Detection Engine Updates Version 2.170

  Release Date: August 17, 2026

This release ships six new detectors — Firebase ID tokens, Coze access tokens, Keycloak access tokens, Keycloak refresh and offline tokens, Fish Audio API keys, and Azure Custom Vision Training keys — along with a new analyzer for Apify tokens. The Docker Credentials detector now catches Docker Hub personal access tokens used with docker login --username / -u. On the validation side, the three New Relic checkers can now identify revoked keys, the Bitbucket Keys checker no longer reports invalid credentials as valid, and the Google Cloud Keys analyzer no longer raises an error when a key has no scopes or metadata.

Notable precision improvements (measured on internal benchmarks):

• fastly_personal_token: significant reduction in false positives.
• scaleway_token: significant reduction in false positives.

New Detectors

• Firebase ID Token: Add a new detector for Firebase ID tokens.
• Coze Access Token: Add a new detector for Coze access tokens.
• Keycloak Access Token: Add a new detector for Keycloak access tokens.
• Keycloak Refresh Token: Add a new detector for Keycloak refresh and offline tokens.
• Fish Audio API Key: Add a new detector for Fish Audio API Key.
• Azure Custom Vision Training Key: Add a new detector for Azure Custom Vision Training keys.

Detector Updates

• Fastly Personal Token: Improve precision by rejecting proxy-subscription node passwords and 32-char prefixes of longer base64url values
• Google OAuth2 Keys: Banlist the public Firebase CLI OAuth client secret
• Docker Credentials: Detect Docker Hub PATs used with docker login --username / -u
• New Relic Key: use an empty post request to check for revoked keys
• New Relic Insights Insert Key: use an empty post request to check for revoked keys
• New Relic APM License Key: use an empty post request to check for revoked keys
• Scaleway Token: Improve precision by rejecting node UUIDs from proxy-subscription configs
• Bitbucket Keys: Fix checker returning valid for invalid credentials

New Analyzers

• Apify Token: Add a new analyzer for Apify API tokens.

Analyzer Updates

• Google Cloud Keys: No longer raise an InvalidSecretError when no scopes and metadata are found