This release adds new detectors for Lovable project access tokens and Lovable git tokens. It also improves precision for GitHub and npm tokens: values that fail format validation are no longer reported by generic detectors.

Notable precision improvements (measured on internal benchmarks):

• github_access_token: significant reduction in false positives.
• github_oauth_token: significant reduction in false positives.
• github_app_token: significant reduction in false positives.
• npm_token: significant reduction in false positives.

New Detectors​

• Lovable Access Token: Add a new detector for Lovable project access tokens.
• Lovable Git Token: Add a new detector for Lovable git tokens.

Detector Updates​

• GitHub Personal Access Token: Values that fail format validation are no longer reported by generic detectors.
• GitHub OAuth Token: Values that fail format validation are no longer reported by generic detectors.
• GitHub App Token: Values that fail format validation are no longer reported by generic detectors.
• npm Token: Values that fail format validation are no longer reported by generic detectors.

This release adds new detectors for Slack Workflow Builder webhook trigger URLs, n8n API keys, Atlassian auth keys, AWS Cognito User Pool access tokens, OpenAI platform access tokens, Vercel OIDC tokens, and OpenCode API keys. It also introduces a new checker for Supabase service_role JWTs, and hardens the Azure Event Hub and Azure Service Bus checkers so a key is only reported as valid when the response is a genuine Service Bus feed. On the analyzer side, the GitHub Personal Access Token, GitHub App Token, and GitHub OAuth Token analyzers now build the correct URL for GitHub Enterprise custom hosts, and the Google API Key analyzer correctly handles 403 responses. Recall is improved for PostgreSQL credentials whose usernames contain dashes. Finally, the grafbase_access_token detector and checker have been removed and the Amadeus OAuth credentials detector and checker disabled, as both services are no longer available.

Notable precision improvements (measured on internal benchmarks):

• github_access_token, github_app_token, github_oauth_token, npm_token: significant reduction in false positives.
• generic_password: significant reduction in false positives.
• base64_generic_high_entropy_secret: significant reduction in false positives.
• generic_high_entropy_secret: significant reduction in false positives.
• aws_iam: significant reduction in false positives.
• curl_username_password: significant reduction in false positives.
• generic_encryption_key: significant reduction in false positives.

New Detectors​

• Slack Webhook Trigger URL: Add a new detector for Slack Workflow Builder webhook trigger URLs.
• n8n API Key: Add a new detector for n8n API keys.
• Atlassian Auth Key: Add a new detector for Atlassian auth keys (OAuth 2.0 access tokens issued by auth.atlassian.com).
• AWS Cognito Access Token: Add a new detector for AWS Cognito User Pool access tokens.
• OpenAI Access Token: Add a new detector for OpenAI platform access tokens.
• Vercel OIDC Token: Add a new detector for Vercel OIDC workload-identity tokens.
• OpenCode API Key: Add a new detector for OpenCode API keys.

Detector Updates​

• GitHub Personal Access Token: Reject tokens that fail format validation, reducing false positives.
• GitHub App Token: Reject tokens that fail format validation, reducing false positives.
• GitHub OAuth Token: Reject tokens that fail format validation, reducing false positives.
• Generic Password: Ignore passwords in public proxy-subscription configs (shadowsocks/vmess/vless/trojan/hysteria URIs, Telegram MTProto links, clash/mihomo node lists).
• Generic High Entropy Secret: Stop flagging git-sha image tags on .war and .ear artifact references (e.g. imageName: oauth-helper.war:<sha>).
• Generic High Entropy Secret: Ignore secrets in public proxy-subscription configs (incl. clash/mihomo node lists) and URL-signing tokens (S3 presigned parameters, HLS stream tokens, booking/redirect tokens).
• Base64 Generic High Entropy Secret: Ignore secrets whose decoded context is a public proxy-subscription config or a URL-signing token.
• AWS IAM Keys: Ignore presigned-URL parameters and github avatar ids.
• Curl Username Password: Ignore crypto-miner pool credentials (wallet addresses passed as curl passwords).
• PostgreSQL Credentials: PostgreSQL credentials assignment detectors now match usernames containing dashes (e.g. workflow-prod-user), which were previously truncated at the first dash. The username length bound was also raised from 20 to 30 characters to fit longer dash-separated usernames.
• Amadeus OAuth Credentials: Disable detector and checker as the Amadeus self-service API has been discontinued.
• Azure Event Hub Key: Only report the key as valid when the 200 response is a genuine Service Bus Atom feed, preventing false valid results behind intercepting proxies.
• Azure Service Bus Key: Fix Service Bus namespace extraction that truncated some namespaces, and only report the key as valid when the 200 response is a genuine Service Bus Atom feed.
• Generic Database Assignment: Merged the attached-port variant into the Generic Database Assignment detector.
• Supabase Service Role JWT: Add a new checker for Supabase service_role JWTs.
• npm Token: Reject tokens that fail format validation, reducing false positives.
• Generic Encryption Key: Ignore Talend encrypted passwords (enc:system|routine.encryption.key.vN:...).

Analyzer Updates​

• GitHub Personal Access Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom host.
• GitHub App Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• GitHub OAuth Token: Fix analyzer building an incorrect URL for GitHub Enterprise custom hosts.
• Google API Key: Fixes validation of Google API keys that return 403 status code in addition to 400 status code.

Miscellaneous​

• The Grafbase Access Token detector and checker have been removed. The service for this detector is no longer available.

This release adds new detectors for the Azure Immersive Reader Key and for Alibaba Cloud Model Studio (Qwen / DashScope) Coding Plan and Token Plan API keys, along with Prefect Cloud API keys; new validity checkers for Alibaba Cloud (IAM) keys and for GitLab Deploy Tokens; and a batch of detector updates — broader credential key-name coverage for the Generic High Entropy Secret detector, updated Okta host matching for regional and preview domains, sturdier Auth0 and Microsoft Power Apps Webhook validation, and HTML/Markdown file scanning extended to npm, GitHub (Personal Access, OAuth and App) and Slack tokens.

