feat(detectors): add VaultRootToken detector

[deerajcm]

Summary

Add detector for HashiCorp Vault root tokens (TF034).

Changes

• Add VaultRootToken detector for root tokens generated during vault init
• Pattern: hvs.[A-Za-z0-9]{20,} or s.[a-zA-Z0-9]{24,}
• Keywords: "root_token", "root token", "initial root token", "VAULT_ROOT_TOKEN"
• Format-based verification (API verification skipped for security)
• Add enum VaultRootToken = 1064 to proto definitions
• Register detector in defaults.go
• Add comprehensive unit tests

Detector Details

Type: HashiCorp Vault Root Token
Patterns:

• New format: hvs.XXXXX (28+ characters)
• Legacy format: s.XXXXX (26+ characters)

Keywords: Specifically targets root token context to reduce false positives with regular service tokens

Verification: Format validation only - root tokens have unrestricted access and shouldn't be tested against live systems

Use Case: Detect exposed root tokens from vault initialization output

Context-Aware Detection

Unlike regular Vault tokens, this detector uses specific keywords to identify root token context:

• root_token (variable names)
• Initial Root Token: (vault init output)
• VAULT_ROOT_TOKEN (environment variables)

This reduces false positives while maintaining high detection rate for actual root tokens.

Security Note

Root tokens have unrestricted access to all Vault operations. Format-only verification is intentional:

• ✅ Avoids testing against live Vault instances
• ✅ Prevents potential security alerts from verification attempts
• ✅ Still provides high confidence detection via format validation

Test Results

✅ valid_new_format_root_token - PASS
✅ valid_legacy_format_root_token - PASS
✅ token_in_terraform_config - PASS
✅ invalid_too_short - PASS
✅ invalid_wrong_prefix - PASS

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Broad new detector and proto enum changes can affect builds and downstream type mappings; Vault/Docker verification paths touch sensitive credentials and default local endpoints.
> 
> **Overview**
> Adds several new secret scanners and wires them into the default engine, alongside tighter verification for existing ones.
> 
> **New detectors** include **HTTP Basic Auth** (`Authorization: Basic` base64 with decoded username/password in `SecretParts`), **HashiCorp Vault root tokens** (context keywords + format-only “verification” with rotation warnings), **Vault service/batch/recovery tokens** (optional `lookup-self` against configurable/default Vault URLs), **Duffel** API keys (live tokens skipped for verification), and **Docker Swarm unlock** keys (`SWMKEY-1-…`). **Duffel** is enabled in proto (no longer “not implemented”). **Slack** now matches **app-level** `xapp-1-…` tokens.
> 
> **AWS AppSync** verification is refactored to try multiple GraphQL queries, always read the response body, and classify 200/502/400 responses using JSON error snippets (auth vs schema vs success), with new handling for 400/404.
> 
> **Proto / enum churn** replaces `BrainTrustApiKey` at 1053 with several new types (`BasicAuth`, `VaultRootToken` at 1070, etc.); note `dockerswarmunlock` references `DockerSwarmUnlock` while proto lists `DockerSwarmJoinToken` at 1059—a possible mismatch worth checking at build time.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit d633f939ddfe2f3af69c45e10fdfa9d8ab319d84. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ deerajcm
❌ Deeraj CM

---

Deeraj CM seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Deferred response body close inside loop causes resource leak

Medium Severity

defer resp.Body.Close() is called inside the for loop iterating over vaultUrls. In Go, defer runs when the enclosing function returns, not when the loop iteration ends. When the switch hits StatusBadRequest or default and continues, the response body stays open. Multiple iterations accumulate unclosed response bodies until the function finally returns, causing a resource leak of HTTP connections and file descriptors.

 

^{Reviewed by Cursor Bugbot for commit fd75bdc. Configure here.}

[cursor]

Verification uses localhost-blocking client with localhost-only endpoints

Medium Severity

defaultClient is DetectorHttpClientWithNoLocalAddresses, which blocks connections to loopback/private IPs. The only HTTP endpoint tried is localhost:2375, which will always be rejected. The unix socket is explicitly skipped. So the HTTP verification is dead code, and the fallback format check at line 98 always passes for any regex-matched token, making every detection unconditionally Verified: true.

Additional Locations (2)

• pkg/detectors/dockerswarmunlock/dockerswarmunlock.go#L61-L65
• pkg/detectors/dockerswarmunlock/dockerswarmunlock.go#L95-L100

 

^{Reviewed by Cursor Bugbot for commit fd75bdc. Configure here.}

[cursor]

Duffel still in test exclusion list after implementation

High Severity

The Duffel detector is now registered in defaults.go, but DetectorType_Duffel remains in the excludedFromDefaultList map in defaults_test.go. The TestAllDetectorTypesAreInDefaultList test performs a reverse check that fails when a type appears in both the active detector list and the exclusion list, so this will cause a test failure.

 

^{Reviewed by Cursor Bugbot for commit fd75bdc. Configure here.}

[cursor]

Redundant custom min function shadows Go builtin

Low Severity

A custom min function is defined that duplicates the built-in min available since Go 1.21. The project uses Go 1.25 (per go.mod), so this package-level function unnecessarily shadows the builtin and adds dead code.

 

^{Reviewed by Cursor Bugbot for commit fd75bdc. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 5 total unresolved issues (including 4 from previous reviews).

^{Reviewed by Cursor Bugbot for commit d633f93. Configure here.}

[cursor]

Enum value 1053 reassigned breaking existing BrainTrust detector

High Severity

Enum value 1053 was reassigned from BrainTrustApiKey to ShippoLiveToken, but the existing braintrust detector package still references DetectorType_BrainTrustApiKey and is still registered in defaults.go. This removes a live enum constant that's actively used by production code.

 

^{Reviewed by Cursor Bugbot for commit d633f93. Configure here.}