chore(deps): update pre-commit hook betterleaks/betterleaks to v1.7.4

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
betterleaks/betterleaks	repository	minor	v1.6.1 → v1.7.4

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.7.4

Compare Source

What's New

Added a components field in the [[rules]] table. The introduction of components moves Betterleaks toward a canonical rule model. Each rule in [[rules]] should describe how secrets get detected, which nearby values belong (via components) to it, how it is filtered, and how it is validated. Adding components keeps multipart relationships with the rule they belong to instead of introducing a separate configuration shape (or expanding [[rules.required]].

A rule can reference other rules as required or optional components. The
top-level rule regex remains the reported secret and proximity anchor:

[[rules]]
id = "credential"
regex = '''credential[=: ]+([A-Za-z0-9_-]+)'''
components = [
  { id = "account-id", within = "5L" },
  { id = "session-token", optional = true, within = "-2L,+4C" },
]

Components are required (as in optional=false, not as in "each rule requires components) by default. Set optional = true to attach a component when present without making it gate the primary finding; optional = false is equivalent to omitting the field. within is optional and uses the same grammar as --match-context: 5L allows the primary match line plus up to four lines before and after, 100C allows 100 characters on either side, and signs make a boundary directional (for example, -2L,+4C). When within is omitted, the component only needs to occur in the same fragment.

You can reference components in the validate Expr like:

components["account-id"]?.secret ?? ""

Components are keyed by the referenced component rule ID. Each has secret and captures fields.

Changelog

• ed69eef captures was overloaded (#​285)
• fabb0c2 introduce components field, start deprecating rules.required (#​282)
• e8c8ab9 validator for algolia (#​278)

v1.7.3

Compare Source

Changelog

• 82b306a fix case where we arent filtering bc casing (#​279)
• 726c42a new logo

v1.7.2

Compare Source

Changelog

• b9de7fd fix filepath regression w/ fastwalk (#​274)

v1.7.1

Compare Source

What's New

The last thing we want is for Betterleaks to be spamming providers with unnecessary API calls. Betterleaks caches requests per unique finding so hitting a rate limit shouldn't be a common occurrence. If you find you are getting rate limited, then we probably need to tweak the rule to fire less often.

This release gives users the ability to control requests per second and max requests.

--validation-max-requests int   maximum validation requests sent to each provider target (0 = unlimited)
--validation-rps float          global validation requests per second (0 = unlimited)
--validation-rps-rule strings   rule-specific validation request rate as RULE=RPS (repeatable)

Fixed

Fixed a potential panic on archive handling #​266 and #​270

Changelog

• d56727e add validation limits (#​273)
• c197f8d bump min ver for config (#​271)
• ca147d7 fix(sources): don't crash the process on archive/decompress panics (#​266)
• 968138e fix(sources): recover from panics on the archive extractor path (#​270)
• 42fbff2 rm POST validators for aikido (#​272)

v1.7.0

Compare Source

What's New

More better rules, faster!

More Rules

Version	Rules	With validation
v1.6.1	325	106
v1.7.0	412	187

Full list of rules added:

aiven-auth-token
apify-api-token
asaas-api-token
azure-app-configuration-connection-string
azure-client-id
azure-servicebus-connection-string
azure-storage-account-key
azure-storage-account-name
azure-tenant-id
bitrise-access-token
buildkite-service-token
buildkite-user-access-token
canadian-digital-service-notify-api-key
checkout-secret-key
circleci-personal-token
circleci-project-token
cloudsmith-api-key
crates-io-api-key
databento-api-key
datastax-astra-application-token
devcycle-client-sdk-key
devcycle-mobile-sdk-key
devcycle-server-sdk-key
docker-swarm-join-token
docker-swarm-unlock-key
ebay-client-id
ebay-client-secret
fullstory-api-key
gcp-gemini-api
highnote-secret-live-key
ionic-personal-access-token
langchain-langsmith-personal-access-token
langchain-langsmith-service-key
lark-app-id
lark-app-secret
lichess-personal-access-token
mailersend-api-token
mercury-production-api-token
mergify-application-key
midtrans-production-server-client-key
neon-api-key
onesignal-rich-authentication-token
onfido-live-api-token-ca
onfido-live-api-token-eu
onfido-live-api-token-us
openweather-api-key
paddle-live-api-key
persona-production-api-key
pinecone-api-key.1
pinecone-api-key.2
pinterest-access-token
plivo-auth-id
plivo-auth-token
polar-oauth-access-token
polar-organization-access-token
polar-personal-access-token
proof-full-access-api-key
rainforest-pay-production-api-key
ramp-client-id
ramp-client-secret
redirect-pizza-api-token.1
render-api-key
rootly-api-key.1
runpod-api-key.1
salesforce-access-token.1
salesforce-instance-url.1
samsara-api-token.1
scalr-api-access-token.1
segment-public-api-token.1
snowflake-account-host.1
snowflake-programmatic-access-token.1
sslmate-api-key.1
tableau-personal-access-token-name.1
tableau-personal-access-token.1
tableau-server-host.1
tailscale-api-key.1
telnyx-api-v2-key.1
temporal-cloud-api-key.1
thunderstore-api-token.1
unkey-root-key.1
val-town-api-token.1
wakatime-api-key.1
wakatime-api-key.2
weatherstack-api-key.1
workato-developer-api-token.1
workos-production-api-key.1
zuplo-consumer-api-key.1

