Skip to main content

Detection Engine Updates Version 2.174

calendar icon   Release Date: October 13, 2026

Version 2.174.0 adds ten new detectors, covering Lago API keys, Composio project and organization API keys, Codex API keys, CARTO Basemaps API keys, Google Chat incoming webhook URLs, SFTP credentials, HubSpot CLI personal access keys, AmneziaWG VPN private keys and Kubernetes kubeconfig bearer tokens. Two new analyzers are available, for GoCardless API access tokens and Adobe refresh tokens. A validity checker is now enabled for SMTP credentials, and existing checkers were improved across Algolia, Snowflake, Snyk (SNYK-US-02), Azure Entra, Azure Active Directory, GitLab Deploy Tokens, LiteLLM, n8n, Open VSX, Midtrans, AWS SES and FTP credentials, mainly to reach custom hosts and proxies, handle secrets without a port, and avoid spurious failed_to_check results. Detection coverage also grew for GitHub App server-to-server tokens, Docker credentials, Gemfury tokens, SSH passwords in expect scripts, MSSQL credentials without a port, and Azure Entra app secrets declared against Microsoft national cloud sign-in hosts. On the maintenance side, the _with_host variants of the Azure Event Grid, Grafana service account, Kubernetes service account and PlanetScale detectors were merged into their base detectors, the PostgreSQL port variants were merged into postgres_assignment, and the deprecated line_notify_token detector was removed.

Notable precision improvements (measured on internal benchmarks):

  • generic_high_entropy_secret: significant reduction in false positives, with image names from known container registries no longer reported.
  • generic_database_assignment: significant reduction in false positives from shell command substitutions, empty defaults, the --userns flag and malformed host or username values.
  • microsoft_azure_storage_account_key: significant reduction in false positives caused by JFrog reference tokens assigned to jfrog variables.

New Detectors​

Detector Updates​

  • SMTP credentials: Enable the SMTP credentials validity checker.
  • FTP Credentials: The ftp_credentials_assignment checker now handles secrets without a port.
  • Algolia Keys: The algolia_monitoring checker now validates all Algolia keys with more permissions than the default search key.
  • Snowflake Credentials: The snowpark_api_credentials checker now supports short account identifiers, hostnames, and full Snowflake URLs.
  • Azure Entra App Secret: The azure_entra_app_secret detector now detects credentials declared against Microsoft national cloud sign-in hosts.
  • Azure Entra Access Token: The Azure Entra Access Token checker now accepts a custom host.
  • Azure Entra ID Token: Azure Entra ID token checker can now reach custom hosts through a proxy.
  • Azure Active Directory API Keys: The Azure Active Directory API Keys checker now accepts a custom host.
  • GitHub App Token: GitHub Server-to-server Tokens in the ghs_<app id>_<JWT> format are now detected with any number of scopes, including longer tokens previously missed.
  • Docker Credentials: Update docker_credentials detector to support the new format.
  • Generic High Entropy Secret: The generic_high_entropy_secret no longer reports secrets that are actually part of image names coming from known container registries.
  • Midtrans API Key: Fix midtrans_apikey marking invalid secrets as failed_to_check because of change in midtrans API response
  • SSH Credentials: The ssh_password detector now detects passwords sent in expect scripts after an SSH password prompt.
  • MSSQL Credentials: The mssql_assignment detector now detects MSSQL credentials assigned without a port.
  • AWS SES Keys: The checker of the aws_ses_keys detector now has a timeout. This should reduce the number of times it gets killed by apikey-checker.
  • Open VSX Access Token: The checker for the ovsx_access_token has been updated following a behavior change of OpenVSX API.
  • SFTP Credentials: The ftp_credentials_assignment detector now only captures FTP secrets, not SFTP.
  • GitLab Deploy Token: GitLab Deploy Token checker can now reach custom hosts through a proxy.
  • LiteLLM API Key Without Host: LiteLLM API key checker can now reach custom hosts through a proxy.
  • Microsoft Azure Storage Account Key: The microsoft_azure_storage_account_key detector no longer matches JFrog secrets assigned to jfrog variables.
  • Azure Event Grid Access Key: The azure_event_grid_access_key_with_host detector has been merged into azure_event_grid_access_key.
  • Grafana Service Account Token: The grafana_service_account_token_with_host detector has been merged into grafana_service_account_token.
  • Kubernetes Service Account Token: The kubernetes_jwt_with_host detector has been merged into kubernetes_jwt.
  • PlanetScale Database Password: The planetscale_database_password_with_host_and_username detector has been merged into planetscale_database_password.
  • Gemfury Deploy Or Push Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
  • Gemfury Full Access Token: Update Gemfury detectors to detect credentials outside Gemfury repository URLs.
  • Snyk Key: The snyk_key_v2 checker now supports the SNYK-US-02 region.
  • PostgreSQL Credentials: The detectors postgres_assignment_attached_port and postgres_assignment_no_port have been merged into the postgres_assignment detector.
  • n8n API Key: The n8n API key checker now checks keys found with a host written without its scheme.
  • n8n MCP Access Token: The n8n MCP access token checker now checks tokens found with a host written without its scheme.
  • Generic Database Assignment: Fixed generic_database_assignment reporting the --userns CLI flag as a username, and leading dots or dashes in hosts and usernames.

New Analyzers​

Analyzer Updates​

  • GitLab Token: Fixed GitLab analyzer failing on fine-grained personal access tokens by updating the import scope checks to match GitLab's new API behavior.

Miscellaneous​

  • The line_notify_token detector and checker have been removed. The service for this detector is no longer available.

Something we didn’t cover?

See our Roadmap
Subscribe on GitHub
Submit a request
API status