Notable precision improvements (measured on internal benchmarks):

• okta_token_with_host: precision raised from ~0% to ~100% on a manually reviewed subset, dropping generic-host false matches while capturing regional and preview host domains.
• auth0_keys: significant reduction in false positives, requiring a JSON response so non-Auth0 domains are no longer reported as valid.
• microsoft_power_apps_webhook: significant reduction in false positives, treating WorkflowNotFound responses from deleted flows as invalid.
• bearer_token: significant reduction in false positives, dropping all expired JWT tokens that would otherwise be caught by this detector as false positives.

New Detectors​

• Azure Immersive Reader Key: Add a new detector for Azure Immersive Reader Key.
• DashScope Coding Plan API Key: Add a new detector for Coding Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• DashScope Token Plan API Key: Add a new detector for Token Plan Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• Prefect Cloud API Key: Add a new detector for Prefect Cloud API keys.

Detector Updates​

• Generic High Entropy Secret: Detect more credential key names (access, app, vault, sign, dev, prod, staging key prefixes). Encryption keys are handled by generic_encryption_key.
• Alibaba Cloud Keys: Add validity checker for Alibaba IAM.
• Okta Token with Host: Update host pattern to match regional and preview host domains.
• GitLab Deploy Token: Add validity checker when username and host are present.
• GitLab Deploy Token: Add validity checker when username and host are present.
• npm Token: Scan HTML and Markdown files
• Auth0 Keys: require a JSON response to mark secrets valid, avoiding false valid statuses when the domain is not an Auth0 tenant
• Microsoft Power Apps Webhook: treat WorkflowNotFound responses as invalid (deleted flows)
• GitHub Personal Access Token: Scan HTML and Markdown files
• GitHub OAuth Token: Scan HTML and Markdown files
• GitHub App Token: Scan HTML and Markdown files
• Slack Application Credentials: Scan HTML and Markdown files

Version 2.167.0 introduces eleven new detectors, expanding coverage across Azure services (SQL Credentials, Machine Learning, Video Indexer, Health Insights, and Fluid Relay keys), AI and LLM platforms (LiteLLM and Alibaba Cloud Model Studio / DashScope), and developer tooling (Apify, Authress, and Gemfury). It also ships new and upgraded validity checkers for LiteLLM, LaunchDarkly, Llama Cloud, New Relic APM, npm, Hume AI, and Azure SQL, improves recall for the Datadog and Snyk detectors, and fixes team-library scope detection in the Figma Personal Access Token analyzer.

Notable precision improvements (measured on internal benchmarks):

• okta_token_with_host: significant reduction in false positives, by excluding generic Okta domains (e.g. login.okta.com) from host capture.

New Detectors​

• LiteLLM API Key: Add a new detector for LiteLLM API Key without catching host.
• Azure SQL Credentials: Add a new detector for Azure SQL Assignment.
• Azure Machine Learning Key: Add detector for Azure Machine Learning keys.
• Azure Video Indexer Key: Add a new detector for Azure Video Indexer Key.
• Apify Proxy Token: Add a new detector for Apify Proxy Token.
• DashScope API Key: Add a new detector for signed (workspace) Alibaba Cloud Model Studio (Qwen / DashScope) API keys.
• Authress Access Key: Add a new detector for Authress Service Client Access Key.
• Gemfury Deploy Or Push Token Without Username: Add a new detector for Gemfury Deploy Or Push Token Without Username.
• Gemfury Full Access Token Without Username: Add a new detector for Gemfury Full Access Token Without Username.
• Azure Health Insights Key: Add a new detector for Azure Health Insights Key.
• Azure Fluid Relay Key: Add a new detector for Azure Fluid Relay Key.

Detector Updates​

• Datadog API Credentials: Improve recall for datadog_api_key.
• Snyk Key: Improve recall for snyk_key.
• Okta Token with Host: Exclude generic Okta domains from host capture.
• Hume AI API key: Update the endpoint used by this checker to fix checker failures.
• LiteLLM API Key Without Host: Add a new checker for LiteLLM API Key without host with custom host support.
• LaunchDarkly SDK Key: Upgrade checker to use the correct endpoint.
• Llama Cloud API Key: Add validity checker for llama cloud apikey.
• New Relic APM License Key: Add validity checker for New Relic APM License Key.
• npm Token: Add validity checkers for npm token and npm token prefixed.

Analyzer Updates​

• Figma Personal Access Token: Fix team library content scope detection.

This version adds nine new detectors — Amadeus OAuth Credentials, Kinde OAuth Credentials, TomTom API Key, Datadog Personal Access Token, and five Azure services (Maps, Mixed Reality, Service Bus, Quantum, and Bot Direct Line). It also introduces validity checkers for Gemfury Deploy/Push and Full Access tokens, refreshes the LiteLLM and GitLab runner authentication checkers, extends the Artifactory token detector to match longer host names, and updates the Google Cloud and GitLab token analyzers.

New Detectors​

• Amadeus OAuth Credentials: Add a new detector for Amadeus OAuth Credentials.
• Kinde OAuth Credentials: Add a new detector for Kinde OAuth Credentials.
• Azure Maps Key: Add a new detector for Azure Maps Key.
• Azure Mixed Reality Key: Add a new detector for Azure Mixed Reality Key.
• TomTom API Key: Add a new detector for TomTom API Key.
• Datadog Personal Access Token: Add a new detector for Datadog Personal Access Token.
• Azure Service Bus Key: Add a new detector for Azure Service Bus Key.
• Azure Quantum Key: Add a new detector for Azure Quantum Key.
• Azure Bot Direct Line Key: Add a new detector for Azure Bot Direct Line Key.

Detector Updates​

• Gemfury Deploy Or Push Token: Add a new checker for Gemfury Deploy Or Push Token.
• Gemfury Full Access Token: Add a new checker for Gemfury Full Access Token.
• LiteLLM API Key: Use the models endpoint and validate JSON response shape.
• LiteLLM API Key: Use the models endpoint and validate JSON response shape.
• GitLab runner authentication token: Fix the validity check for GitLab runner authentication tokens
• Artifactory Token With Host: Fixed artifactory_token_with_host detector to catch longer host names.

Analyzer Updates​

• Google Cloud Keys: Stop fetching project IAM members in analyzer metadata.
• GitLab Token: Fix fine-grained GitLab PAT analyzer by removing scope checkers that cannot be validated.

This release of the GitGuardian detection engine adds new detectors for Stitch API Key, ActiveMQ Credentials, Instantly API Key, Gitea Access Token, Fal.ai API Key, SurrealDB Cloud JWT Token, Kimi API Key, and Wiz OAuth Credentials. It also introduces new validity checkers — several with custom-host support — for Okta Token, Okta OAuth Credentials, Azure Communication Services Connection String, Azure Storage Account Key, AWS Cognito OAuth 2.0 Credentials, LaunchDarkly SDK Key, Pulumi Access Token, and the Python Package Index Key. A number of existing checkers were upgraded to keep pace with provider changes: AWS IAM Keys now check all AWS regions, Sumo Logic gains the Switzerland and Korea deployments (dropping the retired India endpoint), and Supabase, Vultr, Baidu AI, and SAP OAuth Credentials were updated for revised endpoints and validity handling.

Notable precision improvements (measured on internal benchmarks):

• azure_active_directory_api_keys: significant reduction in false positives.

New Detectors​

• Stitch Api Key: [Detector-builder] Add a detector for Stitch Api Key
• ActiveMQ Credentials: Add a new detector for ActiveMQ Assignment.
• Instantly API Key: Add a new detector for Instantly API Key.
• Gitea Access Token: Add a new detector for Gitea Access Token.
• Fal.ai API Key: Add a new detector for Fal.ai API Key.
• SurrealDB Cloud JWT Token: Add a new detector for SurrealDB Cloud JWT Token.
• Kimi API Key: Add a new detector for Kimi API Key.
• Wiz OAuth Credentials: Add a new detector for Wiz OAuth Credentials.

Detector Updates​

• AWS IAM Keys: Update the AWS IAM checker to check all AWS regions.
• Okta Token: Add a new checker for Okta Token with custom_host_support.
• Okta Keys: Add a new checker for Okta OAuth Credentials with custom_host_support.
• Okta Keys: Add a new checker for Okta OAuth Credentials with custom_host_support.
• Azure Communication Services Connection String: Add a new checker for Azure Communication Services Connection String.
• Microsoft Azure Storage Account Key: Add a new checker for Azure Storage Account Key with custom_host_support.
• AWS Cognito OAuth 2.0 Credentials: Add a new checker for AWS Cognito OAuth credentials with custom host support.
• LaunchDarkly SDK Key: Add a new checker for LaunchDarkly SDK Key.
• Azure Active Directory API Keys: Update the matchers to improve detection accuracy.
• Pulumi Access Token: Add a new checker for Pulumi Access Token.
• Sumo Logic Keys: Remove the non-existent India endpoint and add the Switzerland and Korea deployments.
• Supabase API Key: Return invalid when the project no longer exists, while keeping failed to check on a transient outage.
• Python Package Index Key: Add a checker validating PyPI API tokens against pypi.org and test.pypi.org
• Vultr Key: Migrate the checker to the Vultr v2 API as the v1 endpoint was removed.
• Baidu AI API Key: Use the chat/completions endpoint as the model listing endpoint no longer authenticates API keys.
• SAP OAuth Credentials: Treat a 404 from a non-existent tenant as invalid instead of failed to check.

This release of the GitGuardian detection engine adds six new detectors — for Authentik API Token, Pagar.me Encryption Key, Adobe Refresh Token, LiteLLM API Key, brapi.dev API Key, and Open VSX Access Token — together with new checkers for Google OAuth2 Keys and a new analyzer for Adafruit IO API Key.

Notable precision improvements (measured on internal benchmarks):

• snyk_key: precision raised from ~40% to ~90%.
• finicity_authentication_keys: precision raised from ~67% to ~98%.
• hunter_api_key: precision raised from ~9% to ~100%.
• datadog_api_credentials: significant reduction in false positives.
• github_access_token: significant reduction in false positives.
• heroku_platform_key: significant reduction in false positives.

New Detectors​

• Authentik API Token: Add a new detector for Authentik API Token.
• Pagar.me Encryption Key: Add a new detector for Pagar.me Encryption Key.
• Adobe Refresh Token: Add a new detector for Adobe Refresh Token.
• LiteLLM API Key: Add a new detector for LiteLLM API Key.
• brapi.dev API Key: Add a new detector for brapi.dev API Key.
• Open VSX Access Token: Add a new detector for Open VSX Access Token.

Detector Updates​

• Google OAuth2 Keys: Add checkers for Google OAuth2 Keys.
• Datadog API Credentials: Improve datadog_api_key precision.
• Finicity Authentication Keys: Improve finicity_auth_keys detector precision.
• Snyk Key: Improve snyk_key detector precision.
• GitHub Personal Access Token: Improve github_token detector precision.
• Hunter API Key: Improve hunter_api_key detector precision.
• Heroku Platform Key: Improve heroku_token detector precision.

