feat: add OpenRouter detector - #4500
Conversation
f436f10 to
8cee242
Compare
c192f0c to
8cee242
Compare
|
Hey @shahzadhaider1, lmk if there's anything needed from me to move this PR forward! |
Hey @McPatate, thank you for the contribution. It looks good, but we’re currently pausing the addition of new detectors. We’ll get this merged once we’ve refined our process for maintaining them. |
|
Ok thanks for letting me know! Do you have an idea of the timeline wrt to:
? |
|
Thanks for your patience @McPatate -- we're kicking around ideas for getting this merged in a stable fashion. I should have more for you soon; hopefully today. |
|
OK I've got something of a testing strategy defined; I'm hoping to find the time today or tomorrow (likely tomorrow) to set that up and run this through. Will keep you updated. EDIT: I should say this involves running tons of specific data through this thing, so it's not the kind of test we can reasonably ask contributors to do, at least not yet. |
camgunz
left a comment
camgunz
left a comment
There was a problem hiding this comment.
OK this looks good! Again thanks for your patience.
shahzadhaider1
left a comment
shahzadhaider1
left a comment
There was a problem hiding this comment.
Looks good. Thank you for the great work. We really appreciate it.
|
Happy to contribute 😄 |
|
@shahzadhaider1 any update on this? I would like to see this change land too :) lmk if I can help |
There are currently some merge conflicts in the branch. We'll either wait for the author to resolve them or take a look ourselves and get the PR merged. |
e121ba8 to
11e5937
Compare
|
Fixed the conflicts, lmk if the PR is still the expected way to add a detector! |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
@McPatate legend, thanks! (I am not part of trufflehog, just a user that needs the change you added :P) |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 623e121. Configure here.
|
@shahzadhaider1 friendly ping :) |
* refactor: remove unnecessary `AnalysisInfo` field
Signed-off-by: Luc Georges <luc.sydney.georges@gmail.com>
Signed-off-by: Luc Georges <luc.sydney.georges@gmail.com>
a3288ca to
9ad890b
Compare
MuneebUllahKhan222
left a comment
MuneebUllahKhan222
left a comment
There was a problem hiding this comment.
LGTM. Just two non-blocking comments.
| "github.com/trufflesecurity/trufflehog/v3/pkg/engine/ahocorasick" | ||
| ) | ||
|
|
||
| func TestOpenRouter_Pattern(t *testing.T) { |
There was a problem hiding this comment.
Can we add more test and follow the pattern similar to browserStack_test.go
| var _ detectors.Detector = (*Scanner)(nil) | ||
|
|
||
| var ( | ||
| defaultClient = common.SaneHttpClient() |
There was a problem hiding this comment.
Can we use dedupe client here. Inspiration can be taken from meraki detector.
6 participants
closes #4499
Description:
Adds the OpenRouter detector as discussed in #4499.
Checklist:
make test-community)?make lintthis requires golangci-lint)?Note: I ran
make lintand I'm seeing quite the list of warnings, although none related to the changes I made afaict. Is this safe to ignore?Note
Low Risk
Additive detector-only change following existing patterns; verification is a read-only external API call with no changes to auth or core scan pipeline.
Overview
Adds OpenRouter as a new secret detector so scans can find
sk-or-v1-API keys and optionally confirm them against OpenRouter.The new scanner matches keys with a strict hex pattern, deduplicates hits, redacts output, and when verification is on calls
GET https://openrouter.ai/api/v1/keywith a Bearer token. Valid keys get extra metadata (label, limits, usage, free tier). 401 is treated as invalid; other status codes surface as verification errors.Wiring follows other gated detectors: new
DetectorType_OpenRouter(1057) in proto and generated pb,OpenRouterDetectorEnabledinpkg/feature, registration inbuildDetectorList()with feature-flag filtering, default on inmain.go, andexcludedFromDefaultListupdated so the defaults test stays consistent. Unit tests cover regex/keyword behavior; integration tests (build tagdetectors) cover live verify with GCP test secrets.Reviewed by Cursor Bugbot for commit acbc913. Bugbot is set up for automated code reviews on this repo. Configure here.