#93 secrets: add Azure & GCP service-account key patterns to the built-in detector

[Anonymous]

Originally created by: fu351

Why

The built-in secret detector (SecretLeakageRule, src/doberman/engine/rules/secrets.py; patterns in _CREDENTIAL_PATTERNS, ~lines 52–75) already recognizes AWS (AKIA… / ASIA…), Google API keys (AIza…), GitHub, GitLab, Slack, Stripe, OpenAI/Anthropic, SendGrid, npm, JWTs, PEM private-key headers, and DB URIs with embedded creds. Two of the biggest clouds are missing:

• Azure — storage AccountKey=… / connection strings, SAS tokens.
• GCP service-account key JSON — the {"type": "service_account", …, "private_key": "-----BEGIN PRIVATE KEY-----…"} shape.

An agent handing one of those to an external destination should trip the same defense the others do.

What to do

Add conservative, well-anchored patterns for Azure and GCP SA keys to _CREDENTIAL_PATTERNS (and/or the structured detectors alongside it), wired to the same reason codes the existing patterns use (secret_exfiltration for clear external exfil, sensitive_secret_access for local reads).

Please respect this project rule

We never claim secret detection is airtight — it's defense-in-depth. So:

• Favor low-false-positive, tightly anchored patterns over greedy ones (a noisy rule that flags every base64 blob is worse than none).
• Don't oversell it in docs; keep the README's coverage note honest.

Tests (tests/unit)

• A synthetic Azure connection string and a synthetic GCP SA-key JSON are each detected with the right reason code.
• Redaction invariant (hard requirement): assert the synthetic secret value never appears in any log line, decision record, or CLI output.
• A benign near-miss (e.g. a normal base64 asset, a config value that merely contains AccountName=) must not trip.

Use fixtures — no real secrets, no network.

Done when

• Azure + GCP SA-key patterns land with tests; no raw secret is ever logged; the README secret-coverage note is updated and stays honest ("defense-in-depth, not exhaustive").

Why this is a good first issue

Self-contained, pattern-shaped work in one file — and you'll learn how Doberman balances detection against false positives and the redaction invariant.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed