trufflehog icon indicating copy to clipboard operation
trufflehog copied to clipboard

Published 20 hours ago • verified publisher icon trufflesecurity

Update AzureDevops scanner

Open Kiblyn11 opened this issue 4 months ago • 0 comments

Description:

I observed one limitation with the current azure devops scanner. It works on scanning by projects and this missed a few valid tokens that were not on a specific project I believe (ones that are used to push deliverables to visual studio marketplace). I observed how DevOps PAT tokens are verified with CLI npx vsce verify-pat -p $TOKEN and came with this new verification method. As I'm not sure how it impact existing detector I chose to keep both methods in this PR.

I also extended keywords to improve result detection (in particular vsce tokens)

Checklist:

  • [x] Tests passing (make test-community)?
  • [x] Lint passing (make lint this requires golangci-lint)?

Kiblyn11 avatar Jun 17 '25 20:06 Kiblyn11