Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dogecoin secret false positive #985

Open
peppescg opened this issue Feb 7, 2025 · 1 comment
Open

Dogecoin secret false positive #985

peppescg opened this issue Feb 7, 2025 · 1 comment
Labels

Comments

@peppescg
Copy link
Contributor

peppescg commented Feb 7, 2025

Describe the issue

There is false positive detected by the Dogecoin regex ( Dogecoin: \b(D|A)[a-km-zA-HJ-NP-Z1-9]{25,34}\b )

The import code snippet, is matched by the regex, in particular this import AddProviderEndpointRequest

import {
  AddProviderEndpointRequest,
  ProviderAuthType,
  ProviderType,
} from "@/api/generated";

Steps to Reproduce

try to add AddProviderEndpointRequest in the code and ask for a review

Operating System

MacOS (Arm)

IDE and Version

Vsocde 1.96.4

Extension and Version

continue

Provider

vLLM

Model

deepseek

Codegate version

0.1.17

Logs

No response

Additional Context

Image
@yrobla
Copy link
Contributor

yrobla commented Feb 7, 2025

we could be more refined when choosing candidates for secrets. Typically only key=value patterns should be leaked secrets. But we also have others, such as private keys, that do not follow this pattern. So we only detect based on the regex now, and additionally detects if we have a key value, but is not needed.
We really should be better interpreting the context of the code, and not only the regexes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants