Skip to content

[INS-339] Add New Relic User Key detector#4794

Open
mustansir14 wants to merge 5 commits intotrufflesecurity:mainfrom
mustansir14:INS-339-Detector-Visible-New-Relic-User-API-Key
Open

[INS-339] Add New Relic User Key detector#4794
mustansir14 wants to merge 5 commits intotrufflesecurity:mainfrom
mustansir14:INS-339-Detector-Visible-New-Relic-User-API-Key

Conversation

@mustansir14
Copy link
Contributor

@mustansir14 mustansir14 commented Mar 6, 2026

Description:

This PR adds the New Relic User Key Detector.

Regex: \b(NRAK-[A-Z0-9]{27})\b

Verification:
For verification, we use the New relic NerdGraph API: https://api.newrelic.com/graphql.
We send a POST request with body { requestContext { userId } }. A response code of 200 means the key is valid. 401 means it is an invalid/rotated key and 403 means the region is incorrect.
Note: For EU region keys, the endpoint should be https://api.eu.newrelic.com/graphql"

Corpora Test:
The detector does not appear in the list.
image
image

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Adds a new detector that introduces outbound verification requests to New Relic’s NerdGraph API (US/EU), which could impact scan performance/behavior if the endpoint is slow or changes responses. Otherwise changes are additive and isolated to detector registration and protobuf enum wiring.

Overview
Adds a new NewRelicUserKey detector that finds NRAK-... user API keys via regex and optionally verifies them by calling New Relic’s NerdGraph GraphQL endpoint (trying US and EU regions) and recording region/user_id in ExtraData.

Registers the detector in the default detector list and extends the detector type enum (proto/detectors.proto + generated detectors.pb.go). Includes unit, integration, and benchmark tests for matching and verification behavior.

Written by Cursor Bugbot for commit 849426f. This will update automatically on new commits. Configure here.

@mustansir14 mustansir14 requested a review from a team March 6, 2026 10:50
@mustansir14 mustansir14 requested review from a team as code owners March 6, 2026 10:50
Copy link

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 2 potential issues.

Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant