Update README.md

Update Adding_Detectors_external.md (#1822 )
* Update Adding_Detectors_external.md * Update Adding_Detectors_external.md * Update Adding_Detectors_external.md * Lil more
2023-09-26 21:16:35 -07:00 · 2023-09-26 17:18:58 -05:00 · 2023-09-26 12:38:33 -07:00 · 2023-09-26 12:25:48 -04:00 · 2023-09-26 08:23:07 -05:00 · 2023-09-25 12:48:23 -07:00
707 changed files with 15127 additions and 7605 deletions
@@ -0,0 +1,46 @@
+name: detector test aggregation
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 8 * * *"
+
+jobs:
+  test-detectors:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: "read"
+      contents: "read"
+      id-token: "write"
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - id: "auth"
+        uses: "google-github-actions/auth@v1"
+        with:
+          workload_identity_provider: "projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
+          service_account: "github-ci-external@trufflehog-testing.iam.gserviceaccount.com"
+      - name: Test
+        run: make test-integration
+      - name: Set up gotestsum
+        run: |
+          go install gotest.tools/gotestsum@latest
+          mkdir -p tmp/test-results
+      - name: Test
+        run: |
+          CGO_ENABLED=1 gotestsum --junitfile tmp/test-results/test.xml --raw-command -- go test -json -tags=detectors -timeout=15m $(go list ./... | grep pkg/detectors)
+      - name: Upload test results to BuildPulse for flaky test detection
+        if: ${{ !cancelled() }} # Run this step even when the tests fail. Skip if the workflow is cancelled.
+        uses: buildpulse/buildpulse-action@main
+        with:
+          account: 79229934
+          repository: 694446374
+          path: |
+            tmp/test-results/*.xml
+          key: ${{ secrets.BUILDPULSE_DETECTORS_ACCESS_KEY_ID }}
+          secret: ${{ secrets.BUILDPULSE_DETECTORS_SECRET_ACCESS_KEY }}
+          tags: detectors
@@ -1,4 +1,3 @@
-
 name: Test

 on:
@@ -14,57 +13,57 @@ jobs:
    if: ${{ ! github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
-      actions: 'read'
-      contents: 'read'
-      id-token: 'write'
+      actions: "read"
+      contents: "read"
+      id-token: "write"
    steps:
-    - name: Install Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: '1.21'
-    - name: Checkout code
-      uses: actions/checkout@v3
-    - id: 'auth'
-      uses: 'google-github-actions/auth@v1'
-      with:
-        workload_identity_provider: 'projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
-        service_account: 'github-ci-external@trufflehog-testing.iam.gserviceaccount.com'
-    - name: Test
-      run: make test-integration
-  test-detectors:
-    if: ${{ ! github.event.pull_request.head.repo.fork }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: 'read'
-      contents: 'read'
-      id-token: 'write'
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: '1.21'
-    - name: Checkout code
-      uses: actions/checkout@v3
-    - id: 'auth'
-      uses: 'google-github-actions/auth@v1'
-      with:
-        workload_identity_provider: 'projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider'
-        service_account: 'github-ci-external@trufflehog-testing.iam.gserviceaccount.com'
-    - name: Test
-      run: make test-detectors
-      continue-on-error: true
+      - name: Install Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - id: "auth"
+        uses: "google-github-actions/auth@v1"
+        with:
+          workload_identity_provider: "projects/811013774421/locations/global/workloadIdentityPools/github-pool/providers/github-provider"
+          service_account: "github-ci-external@trufflehog-testing.iam.gserviceaccount.com"
+      - name: Set up gotestsum
+        run: |
+          go install gotest.tools/gotestsum@latest
+          mkdir -p tmp/test-results
+      - name: Test
+        run: |
+          CGO_ENABLED=1 gotestsum --junitfile tmp/test-results/test.xml --raw-command -- go test -json -tags=sources $(go list ./... | grep -v /vendor/ | grep -v pkg/detectors)
+        if: ${{ success() || failure() }} # always run this step, even if there were previous errors
+      - name: Upload test results to BuildPulse for flaky test detection
+        if: ${{ !cancelled() }} # Run this step even when the tests fail. Skip if the workflow is cancelled.
+        uses: buildpulse/buildpulse-action@main
+        with:
+          account: 79229934
+          repository: 77726177
+          path: |
+            tmp/test-results/*.xml
+          key: ${{ secrets.BUILDPULSE_ACCESS_KEY_ID }}
+          secret: ${{ secrets.BUILDPULSE_SECRET_ACCESS_KEY }}
+          tags: integration
+      - name: Annotate test results
+        uses: mikepenz/action-junit-report@v3
+        if: success() || failure() # always run even if the previous step fails
+        with:
+          report_paths: "tmp/test-results/*.xml"
  test-community:
    if: ${{ github.event.pull_request.head.repo.fork }}
    runs-on: ubuntu-latest
    permissions:
-      actions: 'read'
-      contents: 'read'
+      actions: "read"
+      contents: "read"
    steps:
-    - name: Install Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: '1.21'
-    - name: Checkout code
-      uses: actions/checkout@v3
-    - name: Test
-      run: make test-community
+      - name: Install Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Checkout code
+        uses: actions/checkout@v3
+      - name: Test
+        run: make test-community
@@ -1,4 +1,4 @@
-PROTOS_IMAGE ?= trufflesecurity/protos:1.18-0
+PROTOS_IMAGE ?= trufflesecurity/protos:1.21-0

 .PHONY: check
 .PHONY: lint
@@ -59,7 +59,7 @@ protos-windows:

 release-protos-image:
 	docker buildx build --push --platform=linux/amd64,linux/arm64 \
-	-t trufflesecurity/protos:1.18-0 -f hack/Dockerfile.protos .
+	-t trufflesecurity/protos:1.21-0 -f hack/Dockerfile.protos .

 snifftest:
 	./hack/snifftest/snifftest.sh
@@ -61,6 +61,9 @@ Download and unpack from https://github.com/trufflesecurity/trufflehog/releases
 # Compile from source
 git clone https://github.com/trufflesecurity/trufflehog.git
 cd trufflehog; go install
+
+# Using installation script
+curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
 ```

 # :rocket: Quick Start
@@ -90,10 +93,10 @@ Timestamp: 2022-06-16 10:17:40 -0700 PDT
 ...
 ```

-## 2: Scan a GitHub Org for only verified secrets
+## 2: Scan a GitHub Org for only verified secrets (including the comments sections)

 ```bash
-trufflehog github --org=trufflesecurity --only-verified
+trufflehog github --org=trufflesecurity --only-verified --issue-coments --pr-comments
 ```

 ## 3: Scan a GitHub Repo for only verified keys and get JSON output
@@ -110,37 +113,44 @@ Expected output:
 ...
 ```

-## 4: Scan an S3 bucket for verified keys
+## 4: Scan a GitHub Repo + its Issues and Pull Requests.
+
+
+```bash
+trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issues --prs
+```
+
+## 5: Scan an S3 bucket for verified keys

 ```bash
 trufflehog s3 --bucket=<bucket name> --only-verified
 ```

-## 5: Scan S3 buckets using IAM Roles
+## 6: Scan S3 buckets using IAM Roles

 ```bash
 trufflehog s3 --role-arn=<iam role arn>
 ```

-## 6: Scan a Github Repo using SSH authentication in docker
+## 7: Scan a Github Repo using SSH authentication in docker

 ```bash
 docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" trufflesecurity/trufflehog:latest git ssh://github.com/trufflesecurity/test_keys
 ```

-## 7: Scan individual files or directories
+## 8: Scan individual files or directories

 ```bash
 trufflehog filesystem path/to/file1.txt path/to/file2.txt path/to/dir
 ```

-## 8: Scan GCS buckets for verified secrets.
+## 9: Scan GCS buckets for verified secrets.

