[INS-497] Add Pganalyze Read Key Detector

[MuneebUllahKhan222]

Description

This PR adds the pganalyze Read API Key Detector for TruffleHog.

It scans for pganalyze Read API keys and optionally verifies them via the official pganalyze GraphQL API.

Regex:

\b(pgar_[A-Za-z0-9]{27})\b

The detector uses the contextual keyword pgar_ to reduce false positives.

Verification

For verification, we use the pganalyze GraphQL API endpoint:

https://app.pganalyze.com/graphql

We send a POST request with the token in the Authorization header using the format:

Authorization: Token <token>

A response code of:

• 200 OK means the API key is valid
• 401 Unauthorized means the API key is invalid.

This API endpoint is part of the official pganalyze API surface and can be used safely for verification. The verification request performs a read-only GraphQL query and does not perform any destructive actions.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Additive detector following existing feature-flag and verification patterns; no changes to core scan or auth paths beyond optional outbound HTTP during verify.

Overview
Adds PgAnalyze Read Key detection for tokens matching pgar_ plus 27 alphanumeric characters, with the pgar_ keyword for Aho-Corasick pre-filtering.

When verification is enabled, keys are checked via a POST to https://app.pganalyze.com/graphql using Authorization: Token <key>; 200 marks verified and 401 invalid.

Wires the scanner into default detectors behind PgAnalyzeReadKeyDetectorEnabled (enabled in OSS main.go), registers DetectorType_PgAnalyzeReadKey = 1054 in proto/generated code, and adds unit, pattern, and integration tests.

^{Reviewed by Cursor Bugbot for commit 4bd646f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Corpora Test Results

Scans a corpus of real-world public code against only the detectors changed in this PR, then compares unique match counts between the PR build and the main baseline to catch regex regressions. Verification is disabled — each detector's regex is measured independently.

1 new · 0 clean  |  Scoped to: pganalyzereadkey

Status	Detector	Unique matches (main)	Unique matches (PR)	New	Removed
🆕	pganalyzereadkey	—	0	—	—

• 🔴 regression: >5 new, >20% increase over main, or any removed
• ⚠️ warning: 1–5 new and ≤20% increase over main
• ✅ clean
• 🆕 new detector (no baseline)

[shahzadhaider1]

I think it's worth adding this to the ExtraData as well.

[shahzadhaider1]

Since the detector name is PgAnalyzeReadKey, which already indicates that this is a read-only key, what additional value does access_type: read provide in the secret metadata?

Also, can this secret type have other permission levels (e.g. write or admin), or is it always read-only?

[MuneebUllahKhan222]

The token only has read permissions. Also, I think we should keep access_type because if we decide to build an analyzer for this detector in the future, we'll likely want a single analyzer that can handle different types of pganalyze tokens. Since detector_type isn't available in the analyzer input, the analyzer wouldn't know which detector triggered it. Having access_type would provide the necessary context to determine how the token should be analyzed.

[MuneebUllahKhan222]

Also ExtraData doesn't make sense here because it is clear from the detector that the found token is a read key.

[amanfcp]

The wiring LGTM