Add 1Password service account token detector#4891
Open
tanishq-sf wants to merge 6 commits intotrufflesecurity:mainfrom
Open
Add 1Password service account token detector#4891tanishq-sf wants to merge 6 commits intotrufflesecurity:mainfrom
tanishq-sf wants to merge 6 commits intotrufflesecurity:mainfrom
Conversation
Adds a new detector for 1Password service account tokens (ops_eyJ... prefix). These tokens are used to authenticate automated workflows and CI/CD pipelines with 1Password vaults. Detection is pattern-match only since these tokens use SRP-based authentication and cannot be verified with a simple HTTP request. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
- Use a realistic ops_eyJ... token that matches the detector's keyword and regex (ops_eyJ prefix + 50 chars) - Fix double-percent format verbs (%%q -> %q, %%v -> %v, etc.) - Add test case for token that's too short - Only fail keyword check when matches are expected Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ithub.com/tanishq-sf/trufflehog into feat/onepassword-service-account-detector
BitbucketDataCenter (1045) and JiraDataCenterPAT (1046) were added to main since this branch was created. Bumped OnepasswordServiceAccount to 1047 to avoid collision. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Reviewed by Cursor Bugbot for commit 816f698. Configure here.
- Remove trailing \b from regex since Base64 tokens may end with non-word chars (=, -, +, /). Use greedy match without boundary instead. - Remove unused client field and net/http import (pattern-match only detector) - Move import and scanner registration to correct alphabetical position (between onesignal and onfleet, not in the 's' section) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
|
Thanks for putting this together! Just flagging that there's an existing PR for a 1Password Service Account Token detector in #3423. We'll review both contributions and move forward with whichever implementation is most accurate and complete. Appreciate you taking the time to contribute. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ops_eyJ...prefix)Changes
pkg/detectors/onepasswordserviceaccount/— detector + testsproto/detector_type.proto—OnepasswordServiceAccount = 1045pkg/pb/detector_typepb/detector_type.pb.go— generated enum constantpkg/engine/defaults/defaults.go— import + scanner registrationRegex
Test plan
make protosand test suitego test ./pkg/detectors/onepasswordserviceaccount/ -vNote
Medium Risk
Adds a new detector and registers a new protobuf
DetectorTypeenum value, which can affect downstream integrations relying on stable detector type mappings. Detection is pattern-only, so the main functional risk is false positives/negatives from the regex/keyword prefilter.Overview
Adds a new
onepasswordserviceaccountdetector to flag 1Password service account tokens (matchingops_eyJ...) via regex-only scanning (no verification), plus unit tests covering valid/invalid patterns.Registers the detector in the default detector list and extends
DetectorTypewithOnepasswordServiceAccountinproto/detector_type.protoand the generateddetector_type.pb.goenum mapping.Reviewed by Cursor Bugbot for commit c927cba. Bugbot is set up for automated code reviews on this repo. Configure here.