Add Rails Master Key detector

[deerajcm]

What

Adds detector for Rails Master Keys (symmetric encryption keys from Ruby on Rails)

Why

Rails master keys are sensitive encryption keys that should be detected in code repositories

Changes

• Added detector pattern for 32 or 64 hexadecimal characters
• Implements verification by validating hex decode to 16 or 32 bytes
• Registered detector type 1063 in proto
• Supports both Rails 5.2+ (64 hex chars) and older configs (32 hex chars)

Testing

• Pattern matching tests pass
• Verification with real Rails master key returns Verified=true
• All tests passing

---

Note

Medium Risk
New credential and encryption-key detection increases scan sensitivity; the Rails hex regex may false-positive on unrelated 32/64-char hex, and Basic Auth findings always surface decoded passwords as unverified secrets.

Overview
Adds two new secret detectors and wires them into the default engine and DetectorType enum (BasicAuth = 1057, RailsMasterKey = 1063).

HTTP Basic Auth matches Authorization / auth headers with a Basic base64 payload, decodes it, and requires a non-empty username:password. Findings are always unverified (no endpoint to validate against) and populate SecretParts plus decoded RawV2.

Rails Master Key matches 32- or 64-character lowercase hex strings (deduped), with optional verification via hex decode length (16 or 32 bytes) and a rotation guide in ExtraData when verified.

Unit tests cover both detectors; Rails also has pattern/verification tests and a detectors-tag integration test scaffold. Note: the Rails integration test still references Scanner{client: ...} while Scanner is an empty struct and verification is local-only—those cases may not compile or match runtime behavior until aligned.

^{Reviewed by Cursor Bugbot for commit 6a83451. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Deeraj CM seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 6a83451. Configure here.}

[cursor]

Tautological verification always returns true for matches

High Severity

verifyRailsMasterKey always returns true for any regex match, making Verified meaningless. The regex ([0-9a-f]{64}|[0-9a-f]{32}) already guarantees the match is exactly 32 or 64 lowercase hex characters, so the length check, hex.DecodeString, and decoded-length check in the function are all tautologically satisfied. Every other detector in the codebase performs actual external verification (e.g., HTTP API calls). Here, any hex string (MD5 hashes, SHA-256 hashes, etc.) near keywords like "key" or "secret" will be reported as a verified Rails master key.

Additional Locations (1)

• pkg/detectors/railsmasterkey/railsmasterkey.go#L46-L55

 

^{Reviewed by Cursor Bugbot for commit 6a83451. Configure here.}