feat(enrichment): flag deployment-trigger and webhook URLs in secret-scan

[luciferlive112116]

Summary

Extends the secret-scan analyzer with 7 new high-confidence rules for deployment-trigger and webhook URLs
that embed a secret. These follow the existing URL-credential rules (slack_webhook_url / discord_webhook_url
/ teams_webhook_url / zapier_webhook_url / google_chat_webhook_url): a committed URL of this shape leaks a
capability — anyone who has it can trigger a production deploy or suppress a monitor's alerts.

kind	matches	leaked capability
netlify_build_hook_url	api.netlify.com/build_hooks/<id>	triggers a production build
vercel_deploy_hook_url	api.vercel.com/v1/integrations/deploy/prj_<id>/<token>	triggers a deployment
render_deploy_hook_url	api.render.com/deploy/srv-<id>?key=<key>	triggers a deployment
healthchecks_ping_url	hc-ping.com/<uuid>	lets anyone suppress the check's alerts
pipedream_webhook_url	<endpoint>.m.pipedream.net	invokes the workflow
azure_logic_app_url	<host>.logic.azure.com/workflows/…?sig=<sas>	triggers the workflow (SAS in sig=)
google_apps_script_url	script.google.com/macros/s/<deployment-id>/exec	invokes the deployed script

Supersedes the closed prior revision, whose Pipedream terminator (?![a-z0-9.]) rejected a dot-joined
look-alike suffix but still matched a hyphen-joined one (…m.pipedream.net-evil.com). This revision uses
(?![A-Za-z0-9.-]) — rejecting every hostname-continuation character — and adds that exact near-miss to the
negative test. Also applies the review nit to match the Healthchecks UUID case-insensitively (with an
uppercase positive case).

Why these are false-positive-safe. Every match is a full vendor-specific URL (host + the secret
path/param), so an ordinary string can't trip them, and there is no length to guess (the precision class that has
caused past regressions doesn't apply — the host anchors the match). The negative test asserts that vendor
API/docs/dashboard URLs with no secret segment produce nothing, that a Render deploy URL without the key
query param is not flagged, and that both a dot-joined and a hyphen-joined look-alike suffix host
(…m.pipedream.net.evil.com, …m.pipedream.net-evil.com) do not match — the Pipedream rule is the only one whose
match ends at the host, so its terminator rejects every hostname-continuation character.

All 7 are new kinds (verified against the analyzer's current rule kinds — no duplicate) and inserted before
the generic-assignment rule so the specific kind wins. SecretFinding.kind is a free-form string, so there is
no types.ts/render.ts/analyzer-metadata.json change — a two-file, rules-only diff.

No linked issue: additive detection-coverage extending an existing analyzer along its own established lines; each
rule is a self-evident, industry-standard credential URL with no public API/schema/deploy surface change — fits
the repo's preferred (not required) linked-issue policy.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run typecheck
• npm run rees:test — the review-enrichment build + analyzer suite (see note below)
• npm run test:coverage (N/A — this analyzer is in review-enrichment/, outside the root src/** Codecov scope)
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Ran locally: git diff --check (clean), the review-enrichment TypeScript build (exit 0), and the secret-scan
  suite via node --test — 104/104 pass, including a table test asserting each of the 7 new URL formats
  produces exactly one finding of its own kind at high confidence, and a negative test asserting non-secret
  vendor URLs, a param-less Render URL, and a look-alike suffix host produce none.
• Not run locally: the UI, root typecheck, and the metadata:check step of rees:test. This change adds only
  RULES entries (no analyzer descriptor field), so the committed analyzer-metadata.json / UI mirror are
  unchanged (a local regeneration produces a zero-content diff) and metadata:check passes on CI (Linux). On
  this Windows dev box metadata:check reports a spurious line-ending difference; it fails identically on
  unmodified main. analyzer-metadata.json was NOT modified.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Notes

• Detection-only additions: 7 new stateless RULES following the existing specific→generic pattern; no existing
  rule or the analyzer descriptor changed, so current findings and analyzer-metadata.json are unaffected. Each
  new kind reports only file:line + the public-safe kind, never the matched value.
• Test fixtures are assembled from fragments at run time (never a contiguous secret-shaped literal in source),
  so GitHub push protection does not flag this fixture file.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 07:11:57 UTC}

2 files · 1 AI reviewer · no blockers · readiness 80/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This adds focused high-confidence secret-scan rules for deployment/webhook capability URLs and covers the intended positive cases plus the Pipedream suffix regression. The implementation is consistent with the existing rule table, and the Pipedream hostname-continuation guard is the right shape for the prior near-miss. I do not see a reachable correctness break in the visible diff, but several of the new URL regexes should get the same terminator treatment so they do not report prefix-only matches inside longer non-secret strings.

Nits — 5 non-blocking

• nit: review-enrichment/src/analyzers/secret-scan.ts:961 should add a token/path terminator after the Netlify build-hook id, because the current `[0-9a-f]{24}` will also match the first 24 chars of a longer hex-ish path segment.
• nit: review-enrichment/src/analyzers/secret-scan.ts:967 should add a terminator after the Vercel deploy token so the rule reports the full credential-shaped URL instead of a prefix of a longer path segment.
• nit: review-enrichment/src/analyzers/secret-scan.ts:973 should add a terminator after the Render `key` value, matching the care you took on the Pipedream hostname continuation case.
• nit: review-enrichment/src/analyzers/secret-scan.ts:980 should add a terminator after the Healthchecks UUID so a longer UUID-prefixed path is not classified as the exact ping URL.
• nit: review-enrichment/src/analyzers/secret-scan.ts:1001 should add a terminator after `/exec` if this rule is meant to match only the deployed web-app URL and not arbitrary longer Apps Script paths.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ No-issue rationale	PR body explains why no issue is linked.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 146 registered-repo PR(s), 80 merged, 21 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	luciferlive112116; Gittensor profile; 146 PR(s), 21 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: luciferlive112116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: JavaScript, MDX, Python, Rust, TypeScript
• Official Gittensor activity: 146 PR(s), 21 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.