Skip to content

Conversation

@rootranjan
Copy link

Fixes #4628

Description:

Reduce false positives in Chatbot detector by filtering out legitimate code identifiers that match the detector pattern.

Changes:

  • Add filters to exclude letters-only matches (no digits)
  • Filter out snake_case patterns (variable/table names)
  • Filter out camelCase/PascalCase patterns (code identifiers)
  • Fix lint error by properly handling res.Body.Close() error

This reduces false positives from legitimate code identifiers like variable names, class names, and schema names while still detecting real Chatbot API keys that contain digits and have higher entropy.

Problem:
The Chatbot detector was flagging any 32-character alphanumeric string near the keyword "chatbot" as a potential secret, including:

  • PascalCase variable names (e.g., internalFeatureNavigationManager)
  • Snake_case identifiers (e.g., analytics_abc_meltsys_adachatbot)
  • Class names, function names, and configuration keys

Solution:
Added isLikelyFalsePositive() helper function that filters out:

  1. Strings with only letters (no digits) - Real API keys typically contain digits
  2. Snake_case patterns (^[a-z]+(_[a-z]+)+$) - Common for variable/table names
  3. CamelCase/PascalCase patterns - Common for code identifiers

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

- Add filters to exclude letters-only matches (no digits)
- Filter out snake_case patterns (variable/table names)
- Filter out camelCase/PascalCase patterns (code identifiers)
- Fix lint error by properly handling res.Body.Close() error

This reduces false positives from legitimate code identifiers like
variable names, class names, and schema names while still detecting
real Chatbot API keys that contain digits and have higher entropy.
@rootranjan rootranjan requested a review from a team December 30, 2025 16:52
@rootranjan rootranjan requested a review from a team as a code owner December 30, 2025 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Chatbot detector flags legitimate code identifiers as secrets

1 participant