From 4b5bff92c0a9f11e930faa0a292cc2ae33820920 Mon Sep 17 00:00:00 2001
From: bohdansolovie <bohdansolovie@gmail.com>
Date: Sun, 5 Jul 2026 05:35:49 +0200
Subject: [PATCH 1/2] feat(enrichment): detect Knock service and Sourcegraph
 access tokens

Add high-confidence secret-scan rules for Knock knock_st_ management API
service tokens and Sourcegraph sgp_ access tokens, with truncation and
identifier-continuation negative tests.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../src/analyzers/secret-scan.ts              | 12 +++++
 review-enrichment/test/secret-scan.test.ts    | 47 +++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts
index 1ecaeb76af..7f94ec07c4 100644
--- a/review-enrichment/src/analyzers/secret-scan.ts
+++ b/review-enrichment/src/analyzers/secret-scan.ts
@@ -367,6 +367,18 @@ const RULES: Rule[] = [
     re: /\bsk-api-[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/,
     confidence: "high",
   },
+  {
+    // Knock management API service token: `knock_st_` + base62 body.
+    kind: "knock_service_token",
+    re: /\bknock_st_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
+  {
+    // Sourcegraph access token: `sgp_` + 16 hex + `_` + 40 hex (distinct from generic hex blobs).
+    kind: "sourcegraph_access_token",
+    re: /\bsgp_[a-fA-F0-9]{16}_[a-fA-F0-9]{40}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
   {
     // Google OAuth 2.0 client secret: `GOCSPX-` + 28 base64url chars.
     kind: "google_oauth_client_secret",
diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts
index 70d4a77eb7..dd6a9a4eff 100644
--- a/review-enrichment/test/secret-scan.test.ts
+++ b/review-enrichment/test/secret-scan.test.ts
@@ -1035,6 +1035,53 @@ test("scanPatch does not flag truncated MiniMax keys or identifier continuation"
   );
 });
 
+test("scanPatch flags Knock service and Sourcegraph access tokens with high confidence", () => {
+  const fakeKnockToken = "knock_st_" + "a".repeat(20);
+  const knockFindings = scanPatch("src/config.ts", hunk([`const knock = "${fakeKnockToken}";`]));
+  assert.equal(knockFindings.length, 1);
+  assert.equal(knockFindings[0].kind, "knock_service_token");
+  assert.equal(knockFindings[0].confidence, "high");
+
+  const fakeSourcegraphToken = "sgp_" + hex(16) + "_" + hex(40);
+  const sourcegraphFindings = scanPatch("src/config.ts", hunk([`const sg = "${fakeSourcegraphToken}";`]));
+  assert.equal(sourcegraphFindings.length, 1);
+  assert.equal(sourcegraphFindings[0].kind, "sourcegraph_access_token");
+  assert.equal(sourcegraphFindings[0].confidence, "high");
+});
+
+test("scanPatch does not flag truncated Knock/Sourcegraph tokens or identifier continuation", () => {
+  assert.equal(scanPatch("src/config.ts", hunk([`const knock = "knock_st_${"a".repeat(19)}";`])).length, 0);
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const knock = "knock_st_${"a".repeat(20)}_suffix";`])).some((f) => f.kind === "knock_service_token"),
+    false,
+  );
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const knock = "knock_st_${"a".repeat(20)}-suffix";`])).some((f) => f.kind === "knock_service_token"),
+    false,
+  );
+
+  const shortSourcegraphToken = "sgp_" + hex(16) + "_" + hex(39);
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${shortSourcegraphToken}";`])).some((f) => f.kind === "sourcegraph_access_token"),
+    false,
+  );
+  const sourcegraphSuffixToken = "sgp_" + hex(16) + "_" + hex(40) + "-suffix";
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphSuffixToken}";`])).some((f) => f.kind === "sourcegraph_access_token"),
+    false,
+  );
+  const sourcegraphUnderscoreToken = "sgp_" + hex(16) + "_" + hex(40) + "_suffix";
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphUnderscoreToken}";`])).some((f) => f.kind === "sourcegraph_access_token"),
+    false,
+  );
+  const sourcegraphAlphaSuffixToken = "sgp_" + hex(16) + "_" + hex(40) + "z";
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphAlphaSuffixToken}";`])).some((f) => f.kind === "sourcegraph_access_token"),
+    false,
+  );
+});
+
 test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => {
   const cases = [
     ["google_oauth_client_secret", "GOCSPX-" + b62(28)],

From 9824eee86c7eadd91de9cc7c88016d172961ebcc Mon Sep 17 00:00:00 2001
From: bohdansolovie <bohdansolovie@gmail.com>
Date: Sun, 5 Jul 2026 05:53:22 +0200
Subject: [PATCH 2/2] chore: retrigger Gittensory Orb review

Co-authored-by: Cursor <cursoragent@cursor.com>