v3.95.9

What's Changed

• feat: add OpenRouter detector by @McPatate in #4500
• Integrations fully codeowns detectors by @trufflesteeeve in #5104
• [INS-332] Add New Relic Insights Insert key detector by @mustansir14 in #4778
• [INS-351] Added Duffel Token Detector by @MuneebUllahKhan222 in #4795
• [INS-341] Added Shippo detector by @MuneebUllahKhan222 in #4820
• [INS-467] Add IPinfo detector to default detectors list by @mustansir14 in #4970
• fix: reject --include-repos/--exclude-repos with --repo in github scan by @kashifkhan0771 in #5112
• [INS-468] Add improved lob detector to defaults.go by @mustansir14 in #4971
• feat(action): add image input to allow registry mirror overrides by @eightseventhreethree in #4965
• feat: Support archived repo exclusion from GH org scans by @hibare in #4875
• [INT-715] Retry transient failures when verifying OpenAI keys by @bill-rich in #5117
• [INS-410] Added batch token detector by @MuneebUllahKhan222 in #4824
• [INT-650] Don't log as error when git diff is too long by @bill-rich in #5113

New Contributors

• @McPatate made their first contribution in #4500
• @eightseventhreethree made their first contribution in #4965

Full Changelog: v3.95.8...v3.95.9

v3.95.8

What's Changed

• removed "unauthorized" as exception for rotated graphana secrets by @jordanTunstill in #5068
• fix(azuresastoken): match SAS tokens regardless of parameter order by @genisis0x in #5043
• Add prometheus metrics for engine channels and workers by @mcastorina in #5095
• [INS-465] Skip unverified JWT Detector results when feature flag is enabled by @MuneebUllahKhan222 in #5072
• [INS-334] Octopus Deploy detector by @MuneebUllahKhan222 in #4787
• Fix Syntax error in feature.go by @MuneebUllahKhan222 in #5109
• Include encoded resume info instead of clobbering it by @bill-rich in #5110

Full Changelog: v3.95.7...v3.95.8

v3.95.7

What's Changed

• fix(sources/filesystem): order resume comparison by path component by @genisis0x in #5041
• test(handlers): point APK test fixture at trufflehog-test-assets by @amanfcp in #5053
• fixed regex typo that was causing conf uuid's to be surfaced as non-live atlassian secrets. by @jordanTunstill in #5029
• Fix GitHub App cross-org member enumeration using per-installation tokens by @dustin-decker in #4774
• fix: add git worktree support in PrepareRepo by @andoniaf in #4690
• [INS-406] Braintrust detector by @MuneebUllahKhan222 in #4826
• huggingface: add bucket scanning by @julien-c in #5017
• Skip reverification results during deduplication by @mcastorina in #5069
• chore(renovate): bump shared config to v1.0.3 by @bryanbeverly in #5044
• Add scan_all_installations option for multi-org GitHub App scanning by @dustin-decker in #4775
• Expose SecretParts in the JSON output by @bradlarsen in #5073
• [INS-497] Add Pganalyze Read Key Detector by @MuneebUllahKhan222 in #4993
• [INS-197] Add redhatpyxis api key detector by @MuneebUllahKhan222 in #4995
• [INS-407] Fixed AWS detector producing non deterministic output by @MuneebUllahKhan222 in #4836

New Contributors

• @genisis0x made their first contribution in #5041
• @andoniaf made their first contribution in #4690
• @julien-c made their first contribution in #5017