We added 87 new rules, and increased rules with validation from 106 to 187 while dropping scan times.

Better Rules

Thanks to the excellent work by @​joeleonjr, the default generic rule now filters out common public-by-design credentials. These credentials are explicitly intended for client-side use and generally lack access to sensitive data or privileged operations. Reporting them as generic secrets creates unnecessary triage work.

Some publishable credentials have distinctive formats and can be filtered directly. Supabase publishable keys, for example, match the recognizable sb_publishable_[A-Za-z0-9_-]{31} format.

Other credentials do not have a unique shape. An hCaptcha site key looks like an ordinary UUID, so filtering every matching UUID would hide unrelated secrets. Betterleaks therefore requires both the expected format and nearby provider context:

  matchesAny(
    finding["secret"],
    [`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`]
  )
  && filter.containsAny(
    providerMatchContext,
    ["hcaptcha", "site_key", "sitekey"]
  )

This removes a known hCaptcha site key from generic results without suppressing every UUID in the codebase.

Faster Scans

Scans are faster now thanks to a couple optimizations:

• a faster filesystem walk: #​238 (thanks @​charlievieth)
• a custom internal case-folding Aho-Corasick matcher that visits keyword matches
  without first allocating lowercase copies (based on github.com/RRethy/ahocorasick MIT) #​240
• direct keyword-to-rule indexes and pooled candidate bitsets instead of
  rebuilding maps of candidate rule IDs for each fragment #​240
• removal of slow left-of-identifier preamble [\w.-]{0,50}?: #​233

Despite the default ruleset growing from 325 to 412 rules, scan time decreased across all six repository and scan-mode combinations tested.

Target	Mode	v1.6.1	v1.7.0	Scan-time reduction
Rails	Directory	0.346s	0.218s	37.1%
Rails	Git history, 16 workers	5.72s	5.22s	8.6%
GitLab	Directory	3.39s	2.63s	22.4%
GitLab	Git history, 16 workers	131.6s	108.0s	18.0%
Betterleaks	Directory	0.276s	0.202s	26.8%
Betterleaks	Git history, 16 workers	1.76s	1.32s	25.3%

Changelog

• 5babeb2 Drop near matches (#​245)
• bc21eb2 Feat/rule timings (#​227)
• 66d51b6 Filter Publishable and Test Keys from Generic Results (#​207)
• 555b1ec Fix PostHog key length ranges and add personal key validator (#​259)
• 7a28a0d More rules and rule updates (p-r) (#​260)
• a47f6c9 Perf/detect optimizations (#​240)
• 118446e Remove left preamble for a quick perf win (#​233)
• 38c1686 Rules/jul 15 batch 1 (#​246)
• b49c535 Rules/jul 17 batch 1 (#​253)
• b76f266 Some Azure Rules (#​222)
• 8e6d239 add config check test to ci (#​263)
• 2168b56 another batch (#​255)
• 88f8ab7 another batch (#​257)
• f64b922 another batch needs more review (#​262)
• 872e374 bump min ver (#​226)
• 813bd3b bunch of comments (#​243)
• 5c859ad cloudsmith rule (#​235)
• d0f00a3 consistent quoting
• 7f9ed4a couple of 'm's (#​256)
• 2eac852 fast walk (#​238)
• 85b491c fix data race w/ runtime bindings (#​231)
• f629149 fix(detect): log filter-skipped findings (#​199)
• 63d589f fix(kubernetes): expand Secret detection range (#​244)
• 06e89aa limit sourcegraph regex and keywords (#​248)
• 1ebee5c more rules (#​249)
• 6381fa4 need to review (#​264)
• 9be6bc2 render rule (#​242)
• e382667 stripe validator (#​247)
• 501de59 support for quoted and escaped values in --log-opts (#​201)
• 0b4063d validation check for existing gcp-api-key rule, create new gemini rules (#​230)

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "before 7am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.