New Analyzers​

• Adafruit IO API Key: Add a new analyzer for Adafruit IO API Key.

This release adds detectors for Aikido API OAuth2 Credentials, Logflare Access Token, PolyAPI API Key, Apollo.io API Key, AES Cipher Key, and SAP OAuth Credentials (replacing sap_ai_core_credentials). The Azure DevOps Personal Access Token, GitHub App Token, and Pagar.me API Key detectors gain support for new formats. A new checker ships for SAP OAuth Credentials and the Coralogix Personal Key checker now handles keys without granted permissions. The Datadog API Credentials and Azure OpenAI analyzers are also updated, with the latter now surfacing upstream HTTP status codes on failure.

Notable precision improvements (measured on internal benchmarks):

• azure_devops_personal_access_token: significant reduction in false positives.
• github_app_token: significant reduction in false positives.

New Detectors​

• Aikido API OAuth2 Credentials: Add a new detector for Aikido API OAuth2 Credentials.
• Logflare Access Token: Add a new detector for Logflare Access Token.
• PolyAPI API Key: Add a new detector for PolyAPI API Key.
• Apollo.io API Key: Add a new detector for Apollo API Key.
• AES Cipher Key: Add a new detector for AES Cipher Key.
• SAP OAuth Credentials: Add the sap_oauth_credentials detector. This detector replaces the sap_ai_core_credentials detector.

Detector Updates​

• Azure DevOps Personal Access Token: Improve precision and catch new formats of Azure DevOps PAT.
• GitHub App Token: Improve precision and catch new formats of GitHub Server-to-server Token.
• Pagar.me API Key: Update regex pattern to support Pagar.me API keys in sandbox environment.
• SAP OAuth Credentials: Add a checker for the sap_oauth_credentials detector.
• Coralogix Personal key: Update checker for Coralogix Personal Key to support keys without granted permissions.

Analyzer Updates​

• Datadog API Credentials: Remove apm_api_catalog_write scope checker from Datadog API credentials analyzer.
• Azure Open AI API key: Surface upstream HTTP status codes when a request to Azure OpenAI fails instead of swallowing them as a generic invalid-secret error.

This release ships 16 new detectors (Baidu AI Cloud API Key, Baidu Cloud API Keys, HashiCorp Consul ACL Token, ElevenLabs API Key, Datadog Application Key, Volcengine API Key, QQ Robot API Keys, Canva Integration OAuth 2.0, Bitrise Personal Access Token, Bitrise Workspace API Token, MaxMind License Key, Snyk Key V2, Cloudflare API Token V2, CockroachDB API Key, Coder Session Token, Aikido CI Scanning Token), updated detectors for Azure OpenAI (new key format), GitLab (fine-grained personal access tokens), Google Cloud (lower memory on secret-dense files), PayPal Braintree and Slack Bot Token (more accurate check statuses), new analyzers for Azure AI Search and Azure OpenAI, and analyzer updates for GitLab (fine-grained PATs), PostgreSQL Credentials and Anthropic Admin Key. The grafbase_access_token checker is also disabled ahead of the detector's removal in the next release.

Notable precision improvements (measured on internal benchmarks):

• paypal_braintree_keys: significant reduction in false positives.

New Detectors​

• Aikido CI Scanning Token: Add a new detector for Aikido CI Scanning Token.
• Baidu AI API Key: Add a new detector for Baidu AI Cloud API Key.
• Baidu Cloud API Keys: Add a new detector for Baidu Cloud API Keys.
• Bitrise Personal Access Token: Add a new detector for Bitrise Personal Access Token.
• Bitrise Workspace API Token: Add a new detector for Bitrise Workspace API Token.
• Canva Integration OAuth2: Add a new detector for Canva Integration OAuth 2.0.
• Cloudflare API Token: Add a new detector for Cloudflare API Token V2 with new token format.
• CockroachDB API Key: Add a new detector for CockroachDB API Key.
• Coder Session Token: Add a new detector for Coder Session Token.
• Datadog Application Key: Add a new detector for Datadog Application Key.
• ElevenLabs API Key: Add a new detector for ElevenLabs API Key.
• Hashicorp Consul ACL Token: Add a new detector for HashiCorp Consul ACL Token.
• MaxMind License Key: Add a new detector for MaxMind License Key.
• QQ Robot API Keys: Add a new detector for QQ Robot API Keys.
• Snyk Key: Add a new detector for Snyk Key V2.
• Volcengine API Key: Add a new detector for Volcengine API Key.

Detector Updates​

• Azure Open AI API key: Update the azure_open_ai_api_key detector to support the new key format.
• GitLab Token: Update GitLab checker to support fine-grained personal access tokens.
• Google Cloud Keys: The googlecloud detector now uses less memory on files full of secrets.
• Grafbase Access Token: Disabled checker for the grafbase_access_token: the service has been discontinued.
• PayPal Braintree Keys: Improve precision of PayPal Braintree Keys detector.
• Slack Bot Token: Some tokens that could have been wrongly reported as "Invalid" before are now reported as "Failed to check".

New Analyzers​

• Azure AI Search Key: Add a new analyzer for Azure AI Search Key.
• Azure Open AI API key: Add analyzer for Azure Open AI API key.

Analyzer Updates​

• Anthropic Admin Key: Only check workspace members endpoint accessibility.
• GitLab Token: Update GitLab analyzer to support fine-grained personal access tokens.
• PostgreSQL Credentials: The postgresql_credentials secret analyzer no longer fails on instances that do not support ORDER BY for ARRAY_AGG.

This release introduces new detectors for Payhere, HubSpot, Birdeye, Datadog, and GitGuardian access tokens, a new Azure SignalR checker, analyzers for Intercom, Notion, and Azure Cosmos DB, plus precision improvements to several existing detectors.

