From 71149ef642bdfbb34cedb02387409fb37a8e9d41 Mon Sep 17 00:00:00 2001
From: bohdansolovie <bohdansolovie@gmail.com>
Date: Sun, 5 Jul 2026 03:07:47 +0200
Subject: [PATCH] feat(enrichment): detect Browserbase and Modal tokens in
 secret-scan

Add high-confidence rules for bb_ (Browserbase) and ak-/as- (Modal token
ID/secret) with truncation and hyphen/underscore continuation tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../src/analyzers/secret-scan.ts              | 12 ++++++
 review-enrichment/test/secret-scan.test.ts    | 42 +++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts
index 0b6993d0b2..582d7d19a9 100644
--- a/review-enrichment/src/analyzers/secret-scan.ts
+++ b/review-enrichment/src/analyzers/secret-scan.ts
@@ -247,6 +247,18 @@ const RULES: Rule[] = [
     re: /\bfc-[A-Za-z0-9]{16,}(?![A-Za-z0-9_-])/,
     confidence: "high",
   },
+  {
+    // Browserbase API key: `bb_` + base62 body (reject hyphen-continued identifiers).
+    kind: "browserbase_api_key",
+    re: /\bbb_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
+  {
+    // Modal token ID/secret: `ak-` (ID) or `as-` (secret) + base62 body.
+    kind: "modal_token",
+    re: /\b(?:ak|as)-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
   {
     // Google OAuth 2.0 client secret: `GOCSPX-` + 28 base64url chars.
     kind: "google_oauth_client_secret",
diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts
index d586a78575..97d17387c3 100644
--- a/review-enrichment/test/secret-scan.test.ts
+++ b/review-enrichment/test/secret-scan.test.ts
@@ -637,6 +637,48 @@ test("scanPatch does not flag truncated Voyage/Firecrawl keys or identifier cont
   );
 });
 
+test("scanPatch flags Browserbase and Modal API tokens with high confidence", () => {
+  const fakeBrowserbaseKey = "bb_" + "a".repeat(20);
+  const browserbaseFindings = scanPatch("src/config.ts", hunk([`const browserbase = "${fakeBrowserbaseKey}";`]));
+  assert.equal(browserbaseFindings.length, 1);
+  assert.equal(browserbaseFindings[0].kind, "browserbase_api_key");
+  assert.equal(browserbaseFindings[0].confidence, "high");
+
+  const fakeModalTokenId = "ak-" + "b".repeat(20);
+  const modalIdFindings = scanPatch("src/config.ts", hunk([`const modalId = "${fakeModalTokenId}";`]));
+  assert.equal(modalIdFindings.length, 1);
+  assert.equal(modalIdFindings[0].kind, "modal_token");
+  assert.equal(modalIdFindings[0].confidence, "high");
+
+  const fakeModalTokenSecret = "as-" + "c".repeat(20);
+  const modalSecretFindings = scanPatch("src/config.ts", hunk([`const modalSecret = "${fakeModalTokenSecret}";`]));
+  assert.equal(modalSecretFindings.length, 1);
+  assert.equal(modalSecretFindings[0].kind, "modal_token");
+  assert.equal(modalSecretFindings[0].confidence, "high");
+});
+
+test("scanPatch does not flag truncated Browserbase/Modal tokens or identifier continuation", () => {
+  assert.equal(scanPatch("src/config.ts", hunk([`const browserbase = "bb_${"a".repeat(19)}";`])).length, 0);
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const browserbase = "bb_${"a".repeat(20)}_suffix";`])).some((f) => f.kind === "browserbase_api_key"),
+    false,
+  );
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const browserbase = "bb_${"a".repeat(20)}-suffix";`])).some((f) => f.kind === "browserbase_api_key"),
+    false,
+  );
+
+  assert.equal(scanPatch("src/config.ts", hunk([`const modalId = "ak-${"b".repeat(19)}";`])).length, 0);
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const modalId = "ak-${"b".repeat(20)}-suffix";`])).some((f) => f.kind === "modal_token"),
+    false,
+  );
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const modalSecret = "as-${"c".repeat(20)}_suffix";`])).some((f) => f.kind === "modal_token"),
+    false,
+  );
+});
+
 test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => {
   const cases = [
     ["google_oauth_client_secret", "GOCSPX-" + b62(28)],