[INS-341] Added Shippo detector

[MuneebUllahKhan222]

Description:

This PR adds the Shippo API Token Detector for TruffleHog. It scans for both live and test API tokens used by the Shippo shipping platform and supports live verification against the Shippo API.

API Token Regex: \b(shippo_(live|test)_[a-f0-9]{40})\b

Verification:

Verification is performed by sending a GET request to the /v1/shippo-accounts endpoint. The detected token is passed in the Authorization header using the ShippoToken scheme.

Corpora Test:

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Additive detector following existing patterns; verification only runs when scanning with verification enabled and uses outbound HTTP like other API-key detectors.

Overview
Adds a Shippo secret detector for shippo_live_ and shippo_test_ tokens (40 hex chars), with keyword pre-filtering and optional live verification against api.goshippo.com using the ShippoToken authorization scheme on the shippo-accounts endpoint.

Wires it into the product like other gated detectors: new DetectorType_Shippo (1060) in proto/generated code, ShippoDetectorEnabled feature flag (on by default in main), registration in buildDetectorList() with flag-based filtering, and updates to the defaults exclusion test. Includes unit tests for regex/keywords and integration tests (GCP-backed) for verification paths.

^{Reviewed by Cursor Bugbot for commit 710f2a8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 3f183a2. Configure here.}

[cursor]

HTTP 403 incorrectly treated as invalid token

Medium Severity

The verifyShippoToken function treats http.StatusForbidden (403) the same as http.StatusUnauthorized (401), marking the token as unverified. A 403 semantically means authentication succeeded but the user lacks permission for the specific resource — the token is still valid. The verification endpoint (/shippo-accounts) is specifically for Platform accounts, so a valid non-platform Shippo token could receive a 403 and be incorrectly reported as unverified. The braintrust detector, which this code appears modeled after, correctly handles this by returning true for 403 with the comment "Valid token but lacks permission (still valid)."

 

^{Reviewed by Cursor Bugbot for commit 3f183a2. Configure here.}

[MuneebUllahKhan222]

According to the documentation there is only one kind-of API token. Shippo doesn't have non-platform and platform token.