth0 tenant
• Microsoft Power Apps Webhook: treat WorkflowNotFound responses as invalid (deleted flows)
• GitHub Personal Access Token: Scan HTML and Markdown files
• GitHub OAuth Token: Scan HTML and Markdown files
• GitHub App Token: Scan HTML and Markdown files
• Slack Application Credentials: Scan HTML and Markdown files