Notable precision improvements (measured on internal benchmarks):

• open_weather_map_token: precision raised from ~2.7% to ~91.7%.
• npm_token: precision raised from ~50.7% to ~99%.
• atlassian_oauth2: significant reduction in false positives.

New Detectors​

• Payhere App Credentials: Add a new detector for Payhere App Credentials with its corresponding checker.
• HubSpot API Key: Add a new detector for Hubspot API Key with its corresponding checker.
• Birdeye API Key: Add a new detector for Birdeye API Key with its corresponding checker.
• Datadog API Credentials: Add a new detector for Datadog API Keys with its corresponding checker.
• Payhere Merchant Secret: Add a new detector for Payhere Merchant Secret.
• GitGuardian Personal Access Token: Add detector and checker for GitGuardian Personal Access Token
• GitGuardian Service Access Token: Add detector and checker for GitGuardian Service Access Token

Detector Updates​

• Azure SignalR Connection String: Add a new checker for Azure SignalR Connection String.
• Jira Basic Auth: Improve jira_basic_auth content whitelist pre-validator pattern.
• Atlassian Oauth2 Keys: Improved precision by restricting the regex pattern.
• npm Token: Improve precision by updating assignment name keywords.
• OpenWeatherMap Token: Improve detector precision.

New Analyzers​

• Intercom Access Token: Add a new analyzer for Intercom Access Token.
• GitGuardian Personal Access Token: Add analyzer for GitGuardian Personal Access Token.
• GitGuardian Service Access Token: Add analyzer for GitGuardian Service Access Token.
• Notion Integration Token: Add a new analyzer for Notion Integration Token.
• Azure Cosmos DB Credentials: Add a new analyzer for Azure Cosmos DB Credentials.

This release introduces new detectors for Paymob and ConvertTo-SecureString, analyzers for Sentry, Figma, Datadog, and Google Cloud, plus various detector and checker fixes.

The highlight of this release is a new family of private key checkers. For generic PKCS#8, OpenSSH, RSA, and elliptic curve private keys, GitGuardian can now verify whether the key is registered with GitLab or GitHub, letting you distinguish live, account-linked keys from unused ones and prioritize remediation accordingly.

Notable precision improvements:

• gitlab_token: improved precision.
• azure_subscription_key: improved precision.

New Detectors and Checkers​

• Paymob API Key: Add a new detector for Paymob API Key.
• Paymob Secret Key: Add a new detector for Paymob Secret Key.

New Detectors​

• ConvertTo-SecureString Password: Add a new detector for ConvertTo-SecureString Password.
• Paymob HMAC Secret: Add a new detector for Paymob HMAC Secret.

New Checkers​

• Kubernetes Docker Secret: Add custom checkers to handle individual secrets stored in the base64-encoded string.
• Generic Private Key: Check whether a PKCS#8 private key is registered with GitLab or GitHub.
• OpenSSH Private Key: Check whether an OpenSSH private key is registered with GitLab or GitHub.
• RSA Private Key: Check whether an RSA private key is registered with GitLab or GitHub.
• Elliptic Curve Private Key: Check whether an EC private key is registered with GitLab or GitHub.

New Analyzers​

• Sentry User Auth Token: Add a new analyzer for Sentry Token.
• Figma Personal Access Token: Add a new analyzer for Figma Personal Access Token.
• Datadog API Credentials: Add a new analyzer for Datadog API credentials.
• Google Cloud Keys: Add a new analyzer for Google Cloud Keys.

Detector Upgrades​

• GitLab Token: Fix false positive matching passwords in user:pass context
• Azure Subscription Key: azure_subscription_key detector no longer mistakenly reports ServiceNow sys ID as secrets.

Checker Upgrades​

• Supabase API Key: Fix checker to correctly return INVALID for revoked keys.

This release introduces 19 new detectors and checkers including Azure, DeepL, Oracle, SAP, and Polar tokens, 4 new analyzers, and improved detection precision and checker reliability across multiple existing secrets.

Notable Detection Changes​

Starting with this release, we'll highlight notable detector changes that may affect your scan results. In this release, all detectors remain stable - you can expect minimal changes to detection accuracy. Future releases with significant changes will be called out here.

New Detectors and Checkers​

• Polar Organization Access Token: Add a detector for Polar Organization Access Token.
• Google Cloud Express API Key: Add a detector for Google Cloud Express API Key
• Microsoft Azure Storage Account Key: Add a new detector for Microsoft Azure Storage Account Key with Account Name.
• Azure Language API Key: Add a new detector for Azure Language API Key.
• Azure IoT Hub Connection String: Add a new detector for Azure IoT Hub Connection String.
• DeepL Free API Keys: Implemented detector for DeepL Free API keys
• DeepL Pro API Keys: Implemented detector for DeepL Pro API keys
• Azure Document Intelligence Key: Add a new detector for Azure Document Intelligence Key.
• Azure Speech Services Key: Add a new detector for Azure Speech Services Key.
• Azure Computer Vision Key: Add a new detector for Azure Computer Vision API Key.
• Azure Text Translation Key: Add a new detector for Azure Text Translation Key.
• Oracle Credentials: Add a new detector for Oracle JDBC credentials.
• GitGuardian Public Monitoring API Key: Add detector for new GitGuardian Public Monitoring API Key format
• GitGuardian Internal Monitoring Key: Add detector for new GitGuardian Internal Monitoring Key format
• SAP AI Core Credentials: Add a new detector for SAP AI Core Credentials.
• Odoo External API Key: Add a new detector for Odoo External API Key.

New Detectors​

• K3s Token: Add a detector for K3s tokens
• Zoho API Key: Add a detector for Zoho API Key
• ServiceNow Generic Password: Add a new detector for passwords in ServiceNow configuration files.