Full Changelog: v3.95.6...v3.95.7

v3.95.6

What's Changed

• Enigma detector enhance verification to prevent false verified findings by @shahzadhaider1 in #5011
• fix: scan files with lines exceeding bufio's default 64 KB token limit by @MuneebUllahKhan222 in #5022
• fix(postgres): honor ignore tags for default port URLs by @Dawn-Fighter in #4968
• Move to github.com/moby/moby/client from docker/docker by @trufflesteeeve in #4987
• fix: avoid terminal probes before CLI output by @Hackerchen716 in #4994
• Update test containers dependency by @trufflesteeeve in #4978
• Re-host pkg/handlers JSON test fixtures under the org by @amanfcp in #5023
• [INS-465] Add datadogapikey detector to defaults.go by @mustansir14 in #4969
• [INS-470] Add Tly detector to defaults.go, gate it behind feat flag and update its verification logic by @MuneebUllahKhan222 in #5006
• [INS-473] Add wit detector to defaults.go, gate it behind feat flag and update verification logic by @MuneebUllahKhan222 in #5008
• Updating Klaviyo PK new format by @breetan in #5009
• Restructure Klaviyo detector pattern tests by @martinlocklear in #5026
• Replace Renovate config with shared preset (high-risk tier) by @bryanbeverly in #4992
• set redacted value to last 4 characters of secret, to match how the secret type admin interface displays it by @jordanTunstill in #5027
• GitHub finegrained analyzer was improperly handling errors by @dustin-decker in #4498
• [INS-469] Added Rev detectors to defaults.go and gated it behind feature flag by @MuneebUllahKhan222 in #5005
• Fix Renovate lookup: update setup-captain version comment by @bryanbeverly in #4999
• [INS-472] [INS-515] Add user detector to defaults.go, gate it behind feat flag, update verification logic and add custom ep configuration by @MuneebUllahKhan222 in #5007
• Fix: Resolve known dedup issues in notifierWorker by @MuneebUllahKhan222 in #5028
• fix(dropbox): prevent long sl.u. tokens from being truncated by @lukem-ts in #5012
• fix: add filetype=sdist param to pypi detector by @lukem-ts in #4988
• Handlers - Embed small HTTP test fixtures by @amanfcp in #5001
• S3: surface bucket listing failures and fix multi-role object count by @shahzadhaider1 in #5035

New Contributors

• @Dawn-Fighter made their first contribution in #4968
• @Hackerchen716 made their first contribution in #4994
• @breetan made their first contribution in #5009
• @lukem-ts made their first contribution in #5012

Full Changelog: v3.95.4...v3.95.6

v3.95.5

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
• fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
• Added GitLab OAuth Detector by @shahzadhaider1 in #4729
• Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
• [INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
• [INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
• Automate corpora testing in CI by @mustansir14 in #4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
• feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
• Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
• Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
• Update Go security dependencies by @cursor[bot] in #4986
• Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
• Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

• @mariocj89 made their first contribution in #4849
• @cursor[bot] made their first contribution in #4986
• @johannestaas-trufflesec made their first contribution in #4991

Full Changelog: v3.95.3...v3.95.5

v3.95.4

What's Changed

• [INS-461] Add test to ensure new detectors are registered in defaults.go by @mustansir14 in #4915
• [INS-455] Unify common logic in Atlassian Data Center detectors by @mustansir14 in #4907
• fix(github): cache repo info under original URL on redirect by @kashifkhan0771 in #4958
• Added GitLab OAuth Detector by @shahzadhaider1 in #4729
• Box Detector: Extract Subject ID for Analyzer Integration by @shahzadhaider1 in #4761
• [INS-346] SpectralOps Personal API Key Detector by @MuneebUllahKhan222 in #4770
• [INS-335] Added AWS Appsync Detector by @MuneebUllahKhan222 in #4803
• fix(twilio): deduplicate matches to prevent O(N×M) result explosion by @kashifkhan0771 in #4954
• Automate corpora testing in CI by @mustansir14 in #4927
• Enable errcheck and staticcheck for golangci-lint v2 and resolve all issues by @amanfcp in #4924
• feat: add host, db and username to ExtraData for database detectors by @mariocj89 in #4849
• Remove over speculation from Corpora CI workflow by @mustansir14 in #4974
• Fix line numbers for duplicate secrets within a chunk by @amanfcp in #4910
• Add feature flags for Pinecone, Cloudinary, and GitLab OAuth detectors by @camgunz in #4961
• Update Go security dependencies by @cursor[bot] in #4986
• Pin GitHub Actions to SHA digests by @bryanbeverly in #4985
• Update CODEOWNERS: replace 5 slugs with scanning + integrations by @bryanbeverly in #4983
• Added source config flags to sharepoint proto by @MuneebUllahKhan222 in #4972
• [SCAN-795] HTML decoder: ASPX and entity-encoded HTML support by @mustansir14 in #4981
• adds some debugging info for APKs and fixes issues parsing obfuscated APKs by @johannestaas-trufflesec in #4991

New Contributors

• @mariocj89 made their first contribution in #4849
• @cursor[bot] made their first contribution in #4986
• @johannestaas-trufflesec made their first contribution in #4991

Full Changelog: v3.95.3...v3.95.4

v3.95.3

What's Changed

• Renamed AnypointOAuth2 detector's AnalysisInfo keys to make it consistent with its Analyzer by @MuneebUllahKhan222 in #4906
• Rename AnalysisInfo field to SecretParts on detectors.Result by @mcastorina in #4911
• Document SecretParts contract in detector-authoring docs by @mcastorina in #4912
• Add a static check for detectors that don't set SecretParts by @mcastorina in #4913
• Populate SecretParts on all detectors by @mcastorina in #4919
• Make checksecretparts required in CI by @mcastorina in #4921
• Deduplicate concurrent credential verification requests via singleflight by @kashifkhan0771 in #4314
• log non-critical chunk errors at V(2).Info instead of Error by @johnelliott in #4928
• [INS-320] Cloudinary detector by @MuneebUllahKhan222 in #4747
• ci: bump JS actions to Node 24 majors (incl. CodeQL v4 + WIF auth v3) by @bryanbeverly in #4933
• chore: bump golangci-lint-action v7 → v9 (Node 24) by @bryanbeverly in #4936
• Add default Content-Type: application/json header for custom detector verification request by @MuneebUllahKhan222 in #4947
• Make detector Result.SecretParts initialization stricter by @mcastorina in #4948
• Add Pinecone API key detector by @dylanTruffle in #4917
• adding customizable successRanges and rotatedRanges to customDetector by @jordanTunstill in #4892

Full Changelog: v3.95.2...v3.95.3

v3.95.2

What's Changed

• Revert "[INS-397] Fix git version parser panic on non-numeric patch versions" by @trufflesteeeve in #4903

Full Changelog: v3.95.1...v3.95.2

v3.95.1

What's Changed

• [INS-444] Fix verification logic in Mesibo detector by @mustansir14 in #4884

Full Changelog: v3.95.0...v3.95.1

v3.95.0

What's Changed

• Upgrade golangci-lint in CI runner and Makefile by @amanfcp in #4861
• Deprecate SquareUp Detector by @nabeelalam in #4855
• [INS-397] Fix git version parser panic on non-numeric patch versions by @shahzadhaider1 in #4882
• Fix Bitbucket line highlighting URLs by @shahzadhaider1 in #4854
• [INS-403] Support Custom endpoint config in hashicorpvaultauth Detector by @MuneebUllahKhan222 in #4825
• [INS-398] Added tests to ensure that custom endpoint configuration works in artifactory detectors by @MuneebUllahKhan222 in #4832
• Host ldap-verify library in trufflesecurity by @trufflesteeeve in #4859
• Add AnalysisError type and wrap all analyzer error paths by @johnelliott in #4779
• dep-updates: Go 1.25 and dependency refreshes by @dustin-decker in #4888
• Fix nil pointer panics in GitHub analyzer gist/repo binding functions by @shahzadhaider1 in #4864
• [INS-399] Added Bitbucket data center(on prem) PAT detector by @MuneebUllahKhan222 in #4883
• [INS-402] Add Jira Data Center PAT Detector by @mustansir14 in #4872
• Add man page generation for trufflehog by @bryanbeverly in #4894
• Add Confluence Data Center PAT detector by @amanfcp in #4886

Full Changelog: v3.94.3...v3.95.0