Add Composio API key detector
Summary
Request to add a detector for Composio API keys. I work at Composio (composio.dev) and am the point of contact for the key formats; a PR with the detector and pattern tests follows.
Key formats
All three types are a fixed prefix followed by URL-safe nanoid characters [A-Za-z0-9_-], no checksum:
- project keys:
ak_+ 20 characters - organization keys:
oak_+ 20 characters - user keys:
uak_+ 43 characters
oak_ and uak_ contain ak_, so the project pattern needs a non-alphabet character before the prefix. Keys can end in -, so \b alone misses about 1 in 64 of them; the patterns use an explicit non-alphabet boundary on both sides.
Verification
Not in the first PR. Composio is finalizing a dedicated verification endpoint and will follow up with a second PR that adds it, plus sanctioned test credentials for the integration test through whichever secure channel you prefer.
Source: trufflesecurity/trufflehog