New Analyzers​

• Azure App Configuration Connection String: Add a new analyzer for Azure App Configuration Connection String.
• Google API Key: Add a new analyzer for Google API Key.
• Azure Speech Services Key: Add a new analyzer for Azure Speech Services Key.
• FTP Credentials: Add a new analyzer for FTP credentials.

Detector Upgrades​

• Oracle Credentials: Improve the Oracle JDBC connection string detector by updating the regex.
• AWS IAM STS Keys: Reduce false positives by requiring assignment context for client_secret match
• GitLab incoming mail token: Improve precision by updating the regex pattern.
• Pusher Channels Keys: Remove unneeded CWPV pattern
• Jina API Key: Pin key length according to empirical evidence.

Checker Upgrades​

• SMTP credentials: hard-coded well-known SMTP services parameters
• MongoDB Credentials: Fix false positives by using authenticated operation instead of server_info()
• Langfuse Credentials: Add custom host support for langfuse_credentials checker
• GitLab Agent Kubernetes Token: Add custom host support for gitlab_agent_kubernetes_token checker
• GitLab CI/CD Job Token: Add custom host support for gitlab_ci_cd_job_token checker
• GitLab SCIM Token: Add custom host support for gitlab_scim_token checker
• Microsoft Power Apps Webhook: Return invalid check status for deleted webhooks.
• Jina API Key: Interpret 402 low credit status as a sign of a valid key.
• Snowflake Credentials: Refactor snowflake_uri checker to use Snowflake's REST login endpoint.

Analyzer Upgrades​

• GitLab Token: The gitlab_token analyzer now includes more info about the token, and if available, about the token owner.
• PostgreSQL Credentials: Handle connection timeout errors gracefully with a proper AnalyzerFailed exception

This release introduces 4 new detectors for MiniMax, Retell, Azure Storage Account Key, and curl credentials, along with a 12% scanning speed improvement.

New Detectors and Checkers​

• MiniMax API Key: Added a detector and checker for MiniMax API keys.
• Retell API Key: Added a detector and checker for Retell API keys.
• Microsoft Azure Storage Account Key: Added a detector and checker for Microsoft Azure Storage Account Key with Account Name.

New Detectors​

• Curl Username Password: Added a new detector for curl username and password credentials.

Detector Improvements​

• Azure Container Registry Key: Updated detector to catch more token lengths.
• MongoDB Credentials: Fixed false positives in checker by using authenticated operation instead of server_info().

Engine Enhancements​

• Scanning speed improved by 12% as a result of optimizations to the scanner's internal logic.

Engine Performance​

This new version nearly doubles scanning speed, meaning significantly reduced scan times. Self-hosted customers will also benefit from lower resource consumption.

This release also introduces a significant expansion of detection capabilities with over 20 new detectors, particularly for Azure cloud services and payment platforms, along with new revokers and analyzer upgrades.

New Detectors and Checkers​

• WooCommerce Keys: Added a detector and checker for WooCommerce keys.
• Iyzico API Keys: Added a detector and checker for Iyzico API credentials.
• Mercado Pago OAuth: Added a detector and checker for Mercado Pago OAuth credentials.
• Kie AI API Key: Added a detector and checker for Kie AI API keys.
• Momo Credentials: Added a detector and checker for Momo credentials.
• Bitbucket HTTP Access Token: Added a detector and checker for Bitbucket HTTP access tokens.
• Cartesia API Key: Added a detector and checker for Cartesia API keys.
• PostgreSQL Credentials: Added a detector and checker for PostgreSQL assignment credentials without port.
• MariaDB Credentials: Added a detector and checker for MariaDB assignment credentials without port.
• Azure Event Hub Key: Added a detector and checker for Azure Event Hub keys.
• Azure Container Registry Key: Added a detector and checker for Azure Container Registry keys.
• Coralogix Personal Key: Added a detector and checker for Coralogix Personal keys.
• Coralogix Send-Your-Data Key: Added a detector and checker for Coralogix Send-Your-Data keys.
• Azure Web PubSub Connection String: Added a detector and checker for Azure Web PubSub connection strings.
• Azure Batch Credentials: Added a detector and checker for Azure Batch credentials.
• Azure APIM Gateway Key: Added a detector and checker for Azure APIM Gateway keys.
• Azure IoT Provisioning Connection String: Added a detector and checker for Azure IoT Provisioning connection strings.
• Azure AI Search Key: Added a detector and checker for Azure AI Search keys.
• GitLab CI/CD Job Token: Added a detector and checker for GitLab CI/CD Job tokens.
• Pagar.me API Key: Added a detector and checker for Pagar.me API keys.
• PostHog Personal API Key: Added a detector and checker for PostHog Personal API keys.

New Detectors​

• Yookassa API Key: Added a new detector for Yookassa API keys.
• WireGuard Credentials: Added a new detector for WireGuard credentials.
• Nuclei Private Key: Added a new detector for Nuclei signing keys.
• PostHog Project API Key: Added a new detector for PostHog Project API keys.
• OpenClaw Auth Token: Added a new detector for OpenClaw Auth tokens.

Detector Improvements​

• MongoDB Credentials: Improved the precision of the MongoDB Assignment No Port detector by removing false positives.
• MySQL Credentials: Improved detection precision for MySQL assignment no port by removing false positives.
• Oracle Credentials: Improved the Oracle JDBC connection string detector by increasing the minimum match length for the password.
• Username Password: Improved recall of the password regex.
• Neo4j Credentials: Fixed catastrophic backtracking when matching host.
• Generic High Entropy Secret: The detector now catches secrets assigned to variables like SECURITY_KEY.
• Databricks Authentication Token: Added support for optional single digit postfix in Databricks tokens.
• FTP Credentials: Improved recall of the FTP credentials assignment detector.
• Postman API Key: Checker now reports 403 response status code as invalid.
• Cloudflare CA Key: Updated checker to properly report 401 status code as invalid.
• Google API Key: The checker now detects more valid keys.
• Alchemy API Key: Updated deprecated base URL and request parameters in checker.
• LDAP Credentials: Added a connect timeout to the checker.

