From e5a829a0a9e6d7294edab2b24ac0d940f93ffd13 Mon Sep 17 00:00:00 2001
From: bohdansolovie <bohdansolovie@gmail.com>
Date: Sun, 5 Jul 2026 01:52:58 +0200
Subject: [PATCH] feat(enrichment): detect Resend API keys and Mapbox secret
 tokens in secret-scan

Add high-confidence patterns for Resend `re_` keys and Mapbox `sk.eyJ` secret
tokens with fragment-based fixtures, truncation negatives, and Stripe parity.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../src/analyzers/secret-scan.ts              | 12 ++++++++++
 review-enrichment/test/secret-scan.test.ts    | 24 +++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts
index fbe56800d7..775f9c8120 100644
--- a/review-enrichment/src/analyzers/secret-scan.ts
+++ b/review-enrichment/src/analyzers/secret-scan.ts
@@ -187,6 +187,18 @@ const RULES: Rule[] = [
     re: /\bSK[0-9a-fA-F]{32}(?![A-Za-z0-9_])/,
     confidence: "high",
   },
+  {
+    // Resend API key: `re_` + >=24 base62 chars.
+    kind: "resend_api_key",
+    re: /\bre_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/,
+    confidence: "high",
+  },
+  {
+    // Mapbox secret access token: `sk.eyJ` JWT-shaped token (distinct from Stripe `sk_live_` / `sk_test_`).
+    kind: "mapbox_secret_token",
+    re: /\bsk\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
   {
     // Google OAuth 2.0 client secret: `GOCSPX-` + 28 base64url chars.
     kind: "google_oauth_client_secret",
diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts
index 13fcff694c..65ede3548e 100644
--- a/review-enrichment/test/secret-scan.test.ts
+++ b/review-enrichment/test/secret-scan.test.ts
@@ -471,6 +471,30 @@ test("scanPatch does not flag truncated Twilio SIDs or identifier continuation p
   );
 });
 
+test("scanPatch flags Resend and Mapbox secret tokens with high confidence", () => {
+  const fakeResendKey = "re_" + "a".repeat(32);
+  const resendFindings = scanPatch("src/config.ts", hunk([`const resend = "${fakeResendKey}";`]));
+  assert.equal(resendFindings.length, 1);
+  assert.equal(resendFindings[0].kind, "resend_api_key");
+  assert.equal(resendFindings[0].confidence, "high");
+
+  const fakeMapboxSecret = ["sk.", "eyJ", "a".repeat(20), ".", "b".repeat(20)].join("");
+  const mapboxFindings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`]));
+  assert.equal(mapboxFindings.length, 1);
+  assert.equal(mapboxFindings[0].kind, "mapbox_secret_token");
+  assert.equal(mapboxFindings[0].confidence, "high");
+});
+
+test("scanPatch does not flag truncated Resend keys or classify Mapbox secrets as Stripe keys", () => {
+  const truncatedResend = "re_" + "a".repeat(23);
+  assert.equal(scanPatch("src/config.ts", hunk([`const resend = "${truncatedResend}";`])).length, 0);
+
+  const fakeMapboxSecret = ["sk.", "eyJ", "c".repeat(20), ".", "d".repeat(20)].join("");
+  const findings = scanPatch("src/config.ts", hunk([`const mapbox = "${fakeMapboxSecret}";`]));
+  assert.equal(findings.some((f) => f.kind === "stripe_secret_key"), false);
+  assert.equal(findings.some((f) => f.kind === "mapbox_secret_token"), true);
+});
+
 test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => {
   const cases = [
     ["google_oauth_client_secret", "GOCSPX-" + b62(28)],