🔑 fix: Require Colon in API-Key Header Detection

packages/api/src/protection/detectors/pattern.ts

@@ -111,7 +111,7 @@ const STARTER_PATTERNS: readonly CompiledPattern[] = [
   {
     id: 'api_key_header',
     label: 'api-key header',
-    pattern: /\b(api-key:?\s+)[^\s"']+/i,
+    pattern: /\b(api-key:\s+)[^\s"']+/i,
     category: 'credential',
   },
 ];

packages/api/src/protection/runtime.spec.ts

@@ -345,6 +345,29 @@ describe('configured content inspection', () => {
     });
   });
 
+  it('does not interpret the api-key detector label as an API key header', () => {
+    const filters: FiltersConfig = {
+      messages: {
+        pii: {
+          starterPatterns: ['api_key_header'],
+        },
+      },
+    };
+
+    expect(
+      inspectContent(
+        [
+          fragment(
+            'message',
+            'text',
+            'Submitted content contains an api-key header. Remove it and try again.',
+          ),
+        ],
+        { filters },
+      ),
+    ).toBeNull();
+  });
+
   it('keeps the runtime starter catalog aligned with the public schema', () => {
     expect(FILTER_PII_STARTER_PATTERNS).toEqual(STARTER_PATTERN_CASES.map(([ruleId]) => ruleId));
   });