Skip to content

Improve Algolia detector context matching #4905

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
heyfunwhoa wants to merge 2 commits into
base: main
Choose a base branch
from
+14 −2
Open

Improve Algolia detector context matching #4905

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7fd27bb
Improve Algolia detector context matching
heyfunwhoa Apr 22, 2026
33bc856
Improve Metabase detector keyword coverage
heyfunwhoa Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion pkg/detectors/algoliaadminkey/algoliaadminkey.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,14 @@ var (
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"algolia", "docsearch"}
return []string{
"algolia",
"docsearch",
"ALGOLIA_API_KEY",
"ALGOLIA_APPLICATION_ID",
"x-algolia-api-key",
"x-algolia-application-id",
Copy link
Copy Markdown

@cursor cursor Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

New keywords are redundant substrings of existing keyword

Low Severity

All four new keywords (ALGOLIA_API_KEY, ALGOLIA_APPLICATION_ID, x-algolia-api-key, x-algolia-application-id) contain algolia as a substring. The Aho-Corasick pre-filter in ahocorasickcore.go already lowercases both keywords and chunk data, and performs substring matching. Since "algolia" is already a keyword, it will match any text containing the new keywords, making them entirely redundant. They don't expand detection coverage but do add unnecessary entries to the trie and keyword-to-detector map.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 7fd27bb. Configure here.

}
}

// FromData will find and optionally verify AlgoliaAdminKey secrets in a given set of bytes.
Expand Down
7 changes: 6 additions & 1 deletion pkg/detectors/metabase/metabase.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,12 @@ var (
// Keywords are used for efficiently pre-filtering chunks.
// Use identifiers in the secret preferably, or the provider name.
func (s Scanner) Keywords() []string {
return []string{"metabase"}
return []string{
"metabase",
"X-Metabase-Session",
"X-API-Key",
Copy link
Copy Markdown

@cursor cursor Bot Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Overly generic "X-API-Key" keyword triggers false pre-filter matches

Medium Severity

The keyword X-API-Key is an extremely common HTTP header used by many APIs (findl, interseller, langsmith, cloudsmith, etc.). Adding it to the Metabase detector's Keywords() causes the Metabase detector's FromData to be invoked on any chunk containing this generic header, even though the detector's regex (keyPat and baseURL) both require the prefix metabase to match. This results in wasted CPU running regex scans on chunks that can never produce a Metabase result. The other new Metabase keywords (X-Metabase-Session, METABASE_API_KEY) already contain metabase as a substring, making them redundant but harmless — X-API-Key is uniquely problematic because it doesn't contain metabase at all.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 33bc856. Configure here.

"METABASE_API_KEY",
}
}

// FromData will find and optionally verify Metabase secrets in a given set of bytes.
Expand Down