feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan by bohdansolovie · Pull Request #3262 · JSONbored/loopover

bohdansolovie · 2026-07-04T23:40:13Z

Summary

Add high-confidence secret-scan rules for Discord bot tokens ([MNO]….….…) and Twilio Account/API Key SIDs (AC… / SK… + 32 hex).
Distinct from the existing Discord webhook URL rule — bot tokens use a separate three-segment format.
Fragment-based test fixtures (no contiguous fake secrets in committed source), plus truncation and overrun negatives.

Motivation

Discord bot tokens and Twilio SIDs are commonly leaked in config files and env snippets. The secret-scan analyzer already covers many SaaS tokens but missed these high-impact formats.

Test plan

Discord bot token — positive match, truncated negative, not classified as webhook URL
Twilio Account SID and API Key SID — positive matches
Twilio SID truncation and hex-overrun negatives
Full secret-scan.test.ts suite passes
npm run build in review-enrichment/

Made with Cursor

…-scan Add high-confidence patterns for Discord bot tokens and Twilio Account/API Key SIDs with fragment-based fixtures, truncation negatives, and webhook parity. Co-authored-by: Cursor <cursoragent@cursor.com>

superagent-security · 2026-07-04T23:40:20Z

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

superagent-security · 2026-07-04T23:40:37Z

Superagent didn't find any vulnerabilities or security issues in this PR.

loopover-orb · 2026-07-04T23:41:56Z

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-04 23:39:22 UTC}

2 files · no blockers · readiness 73/100 · CI green · clean

⏸️ Suggested Action - Manual Review

The AI review could not be completed for this change, so the gate is held for a human reviewer rather than passed automatically. It re-evaluates on the next update.

Review summary
AI review is already running for this PR head in another Gittensory pass. Gittensory is holding this PR for manual review until that pass completes.

Nits — 2 non-blocking

AI review already in progress for this PR head — The gate is held for a human reviewer rather than passed automatically; it re-evaluates once the in-flight review completes or on the next update.
Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	No AI review summary
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 182 registered-repo PR(s), 102 merged, 9 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bohdansolovie; Gittensor profile; 182 PR(s), 9 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

Author: bohdansolovie
Role context: outside_contributor
Public audience mode: oss maintainer
Lane context: Repository registration is not available in the local Gittensory cache.
Public profile languages: Python, C++, JavaScript
Official Gittensor activity: 182 PR(s), 9 issue(s).
PR-specific overlap: none found.

Contributor next steps

Explain no-issue PR.
Await review-lane availability.
Refresh registry data or choose a registered active repo.
Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

Related work = same linked issue, overlapping active PRs, or title/path similarity.
Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

Re-run Gittensory review

loopover-orb · 2026-07-04T23:42:23Z

Gittensory is closing this pull request on the maintainer's behalf (AI reviewers agree on a likely critical defect: review-enrichment/src/analyzers/secret-scan.ts:181 accepts `AC` + 32 hex characters even when immediately followed by another non-hex identifier character such as `z`, so a string like `ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaz` is incorrectly reported as a `twilio_account_sid`; change the tail guard to reject any identifier continuation, e.g. `re: /\bAC[0-9a-fA-F]{32}(?![A-Za-z0-9_])/`, and apply the same boundary to the `SK` rule.). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.

Use identifier-continuation lookahead so AC/SK + 32 hex is not matched when immediately followed by a non-hex identifier char (Orb JSONbored#3262). Co-authored-by: Cursor <cursoragent@cursor.com>

…-scan (#3263) * feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan Add high-confidence patterns for Discord bot tokens and Twilio Account/API Key SIDs with fragment-based fixtures, truncation negatives, and webhook parity. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(enrichment): tighten Twilio SID tail boundary in secret-scan Use identifier-continuation lookahead so AC/SK + 32 hex is not matched when immediately followed by a non-hex identifier char (Orb #3262). Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>

feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret…

f791e3a

…-scan Add high-confidence patterns for Discord bot tokens and Twilio Account/API Key SIDs with fragment-based fixtures, truncation negatives, and webhook parity. Co-authored-by: Cursor <cursoragent@cursor.com>

bohdansolovie requested a review from JSONbored as a code owner July 4, 2026 23:40

superagent-security Bot added the contributor:flagged Contributor flagged for review by trust analysis. label Jul 4, 2026

loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 4, 2026

loopover-orb Bot assigned bohdansolovie Jul 4, 2026

loopover-orb Bot closed this Jul 4, 2026

bohdansolovie mentioned this pull request Jul 4, 2026

feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan #3263

Merged

5 tasks

Navigation Menu

Uh oh!

feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan - #3262

feat(enrichment): detect Discord bot tokens and Twilio SIDs in secret-scan#3262
bohdansolovie wants to merge 1 commit into
JSONbored:mainfrom
bohdansolovie:feat/secret-scan-discord-twilio

bohdansolovie commented Jul 4, 2026

Uh oh!

superagent-security Bot commented Jul 4, 2026

Uh oh!

superagent-security Bot commented Jul 4, 2026

Uh oh!

loopover-orb Bot commented Jul 4, 2026 •

edited

Loading

⏸️ Gittensory review result - manual review recommended

Uh oh!

loopover-orb Bot commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

bohdansolovie commented Jul 4, 2026

Summary

Motivation

Test plan

Uh oh!

superagent-security Bot commented Jul 4, 2026

Uh oh!

superagent-security Bot commented Jul 4, 2026

Uh oh!

loopover-orb Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏸️ Gittensory review result - manual review recommended

Uh oh!

loopover-orb Bot commented Jul 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

loopover-orb Bot commented Jul 4, 2026 •

edited

Loading