New Analyzers​

• Anthropic Admin Key: Added a new analyzer for Anthropic Admin keys.
• Azure DevOps PAT With Org: Added a new analyzer for Azure DevOps PAT with Organization.

Analyzer Upgrades​

• PostgreSQL Credentials: The analyzer now properly reports the error message instead of raising an unexpected error upon access denied for database.
• SendGrid Key: The analyzer now properly reports when no scopes are found.

New Revokers​

• SendGrid Key: Added revoker for SendGrid API keys.
• Slack User Token: Added revoker for Slack user tokens.
• Slackbot Token: Added revoker for Slackbot tokens.
• Heroku Platform Key: Added revoker for Heroku platform keys.

This release adds 7 new detectors for AI, cloud, and communication platforms including Modelscope, Deepgram, and ZegoCloud, along with enhanced Azure SAS URL detection.

New Detectors and Checkers​

• Modelscope API Key: Added a detector and checker for Modelscope API keys.
• Proxmox API Token: Added a detector and checker for Proxmox API tokens.
• ZegoCloud Secret: Added a detector and checker for ZegoCloud secrets.
• Deepgram API Key: Added a detector and checker for Deepgram API keys.
• Microsoft Power Apps Webhook: Added a detector and checker for Microsoft Power Apps Webhook URLs.
• Mem0 API Key: Added a detector and checker for Mem0 API keys.

New Detectors​

• Obsidian API Key: Added a new detector for Obsidian API keys.

Detector Improvements​

• Azure SAS URL: Widened the regex to catch more types of Azure SAS URLs.
• Okta OAuth Credentials With Host: Adjusted detector to catch more client secrets.
• Azure Entra Access Token: Fixed a crash that occurred on invalid JWT tokens.
• Azure OpenAI API Key: Improved precision of detector.
• Azure Logic App Sig Key: Deprecated detector as it caused false positives and caught secrets already detected by the Azure SAS URL detector.

Analyzer Upgrades​

• Azure SAS URL: The azure_sas_url checker now verifies the expiration date of SAS tokens.

This release introduces 18+ new detectors covering cloud platforms, databases, and DevOps tools.

New Detectors and Checkers​

• Oracle Credentials: Added a detector and checker for Oracle JDBC connection string.
• Azure Entra App Secret: Added a detector and checker for Azure Entra App Secret.
• Azure Entra Access Token: Added a detector and checker for Azure Entra Access Token.
• GitLab SCIM Token: Added a detector and checker for GitLab SCIM Token.
• GitLab Agent Kubernetes Token: Added a detector and checker for GitLab Agent Kubernetes Token.
• ASI:One API Key: Added a detector and checker for ASI:One API keys.
• Azure IoT Device Connection String: Added a detector and checker for Azure IoT Device Connection String.
• Xendit Secret API Key: Added a detector and checker for Xendit Secret API Key.
• Supabase API Key: Added a detector and checker for Supabase API Key.
• Neoload Web Access Token: Added a detector and checker for Neoload Web Access Token.
• MongoDB Credentials: Added a new detector and checker for MongoDB assignment that does not match port.
• Azure Cache for Redis Access Key: Added a detector and checker for Azure Cache for Redis Access Key.

New Detectors​

• GitLab Feed Token: Added a new detector for GitLab feed token.
• Clerk Webhook Token: Added a new detector for Clerk Webhook Token.
• Better Auth Secret: Added a new detector for Better Auth Secret.
• Elastic Search API Key: Added a new detector for Elastic Search API Key.
• Redis Credentials: Added a new detector for Redis assignment that does not match port.
• Azure Relay Key: Added a new detector for Azure Relay Key.

Detector Improvements​

• Doppler API Key: Improved the Doppler API Key detector by widening the regex.
• Databricks Token With Hostname: Improved the Databricks Token With Hostname detector by adding support for GCP Databricks.
• JetBrains TeamCity Config Value: Fixed crash in detector that can happen with some false positives.
• Scraper API Key: Improved precision of detector.
• Slack Webhook URL: Improved the Slack Webhook URL detector to increase precision and reduce false positives.
• MongoDB Credentials: Enhanced the precision of MongoDB Assignment detector by removing the assignment prefix and adding post validators to ban other databases.
• Okta Keys: Do not match ReCAPTCHA site keys.
• Tailscale Pre-Authentication Key: Upgraded the Tailscale Pre-Authentication Key detector by widening the regex.

Analyzer Upgrades​

• Auth0 Keys: The auth0_keys analyzer now surfaces a wider range of error messages.
• Auth0 Keys: Report 404 status code as invalid for auth0_keys checker.
• Cohere API Key: Updated cohere_apikey checker to call a valid endpoint. The previous endpoint has been deprecated and removed.

This release introduces new detectors for Cloudflare R2 and Azure SAS URL, significant improvements to multiple detectors.

New Detectors and Checkers​

• Cloudflare R2 Token: Added a detector and checker for Cloudflare R2 tokens.
• Azure SAS URL: Added a detector and checker for Azure SAS URLs.
• MySQL Credentials: Added a new MySQL assignment detector that doesn't match ports.

New Checkers​

• Tailscale SCIM Key: Added a new checker for Tailscale SCIM keys.

Detector Improvements​

• SendGrid Key: Updated regex to make it stricter and updated checker endpoint.
• Dwolla Keys: Updated detector to include more values.
• PubNub Publish and Subscription Keys: Updated detector to use an AggregateMatcher instead of explicitly listing multiple matchers.
• Google OAuth2 Keys: Updated detector to use an AggregateMatcher instead of explicitly listing multiple matchers.
• Azure Cosmos DB Keys: Updated detector to use an AggregateMatcher instead of explicitly listing multiple matchers.
• Generic High Entropy Secret: Upgraded detector to remove false positives due to Google Tag Manager.
• HashiCorp Vault Token: Improved detector to not match one-time URLs anymore.
• Discord Webhook URL: Improved detector by widening the webhook_id length restrictions.
• Alchemy API Key: Updated checker endpoint.
• Fireworks AI API Key: Fixed the checker.

Miscellaneous​

• Added support for 378 new secret providers for improved incident prioritization on generic secrets.

This release introduces 6 new detectors with comprehensive coverage for cloud services and databases and support for 883 new secret providers.

New Detectors and Checkers​

• HighLevel Private Integration Token: Added a detector and checker for HighLevel Private Integration Token.
• Elastic API Key: Added a detector and checker for Elastic API keys.
• Google Cloud Keys: Added a detector and checker for Google Cloud Keys in base64 format.
• Socket Dev API Key: Added a detector and checker for Socket Dev API keys.
• Upstash Redis Credentials: Added a detector and checker for Upstash Redis credentials.
• Vapid Key: Added a new detector for Vapid keys.

New Checkers​

• Oracle Credentials: Added a new checker for Oracle credentials.

Detector Improvements​

• Cloudflare API Credentials: Updated checker to work with multiple types of tokens.
• MySQL Credentials: Enhanced recall of MySQL Assignment detector by removing the constraint on the prefix.
• GitLab Token: Updated gitlab_personal_token_v2 to cover new patterns.
• Fireworks AI API Key: Updated detector regex to improve recall.
• JSON Web Token: Fixed detector crashing if the expiration date was set to "inf".
• SSH Credentials: Updated SSH password detector to use an AggregateMatcher instead of explicitly listing multiple matchers.
• Duo Keys: Updated detector to use an AggregateMatcher instead of explicitly listing multiple matchers.
• Azure Event Grid Access Key: Updated Azure Event Grid Access Key With Host detector to use an AggregateMatcher instead of explicitly listing multiple matchers.

Analyzer Upgrades​

• AWS IAM: Removed aws_iam analyzer as AWS IAM scope analysis is now performed by NHI integration with AWS.

Miscellaneous​

• Added support for 883 new secret providers for improved incident prioritization on generic secrets.

This release adds a new Google Cloud Access Token detector and checker, along with improvements to Hashicorp Vault, PagerDuty, Docker, and FullStory detectors.

New Detectors and Checkers​

• Google Cloud Access Token: Added a new detector and checker for Google Cloud Access Tokens.

Detector Improvements​

• Hashicorp Vault Token: Updated Hashicorp Vault Token detector to catch more types of patterns.
• Google Cloud Access Token: Updated documentation and metadata for Google Cloud Access Tokens detector.
• PagerDuty Authorization Token: Updated regex with token prefix for PagerDuty authorization token detector.

Analyzer Upgrades​

• Docker Credentials: Updated docker_credentials checker endpoint.
• FullStory API Key: Updated fullstory_api_key checker endpoint.

This release introduces 13 new detectors covering AI services (Hume AI, Azure AI Face, AssemblyAI), cloud platforms (AWS Bedrock, Grafbase), and databases (Neon), plus improvements to Kubernetes, Pinecone, and Discord detectors.

New Detectors and Checkers​

• Hume AI API Key: Added a new detector and checker for Hume AI API keys.
• Hume AI Secret Key: Added a new detector and checker for Hume AI Secret keys.
• Azure AI Face Authentication: Added a new detector and checker for Azure AI Face Authentication.
• Neon API Key: Added a new detector and checker for Neon API keys.
• E2B API Key: Added a new detector and checker for E2B API keys.
• MailerSend API Key: Added a new detector and checker for MailerSend API keys.
• Scraper API Key: Added a new detector and checker for Scraper API keys.
• AIProxy API Key: Added a new detector for AIProxy API keys.
• Cloudsmith Entitlement Token: Added a new detector and checker for Cloudsmith Entitlement Tokens.
• AWS Bedrock Long-term API Key: Added a new detector and checker for AWS Bedrock Long-term API keys.
• Harness API Key: Added a new detector and checker for Harness API keys.
• Grafbase Access Token: Added a new detector and checker for Grafbase Access Tokens.
• AssemblyAI Access Token: Added a new detector and checker for AssemblyAI Access Tokens.

Detector Improvements​

• Generic Password: Removed keyword timeout to increase recall.
• Pinecone API Key: Added new detector pinecone_api_key_v2 following the new API key format, with checkers for both v2 and the original format.
• Pinecone API Keys: Deprecated detector, to be replaced by pinecone_api_key detector.
• Keycloak API Keys: Updated provider and company name to Keycloak.
• Discord Bot Token: Updated to match new pattern.
• Kubernetes JWT: Improved performance of Kubernetes JWT detector.
• Tableau Personal Access Token: Improved regex pattern for matching Tableau personal access tokens.
• Sendinblue Key: Updated provider name to Brevo (new company name).

Analyzer Upgrades​

• Snowflake Credentials: The checker for snowpark_api_credentials secrets can now recognize more valid or invalid secrets.
• Kubernetes Cluster Certificate: Changed Kubernetes API endpoint and validated the JSON answer.
• Kubernetes JWT: Changed Kubernetes API endpoint and validated the JSON answer.