v0.0.158

security/leaked-secrets is sharper in both directions: it stops reporting documentation samples, placeholders, catalogue values and sample data tables as credentials, names more providers (Cerebras, OpenRouter, NVIDIA, Fireworks, Shopify Admin, Stripe restricted keys, Google OAuth client secrets), and classifies Shopify, Netlify and signed-URL tokens and browser SDK keys instead of calling them generic leaks. A percent-encoded Twitter bearer token is found again, and the crawler throttle spacing test no longer fails under load. Thanks to William for the throttle test fix (#1516, #1519).

Fixed

• security/leaked-secrets no longer reports documentation samples, placeholders and binary payloads as credentials. jwt.io's default sample token (when its signature verifies under a published sample secret), a -----BEGIN ... PRIVATE KEY----- header with no key body after it, a connection string with a documentation password on localhost or one whose password is a template placeholder (${user}, {{ pass }}, %s), Stripe's published sample key, a hashed asset name such as neon_<hash>.png, a Dominican Republic IBAN and a run of A inside a base64 image, font or wasm payload are not reported. A real-shaped key in the same place still is: a PEM block with a body, a random password on a local host, any other sk_test_ key. example-password and similar are placeholders. Paystack's sk_live_ keys (40 hex) are labelled Paystack instead of Stripe, and an sk_live_ key with a hex tail that is not Stripe's, such as a chat widget's data-deployment-key, reports as an unknown-provider key with a widget hint. changeme stays reportable on purpose. See leaked-secrets. (#1283, #1227)
• security/leaked-secrets treats Shopify wallet and Shop sessions tokens, the Netlify web vitals token and any apiKey or api-key assignment on apps.shopify.com (Shopify's own site, in markup or script) as public by design. Each needs positive evidence: the token's own claims, the attribute it sits in, or the Shopify sessions URL beside it. An apiKey in a Shopify platform bundle (cdn.shopify.com/shopifycloud/, or /cdn/shopifycloud/ on a *.myshopify.com host) is not reported; secrets, tokens and provider keys in the same bundle still are. A key named search_api_key still reports at medium, with a hint that the name suggests a search-only key, because an admin key under that name reads the same. A role, an extra claim, an unsigned token or an issuer host alone never makes a token public. See leaked-secrets. (#1287, #1229)
• security/leaked-secrets names more providers and labels sbp_ correctly. Cerebras csk- keys, which were missed even beside reported Groq keys, now report. New named patterns: OpenRouter (sk-or-v1-), NVIDIA (nvapi-), Fireworks AI (fw_), Stripe restricted keys (rk_live_), Shopify Admin tokens (shpat_, shpss_, shpca_, shppa_) and Google OAuth client secrets (GOCSPX-). sbp_ is a Supabase personal access token, no longer labelled "Service Role Key": it is account-wide, so revoke it in the account settings. A JWT issued by a Hygraph host is labelled as a Hygraph management or content token. Server-side classes are critical in a browser script (Shopify Admin, sbp_, Google OAuth secrets and Stripe restricted keys); OpenRouter, Cerebras and NVIDIA keys stay high and Fireworks medium. A fw_ camelCase identifier and a Shopify token shape that is a file name or a CSS class (/files/shpat_<hash>.png, .shpca_<hash>) are not reported. See leaked-secrets. (#1309)
• security/leaked-secrets stops reporting values that cannot be credentials and credentials that are sample data. A generic password: or secret: assignment no longer reports credential names written as lower-case words joined by _, : or . (app_secret_v6, authentication_secret_v6); random words with none of a credential word (a whole word: monkey and author do not count), and the value of a Bearer or Basic header, still report, a css-loader class (the whole <file>__<local>___<hash> value), a URL or path with no credential in it, an environment-variable reference, a short elided or masked value, or a span of up to 64 characters that is code (a bare && or ||, a one-letter member call and a long password are not code). A password in a table of three or more same-shaped records with a reserved-domain email in every row that carries it, and a puzzle or generator object with two of its markers, are sample data and are not reported; the same table with real-domain emails stays, as Possible Demo Login (seed data table). See leaked-secrets. (#1292, #1308)
• security/leaked-secrets classifies signed-URL tokens and browser SDK keys instead of calling them generic leaks. A JWT in a ?token=, ?jwt=, ?sig= or X-Amz-* URL parameter (57% of JWT flags in a 38k-site batch were Supabase storage signed URLs) that carries an exp and a url claim and no role or admin scope is labelled Signed URL Token (JWT) and reported at medium with its expiry (any other JWT there is an ordinary JWT). Keys in Bugsnag and Amplitude init calls, data-*-api-key attributes on a third-party widget script and RevenueCat public SDK keys beside the SDK's name are public client keys. A NEXT_PUBLIC_, VITE_ or PUBLIC_ name, or a public* or client*Key name, adds a hint but does not downgrade the finding. An AWS access key id with no 40-character secret-shaped value within 300 characters reports at medium instead of high (an id in one script and its secret in another is ranked below high: each script is read by itself). A service_role key, an admin-scope token and any sk_, rk_ or sb_secret_ value still report wherever they appear. See leaked-secrets. (#1293, #1294)