[INS-351] Added Duffel Token Detector

[MuneebUllahKhan222]

Description

This PR adds the Duffel API Token Detector for TruffleHog.
It scans for Duffel sandbox API tokens (prefix duffel_test_ or duffel_live_) and optionally verifies them via the Duffel API.

Regex: \b(duffel_(test|live)_[A-Za-z0-9_-]{43})(?:$|[^A-Za-z0-9_-])

Verification

For verification, we use the Duffel Users API: /identity/customer/users?limit=1.
We send a GET request with the token in the Authorization header.

A response code of:

• 200 OK → token is valid
• 401 Unauthorized → token is invalid
• 403 Forbidden → token exists but is revoked or has insufficient permissions

This endpoint is part of the official Duffel API and can be used safely for verification.
It is read-only, does not create or modify resources, and simply confirms whether the provided token is valid.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Additive detector behind a feature flag; verification only performs a read-only external API call, matching existing TruffleHog detector patterns.

Overview
Adds a DuffelToken detector that finds duffel_test_ and duffel_live_ API tokens (43-character suffix) and optionally verifies them against Duffel’s read-only GET /identity/customer/users?limit=1 endpoint (Bearer + Duffel-Version: v2).

Wiring follows the usual new-detector path: DetectorType_DuffelToken (1059) in proto, scanner registered in buildDetectorList(), gated by DuffelTokenDetectorEnabled (enabled in main.go), and listed in excludedFromDefaultList for the proto coverage test. Unit, pattern, integration, and benchmark tests are included under pkg/detectors/duffeltoken/.

^{Reviewed by Cursor Bugbot for commit 91cb3f0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[kashifkhan0771]

Just two non-blocking comments but I would highly appreciate if we can improve pattern test cases as I mentioned.

[kashifkhan0771]

Non-blocking comment: As now we have a DoWithDedup we can use it in new detectors.
Example:

resp, err := detectors.DoWithDedup(client, detector_typepb.DetectorType_Meraki, match, req)
if err != nil {
  return nil, false, err
}

[kashifkhan0771]

Pattern test cases are one of the most critical parts of any detector, so I'd suggest taking the time to write them thoroughly.

We've already spent a lot of time cleaning up and improving the test cases across existing detectors, and I'd like to avoid creating another backlog of fixes.

For reference, have a look at:

• https://github.com/trufflesecurity/trufflehog/blob/main/pkg/detectors/browserstack/browserstack_test.go
• Example PR where we improved the test cases: Added pattern test cases for detectors starting with Alphabet C #3564

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit f3c209a. Configure here.}