From c78022afca995efc61c79b83f409804007b6bfb8 Mon Sep 17 00:00:00 2001
From: Dustin Healy <54083382+dustinhealy@users.noreply.github.com>
Date: Mon, 5 Oct 2026 19:15:49 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=91=20fix:=20Require=20Colon=20in=20AP?=
 =?UTF-8?q?I-Key=20Header=20Detection?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../api/src/protection/detectors/pattern.ts   |  2 +-
 packages/api/src/protection/runtime.spec.ts   | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/packages/api/src/protection/detectors/pattern.ts b/packages/api/src/protection/detectors/pattern.ts
index 6456b931be5..f6c9cdb0408 100644
--- a/packages/api/src/protection/detectors/pattern.ts
+++ b/packages/api/src/protection/detectors/pattern.ts
@@ -111,7 +111,7 @@ const STARTER_PATTERNS: readonly CompiledPattern[] = [
   {
     id: 'api_key_header',
     label: 'api-key header',
-    pattern: /\b(api-key:?\s+)[^\s"']+/i,
+    pattern: /\b(api-key:\s+)[^\s"']+/i,
     category: 'credential',
   },
 ];
diff --git a/packages/api/src/protection/runtime.spec.ts b/packages/api/src/protection/runtime.spec.ts
index 78de09b14c0..cb6bb582146 100644
--- a/packages/api/src/protection/runtime.spec.ts
+++ b/packages/api/src/protection/runtime.spec.ts
@@ -345,6 +345,29 @@ describe('configured content inspection', () => {
     });
   });
 
+  it('does not interpret the api-key detector label as an API key header', () => {
+    const filters: FiltersConfig = {
+      messages: {
+        pii: {
+          starterPatterns: ['api_key_header'],
+        },
+      },
+    };
+
+    expect(
+      inspectContent(
+        [
+          fragment(
+            'message',
+            'text',
+            'Submitted content contains an api-key header. Remove it and try again.',
+          ),
+        ],
+        { filters },
+      ),
+    ).toBeNull();
+  });
+
   it('keeps the runtime starter catalog aligned with the public schema', () => {
     expect(FILTER_PII_STARTER_PATTERNS).toEqual(STARTER_PATTERN_CASES.map(([ruleId]) => ruleId));
   });