From eca4db30c7eb03c576e65fe5093018876af59fba Mon Sep 17 00:00:00 2001
From: bohdansolovie <bohdansolovie@gmail.com>
Date: Sun, 5 Jul 2026 06:32:36 +0200
Subject: [PATCH] feat(enrichment): add Mixedbread and Sourcegraph local
 secret-scan rules

Detect mxb_ API keys and sgp_local_ access tokens with broad tail guards and full negative coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../src/analyzers/secret-scan.ts              | 12 +++++
 review-enrichment/test/secret-scan.test.ts    | 47 +++++++++++++++++++
 2 files changed, 59 insertions(+)

diff --git a/review-enrichment/src/analyzers/secret-scan.ts b/review-enrichment/src/analyzers/secret-scan.ts
index 2bb12c8730..7a2dd9fa1f 100644
--- a/review-enrichment/src/analyzers/secret-scan.ts
+++ b/review-enrichment/src/analyzers/secret-scan.ts
@@ -403,6 +403,18 @@ const RULES: Rule[] = [
     re: /\bpdl_(?:live|sdbx)_apikey_[A-Za-z0-9]{26}_[A-Za-z0-9]{22}_[A-Za-z0-9]{3}(?![A-Za-z0-9_-])/,
     confidence: "high",
   },
+  {
+    // Mixedbread API key: `mxb_` + base62 body.
+    kind: "mixedbread_api_key",
+    re: /\bmxb_[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
+  {
+    // Sourcegraph local access token: `sgp_local_` + 40 hex (v3 local format).
+    kind: "sourcegraph_local_access_token",
+    re: /\bsgp_local_[a-fA-F0-9]{40}(?![A-Za-z0-9_-])/,
+    confidence: "high",
+  },
   {
     // Google OAuth 2.0 client secret: `GOCSPX-` + 28 base64url chars.
     kind: "google_oauth_client_secret",
diff --git a/review-enrichment/test/secret-scan.test.ts b/review-enrichment/test/secret-scan.test.ts
index 40cb58af76..09025fd28e 100644
--- a/review-enrichment/test/secret-scan.test.ts
+++ b/review-enrichment/test/secret-scan.test.ts
@@ -1192,6 +1192,53 @@ test("scanPatch does not flag truncated Statsig/Paddle keys or identifier contin
   );
 });
 
+test("scanPatch flags Mixedbread and Sourcegraph local access tokens with high confidence", () => {
+  const fakeMixedbreadKey = "mxb_" + "a".repeat(20);
+  const mixedbreadFindings = scanPatch("src/config.ts", hunk([`const mxb = "${fakeMixedbreadKey}";`]));
+  assert.equal(mixedbreadFindings.length, 1);
+  assert.equal(mixedbreadFindings[0].kind, "mixedbread_api_key");
+  assert.equal(mixedbreadFindings[0].confidence, "high");
+
+  const fakeSourcegraphLocalToken = ["sgp_", "local", "_", hex(40)].join("");
+  const sourcegraphLocalFindings = scanPatch("src/config.ts", hunk([`const sg = "${fakeSourcegraphLocalToken}";`]));
+  assert.equal(sourcegraphLocalFindings.length, 1);
+  assert.equal(sourcegraphLocalFindings[0].kind, "sourcegraph_local_access_token");
+  assert.equal(sourcegraphLocalFindings[0].confidence, "high");
+});
+
+test("scanPatch does not flag truncated Mixedbread/Sourcegraph local tokens or identifier continuation", () => {
+  assert.equal(scanPatch("src/config.ts", hunk([`const mxb = "mxb_${"a".repeat(19)}";`])).length, 0);
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const mxb = "mxb_${"a".repeat(20)}_suffix";`])).some((f) => f.kind === "mixedbread_api_key"),
+    false,
+  );
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const mxb = "mxb_${"a".repeat(20)}-suffix";`])).some((f) => f.kind === "mixedbread_api_key"),
+    false,
+  );
+
+  const shortSourcegraphLocalToken = ["sgp_", "local", "_", hex(39)].join("");
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${shortSourcegraphLocalToken}";`])).some((f) => f.kind === "sourcegraph_local_access_token"),
+    false,
+  );
+  const sourcegraphLocalSuffixToken = ["sgp_", "local", "_", hex(40), "-suffix"].join("");
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphLocalSuffixToken}";`])).some((f) => f.kind === "sourcegraph_local_access_token"),
+    false,
+  );
+  const sourcegraphLocalUnderscoreToken = ["sgp_", "local", "_", hex(40), "_suffix"].join("");
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphLocalUnderscoreToken}";`])).some((f) => f.kind === "sourcegraph_local_access_token"),
+    false,
+  );
+  const sourcegraphLocalAlphaSuffixToken = ["sgp_", "local", "_", hex(40), "z"].join("");
+  assert.equal(
+    scanPatch("src/config.ts", hunk([`const sg = "${sourcegraphLocalAlphaSuffixToken}";`])).some((f) => f.kind === "sourcegraph_local_access_token"),
+    false,
+  );
+});
+
 test("scanPatch flags additional high-confidence SaaS/cloud/CI credential formats", () => {
   const cases = [
     ["google_oauth_client_secret", "GOCSPX-" + b62(28)],