anthropic-api-key default rule silently fails to fire on macOS ARM64 (Homebrew build), works on Linux/aarch64

Summary

The bundled anthropic-api-key default rule (and reproduced with an equivalent custom rule using the same regex shape) does not fire on a syntactically valid Anthropic API key, specifically on macOS ARM64 (Homebrew build). The same version's Linux/aarch64 build detects the identical content correctly.

Environment

• Failing: gitleaks 8.30.1, installed via Homebrew (brew install gitleaks), macOS 15/Darwin arm64 (Apple Silicon). Confirmed after a full brew reinstall gitleaks (fresh bottle pour) — not a corrupted local install.
• Working: gitleaks 8.30.1, Linux/aarch64 direct binary (non-Homebrew), same version string. 18/18 trials (6 seeded fake keys × 3 config variants) fired the default rule correctly there.

Reproduction (macOS ARM64 Homebrew build)

1. Config (config.toml), no custom rules at all:
   toml复制

   title = "t"
   [extend]
   useDefault = true

2. Test file (test.txt) containing a single syntactically valid, fake Anthropic key matching the documented format (sk-ant-api03- + 93 base64url-ish chars + AA):
   复制

   sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklAA

3. Run:
   复制

   gitleaks detect --no-git --source test.txt --config config.toml --no-banner -v

4. Expected: the bundled anthropic-api-key rule fires, reports a leak.
5. Actual (macOS ARM64 Homebrew build): no leaks found, exit 0.

This also reproduces with a custom rule using the same regex shape (\bsk-ant-api03-[A-Za-z0-9_-]{93,99}\b or similar bounded-quantifier patterns) combined with useDefault = true in the same config — the custom rule also silently fails to fire once the full ~180-rule default set is loaded alongside it, though the SAME custom rule fires reliably in a config with no useDefault at all (standalone).

The failure was reproduced across 15+ length/prefix/id variations during initial investigation, and persists after a complete Homebrew reinstall (ruling out a corrupted local binary/cache). A plain Python re.search() using the equivalent pattern confirms the test content unambiguously matches the documented key format — this is not a malformed test fixture.

Suspected cause (not confirmed)

Something structural in how the Go/RE2 regex engine handles a long bounded-repetition quantifier once the full default ruleset (~180 rules) is loaded, specific to the macOS ARM64 build — possibly a build-flag or RE2 library version difference between the Homebrew bottle and the Linux release binary. Not confirmed; further isolation had diminishing returns relative to available time.

Impact

Any user relying on gitleaks' default anthropic-api-key rule on macOS ARM64 (a common developer platform) would not have a real leaked Anthropic key detected by this rule, silently.

Workaround in use

A prefix-only custom rule (matching just \bsk-ant-api03-, no trailing quantifier) as a stopgap — detects key presence reliably but not the full secret value.

Happy to provide the exact fixture files / full trial matrix if useful.