feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan

[bohdansolovie]

Summary

• Add high-confidence secret-scan rules for Discord bot tokens ([MNO]….….…) and Twilio Account/API Key SIDs (AC… / SK… + 32 hex).
• Distinct from the existing Discord webhook URL rule — bot tokens use a separate three-segment format.
• Fragment-based test fixtures (no contiguous fake secrets in committed source), plus truncation and overrun negatives.

Motivation

Discord bot tokens and Twilio SIDs are commonly leaked in config files and env snippets. The secret-scan analyzer already covers many SaaS tokens but missed these high-impact formats.

Test plan

• Discord bot token — positive match, truncated negative, not classified as webhook URL
• Twilio Account SID and API Key SID — positive matches
• Twilio SID truncation and hex-overrun negatives
• Full secret-scan.test.ts suite passes
• npm run build in review-enrichment/

Made with Cursor

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-04 23:39:22 UTC}

2 files · no blockers · readiness 73/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• The AI review could not be completed for this change, so the gate is held for a human reviewer rather than passed automatically. It re-evaluates on the next update.

Review summary
AI review is already running for this PR head in another Gittensory pass. Gittensory is holding this PR for manual review until that pass completes.

Nits — 2 non-blocking

• AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	No AI review summary
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 182 registered-repo PR(s), 102 merged, 9 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bohdansolovie; Gittensor profile; 182 PR(s), 9 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: bohdansolovie
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: Python, C++, JavaScript
• Official Gittensor activity: 182 PR(s), 9 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Explain no-issue PR.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/secret-scan.ts:181 accepts `AC` + 32 hex characters even when immediately followed by another non-hex identifier character such as `z`, so a string like `ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz` is incorrectly reported as a `twilio_account_sid`; change the tail guard to reject any identifier continuation, e.g. `re: /\bAC[0-9a-fA-F]{32}(?![A-Za-z0-9_])/`, and apply the same boundary to the `SK` rule.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.