Skip to content

adding customizable successRanges and rotatedRanges to customDetector#4892

Open
jordanTunstill wants to merge 2 commits intomainfrom
CustomDetectorVerificationOptions
Open

adding customizable successRanges and rotatedRanges to customDetector#4892
jordanTunstill wants to merge 2 commits intomainfrom
CustomDetectorVerificationOptions

Conversation

@jordanTunstill
Copy link
Copy Markdown
Contributor

@jordanTunstill jordanTunstill commented Apr 16, 2026

Description:

This would allow users to add successRanges and rotatedRanges to their customDetectors, for verification purposes, allowing them control/configuration over what is considered live/rotated for these custom detections.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Changes custom detector verification semantics based on HTTP status codes and adds a new proto field, which could affect how secrets are marked verified/unverified and how verification errors are reported.

Overview
Custom detector webhook verification now supports configurable HTTP status success and rotated code ranges via successRanges and the new rotatedRanges, allowing verifiers to mark secrets as live, rotated, or inconclusive based on status codes (while keeping legacy behavior when neither is provided).

This adds range matching/validation utilities, updates NewWebhookCustomRegex to validate both range sets, records truncated verifier responses on “live” outcomes, and introduces tests covering YAML parsing, range validation/matching, mixed legacy+ranged verifier behavior, and verification error handling when responses match neither configured set.

Reviewed by Cursor Bugbot for commit 532003f. Bugbot is set up for automated code reviews on this repo. Configure here.

@jordanTunstill jordanTunstill requested a review from a team April 16, 2026 19:05
@jordanTunstill jordanTunstill requested review from a team as code owners April 16, 2026 19:05
Copy link
Copy Markdown

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit be9bfc5. Configure here.

Comment thread pkg/custom_detectors/custom_detectors.go
…o that an earlier ranged verifier's rangesInEffect = true can't trigger a spurious SetVerificationError after the legacy verifier already confirmed the secret as live.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant