Detection Engine Updates Version 2.172

  Release Date: September 14, 2026

This release ships ten new detectors, including Brightcove OAuth credentials, Infor ION API credentials, Telnyx API keys, Bifrost virtual keys, Jira Data Center personal access tokens, and a generic Sanctum token detector. Several existing detectors gain recall: Scaleway Token now catches SCW_SECRET_KEY / SCALEWAY_SECRET_KEY assignments, Username Password understands Spanish, Portuguese, French, and Turkish keywords, and the Salesforce OAuth2 Keys and Splunk Authentication Token detectors now capture the instance host alongside the credential. On the validation side, new checkers ship for Splunk authentication tokens and Artifactory reference tokens, both with custom host support, and the Salesforce and Databricks checkers move to more reliable endpoints. Eight new secret analyzers cover AWS Cognito, Alibaba Cloud, Databricks, PyPI, Contentful, and the three DigitalOcean token variants.

New Detectors

• Brightcove OAuth Credentials: Add a new detector for Brightcove OAuth credentials.
• Infor ION API Credentials: Add a detector for Infor ION API Gateway OAuth client credentials, and capture the authorization host and token endpoint when they are present.
• Generic Sanctum Token: Add a new detector for generic Sanctum tokens.
• Telnyx API Key: Add a new detector for Telnyx API keys.
• Bifrost Virtual Key: Add a new detector for Bifrost virtual keys, matched alone or together with the URL of the Bifrost deployment.
• Bitbucket HTTP Access Token with Prefix: Add a new detector for Bitbucket HTTP access tokens with the BBDC- prefix.
• Jira Data Center Personal Access Token: Add a new detector for Jira Data Center personal access tokens.
• MetaApi Cloud Token: Add a new detector for MetaApi cloud tokens.
• Appwrite Encryption Key: Add a new detector for Appwrite instance encryption keys.
• APIclub API Key: Add a new detector for APIclub API keys.

Detector Updates

• Salesforce Oauth2 Keys: The detector now also captures the Salesforce instance host next to the keys, and the checker validates credentials against that instance's OAuth token endpoint (production or sandbox) instead of the unreliable token introspection endpoint; it returns failed_to_check when no host is found.
• Scaleway Token: Detect SCW_SECRET_KEY / SCALEWAY_SECRET_KEY assignments, including when the word "scaleway" is absent from the document.
• Databricks Authentication Token With Hostname: Switch the checker to use a more reliable endpoint.
• Username Password: Also match Spanish, Portuguese, French, and Turkish username/password assignment keywords.
• Google API Key: Detect Google API keys that contain only one digit.
• Generic Database Assignment: The generic_database_assignment_attached_port detector has been merged into the generic_database_assignment detector.
• Splunk Authentication Token: The detector now also matches an optional Splunk host alongside the token, and a new checker validates the token against it, with custom host support.
• Artifactory Reference Token: Add a checker for Artifactory reference tokens with custom host support.
• Generic High Entropy Secret: The generic_high_entropy_secret detector now reports secrets located near a localhost mention.
• Generic Encryption Key: The generic_encryption_key detector now reports keys located near a localhost mention.

New Analyzers

• AWS Cognito OAuth 2.0 Credentials with Host: Add a new analyzer for AWS Cognito OAuth credentials with host.
• Alibaba Cloud Keys: Add a new secret analyzer for Alibaba Cloud IAM.
• Databricks Authentication Token With Hostname: Add a new analyzer for Databricks access token with hostname.
• Python Package Index Key: Add a secret analyzer for PyPI API tokens.
• Contentful Content Management API Key: Add a secret analyzer for Contentful Content Management API keys.
• DigitalOcean Personal Access Token v1: Add a new analyzer for DigitalOcean personal access tokens v1.
• DigitalOcean Token: Add a new analyzer for DigitalOcean tokens.
• DigitalOcean OAuth Application Token v1: Add a new analyzer for DigitalOcean OAuth application tokens v1.

Analyzer Updates

• Figma Personal Access Token: The Figma personal access token analyzer now reports the folders:read scope, which replaces the deprecated projects:read scope.