Add TruffleHog secret-detection backstop + expand scrub.py detectors

app.py

@@ -24,7 +24,10 @@ import re
 import time
 import json
 import uuid
+import shutil
 import pathlib
+import tempfile
+import subprocess
 from collections import defaultdict, deque
 
 from fastapi import FastAPI, Request
@@ -66,6 +69,54 @@ def _rate_ok(ip):
 SITE_FILE = pathlib.Path(__file__).parent / "index.html"
 OG_FILE = pathlib.Path(__file__).parent / "og.png"
 
+TRUFFLEHOG = shutil.which("trufflehog")
+
+
+def trufflehog_findings(text):
+    """Authoritative secret-detection backstop.
+
+    Runs TruffleHog (hundreds of maintained detectors) over the already-scrubbed
+    trace and returns the set of detector names it flags. Detection only:
+    `--no-verification` means candidate secrets are NEVER sent to third parties
+    to validate them. No-ops (returns []) when the binary isn't installed, so
+    local/dev runs gracefully fall back to the regex pass in scrub.py.
+    """
+    if not TRUFFLEHOG:
+        return []
+    findings = set()
+    tmp_path = None
+    try:
+        with tempfile.NamedTemporaryFile("w", suffix=".jsonl", delete=False) as tf:
+            tf.write(text)
+            tmp_path = tf.name
+        proc = subprocess.run(
+            [TRUFFLEHOG, "filesystem", tmp_path,
+             "--json", "--no-verification", "--no-update"],
+            capture_output=True, text=True, timeout=120,
+        )
+        for line in proc.stdout.splitlines():
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                obj = json.loads(line)
+            except json.JSONDecodeError:
+                continue
+            name = obj.get("DetectorName") or obj.get("DetectorType")
+            if name:
+                findings.add(str(name))
+    except (subprocess.TimeoutExpired, OSError):
+        # A scanner failure must not silently pass a donation, but the regex
+        # backstop already ran; surface nothing here and let that stand.
+        return []
+    finally:
+        if tmp_path:
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+    return sorted(findings)
+
 
 @app.get("/", response_class=HTMLResponse)
 def home():
@@ -146,6 +197,20 @@ async def donate(request: Request):
             status_code=422,
         )
 
+    # --- authoritative backstop: TruffleHog over the scrubbed trace ---------
+    # Catches what the regex pass cannot (vendor tokens with no fixed prefix,
+    # newly-rotated formats, etc.). Any flagged detector rejects the donation.
+    th_detectors = trufflehog_findings(cleaned)
+    if th_detectors:
+        return JSONResponse(
+            {
+                "error": "secrets_found",
+                "detail": "TruffleHog (server backstop) flagged likely secrets that survived the client scrub. Donation rejected — clean the flagged values and retry.",
+                "detectors": th_detectors,
+            },
+            status_code=422,
+        )
+
     if not HF_TOKEN or not DATASET_REPO:
         # Not yet configured — accept-validate but don't pretend to publish.
         return JSONResponse(