 ```bash
 trufflehog gcs --project-id=<project-ID> --cloud-environment --only-verified
 ```

-## 9: Scan a Docker image for verified secrets.
+## 10: Scan a Docker image for verified secrets.

 Use the `--image` flag multiple times to scan multiple images.

@@ -0,0 +1,14 @@
+# Examples
+This folder contains various examples like custom detectors, scripts, etc. Feel free to contribute!
+
+### Generic Detector
+An often requested feature for TruffleHog is a generic detector. By default, we do not support generic detection as it would result in lots of false positives. However, if you want to attempt detect generic secrets you can use a custom detector. 
+
+#### Try it out:
+```
+wget https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/examples/generic.yml
+trufflehog filesystem --config=$PWD/generic.yml $PWD
+
+# to filter so that _only_ generic credentials are logged:
+trufflehog filesystem --config=$PWD/generic.yml --json --no-verification $PWD | awk '/generic-api-key/{print $0}'
+```
@@ -0,0 +1,15 @@
+detectors:
+- name: generic-api-key
+  keywords:
+  - key
+  - api
+  - token
+  - secret
+  - client
+  - passwd
+  - password
+  - auth
+  - access
+  regex:
+    # borrowing the gitleaks generic-api-key regex
+    generic-api-key: "(?i)(?:key|api|token|secret|client|passwd|password|auth|access)(?:[0-9a-z\\-_\\t .]{0,20})(?:[\\s|']|[\\s|\"]){0,3}(?:=|>|:{1,3}=|\\|\\|:|<=|=>|:|\\?=)(?:'|\"|\\s|=|\\x60){0,5}([0-9a-z\\-_.=]{10,150})(?:['|\"|\\n|\\r|\\s|\\x60|;]|$)"
@@ -9,8 +9,9 @@ replace github.com/couchbase/gocbcore/v10 => github.com/couchbase/gocbcore/v10 v

 require (
 	cloud.google.com/go/secretmanager v1.11.1
-	cloud.google.com/go/storage v1.31.0
+	cloud.google.com/go/storage v1.33.0
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
+	github.com/AzureAD/microsoft-authentication-library-for-go v0.5.1
 	github.com/BobuSumisu/aho-corasick v1.0.3
 	github.com/TheZeroSlave/zapsentry v1.17.0
 	github.com/aws/aws-sdk-go v1.44.83
@@ -20,7 +21,7 @@ require (
 	github.com/bitfinexcom/bitfinex-api-go v0.0.0-20210608095005-9e0b26f200fb
 	github.com/bradleyfalzon/ghinstallation/v2 v2.6.0
 	github.com/charmbracelet/bubbles v0.16.1
-	github.com/charmbracelet/bubbletea v0.24.1
+	github.com/charmbracelet/bubbletea v0.24.2
 	github.com/charmbracelet/glamour v0.6.0
 	github.com/charmbracelet/lipgloss v0.7.1
 	github.com/couchbase/gocb/v2 v2.6.3
@@ -29,10 +30,10 @@ require (
 	github.com/envoyproxy/protoc-gen-validate v1.0.2
 	github.com/fatih/color v1.15.0
 	github.com/felixge/fgprof v0.9.3
-	github.com/getsentry/sentry-go v0.22.0
+	github.com/getsentry/sentry-go v0.24.1
 	github.com/go-errors/errors v1.4.2
 	github.com/go-git/go-git/v5 v5.8.1
-	github.com/go-ldap/ldap/v3 v3.4.5
+	github.com/go-ldap/ldap/v3 v3.4.6
 	github.com/go-logr/logr v1.2.4
 	github.com/go-logr/zapr v1.2.4
 	github.com/go-redis/redis v6.15.9+incompatible
@@ -53,7 +54,8 @@ require (
 	github.com/launchdarkly/go-server-sdk/v6 v6.1.0
 	github.com/lib/pq v1.10.9
 	github.com/lrstanley/bubblezone v0.0.0-20221222153816-e95291e2243e
-	github.com/mattn/go-isatty v0.0.18
+	github.com/marusama/semaphore/v2 v2.5.0
+	github.com/mattn/go-isatty v0.0.19
 	github.com/mattn/go-sqlite3 v1.14.17
 	github.com/mholt/archiver/v4 v4.0.0-alpha.8
 	github.com/muesli/reflow v0.3.0
@@ -70,12 +72,12 @@ require (
 	go.mongodb.org/mongo-driver v1.12.0
 	go.uber.org/mock v0.2.0
 	go.uber.org/zap v1.24.0
-	golang.org/x/crypto v0.12.0
+	golang.org/x/crypto v0.13.0
 	golang.org/x/exp v0.0.0-20230206171751-46f607a40771
-	golang.org/x/oauth2 v0.10.0
+	golang.org/x/oauth2 v0.12.0
 	golang.org/x/sync v0.3.0
-	golang.org/x/text v0.12.0
-	google.golang.org/api v0.131.0
+	golang.org/x/text v0.13.0
+	google.golang.org/api v0.132.0
 	google.golang.org/protobuf v1.31.0
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
 	gopkg.in/h2non/gock.v1 v1.1.2
@@ -83,7 +85,7 @@ require (
 )

 require (
-	cloud.google.com/go v0.110.2 // indirect
+	cloud.google.com/go v0.110.4 // indirect
 	cloud.google.com/go/compute v1.20.1 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
 	cloud.google.com/go/iam v1.1.0 // indirect
@@ -151,7 +153,7 @@ require (
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/form3tech-oss/jwt-go v3.2.5+incompatible // indirect
