Repository navigation
Add a TruffleHog dectector for Kong Konnect Platform - #5305
Conversation
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
b1a4215 to
ea8e739
Compare
ea8e739 to
5722375
Compare
| case http.StatusOK: | ||
| // If the endpoint returns useful information, we can return it as a map. | ||
| return true, extraData, nil | ||
| case http.StatusForbidden: |
There was a problem hiding this comment.
The API documentation only lists 200 and 401 as possible responses. Does the API actually return 403 for valid keys, or was that added to address the Bugbot feedback?
There was a problem hiding this comment.
@shahzadhaider1 I was just trying to make Bugbot happy.
While at the moment the endpoint has only 200 or 401 as possible responses. It is possible that in the future it can start returning 403 too, so this would cover that incase without further changes needed.
I am happy to remove it if you prefer.
There was a problem hiding this comment.
Thanks for confirming. Since /organizations/me only returns 200/401 today, I'd prefer to drop the 403 case. If Konnect starts returning 403 here later, we don't know yet whether it would mean "valid but restricted" or something like a suspended org or disabled account, and treating it as verified would produce false positives. Falling through to default reports it as an unknown status with the code in the error, which is the safer outcome until we can see a real 403 response.
There was a problem hiding this comment.
@shahzadhaider1 , sounds good 403 case has been drop.
thanks for the feedback.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 5219129. Configure here.
shahzadhaider1
left a comment
shahzadhaider1
left a comment
There was a problem hiding this comment.
Great work. Thank you for the contribution!
5 participants
Description:
Add a TruffleHog dectector for Kong Konnect Platform (api.konghq.com)
token format
(?:kpat_|spat_)[a-zA-Z0-9]{49}issue: #5306
Checklist:
make test-community)?make lintthis requires golangci-lint)?Note
Low Risk
Additive, feature-flagged detector using the same registration and HTTP verification pattern as other API-key scanners; no changes to core scan or auth logic.
Overview
Adds Kong Konnect (
DetectorType_KongKonnect, id 1072) to the default scanner set behindKongKonnectDetectorEnabled(on by default in OSSmain.go).The new detector matches Konnect personal/system access tokens with prefix
kpat_orspat_plus 49 alphanumeric characters. When verification is enabled, it checks tokens with a Bearer request tohttps://global.api.konghq.com/v3/organizations/me(200 = verified, 401 = invalid) and attaches a Kong rotation-guide link inExtraData.Registration follows the usual path: proto enum,
buildDetectorList(), feature-flag filter indefaults.go, and unit/integration/pattern tests underpkg/detectors/kong/.Reviewed by Cursor Bugbot for commit 97d5ed6. Bugbot is set up for automated code reviews on this repo. Configure here.