 	github.com/gabriel-vasile/mimetype v1.4.2 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.4 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.4.1 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
@@ -168,7 +170,7 @@ require (
 	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/pprof v0.0.0-20211214055906-6f57359322fd // indirect
 	github.com/google/s2a-go v0.1.4 // indirect
-	github.com/google/uuid v1.3.0 // indirect
+	github.com/google/uuid v1.3.1 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
 	github.com/gorilla/css v1.0.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20171119193500-2bcd89a1743f // indirect
@@ -203,7 +205,7 @@ require (
 	github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8 // indirect
 	github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe // indirect
+	github.com/montanaflynn/stats v0.6.6 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
@@ -244,16 +246,16 @@ require (
 	go.uber.org/multierr v1.6.0 // indirect
 	go4.org v0.0.0-20200411211856-f5505b9728dd // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.14.0 // indirect
-	golang.org/x/sys v0.11.0 // indirect
-	golang.org/x/term v0.11.0 // indirect
+	golang.org/x/net v0.15.0 // indirect
+	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/term v0.12.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.12.0 // indirect
 	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230629202037-9506855d4529 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
 	google.golang.org/grpc v1.56.2 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
@@ -7,8 +7,8 @@ cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTj
 cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
 cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
 cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.110.2 h1:sdFPBr6xG9/wkBbfhmUz/JmZC7X6LavQgcrVINrKiVA=
-cloud.google.com/go v0.110.2/go.mod h1:k04UEeEtb6ZBRTv3dZz4CeJC3jKGxyhl0sAiVVquxiw=
+cloud.google.com/go v0.110.4 h1:1JYyxKMN9hd5dR2MYTPWkGUgcoxVVhg0LKNKEo0qvmk=
+cloud.google.com/go v0.110.4/go.mod h1:+EYjdK8e5RME/VY/qLCAtuyALQ9q67dvuum8i+H5xsI=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/compute v1.20.1 h1:6aKEtlUiwEpJzM001l0yFkpXmUVXaN8W+fbkb2AZNbg=
@@ -25,8 +25,8 @@ cloud.google.com/go/secretmanager v1.11.1 h1:cLTCwAjFh9fKvU6F13Y4L9vPcx9yiWPyWXE
 cloud.google.com/go/secretmanager v1.11.1/go.mod h1:znq9JlXgTNdBeQk9TBW/FnR/W4uChEKGeqQWAJ8SXFw=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.31.0 h1:+S3LjjEN2zZ+L5hOwj4+1OkGCsLVe0NzpXKQ1pSdTCI=
-cloud.google.com/go/storage v1.31.0/go.mod h1:81ams1PrhW16L4kF7qg+4mTq7SRs5HsbDTM0bWvrwJ0=
+cloud.google.com/go/storage v1.33.0 h1:PVrDOkIC8qQVa1P3SXGpQvfuJhN2LHOoyZvWs8D2X5M=
+cloud.google.com/go/storage v1.33.0/go.mod h1:Hhh/dogNRGca7IWv1RC2YqEn0c0G77ctA/OxflYkiD8=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
@@ -178,8 +178,8 @@ github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
 github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
-github.com/charmbracelet/bubbletea v0.24.1 h1:LpdYfnu+Qc6XtvMz6d/6rRY71yttHTP5HtrjMgWvixc=
-github.com/charmbracelet/bubbletea v0.24.1/go.mod h1:rK3g/2+T8vOSEkNHvtq40umJpeVYDn6bLaqbgzhL/hg=
+github.com/charmbracelet/bubbletea v0.24.2 h1:uaQIKx9Ai6Gdh5zpTbGiWpytMU+CfsPp06RaW2cx/SY=
+github.com/charmbracelet/bubbletea v0.24.2/go.mod h1:XdrNrV4J8GiyshTtx3DNuYkR1FDaJmO3l2nejekbsgg=
 github.com/charmbracelet/glamour v0.6.0 h1:wi8fse3Y7nfcabbbDuwolqTqMQPMnVPeZhDM273bISc=
 github.com/charmbracelet/glamour v0.6.0/go.mod h1:taqWV4swIMMbWALc0m7AfE9JkPSU8om2538k9ITBxOc=
 github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
@@ -263,13 +263,13 @@ github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
 github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
-github.com/getsentry/sentry-go v0.22.0 h1:XNX9zKbv7baSEI65l+H1GEJgSeIC1c7EN5kluWaP6dM=
-github.com/getsentry/sentry-go v0.22.0/go.mod h1:lc76E2QywIyW8WuBnwl8Lc4bkmQH4+w1gwTf25trprY=
+github.com/getsentry/sentry-go v0.24.1 h1:W6/0GyTy8J6ge6lVCc94WB6Gx2ZuLrgopnn9w8Hiwuk=
+github.com/getsentry/sentry-go v0.24.1/go.mod h1:lc76E2QywIyW8WuBnwl8Lc4bkmQH4+w1gwTf25trprY=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/gliderlabs/ssh v0.3.5 h1:OcaySEmAQJgyYcArR+gGGTHCyE7nvhEMTlYY+Dp8CpY=
 github.com/gliderlabs/ssh v0.3.5/go.mod h1:8XB4KraRrX39qHhT6yxPsHedjA08I/uBVwj4xC+/+z4=
-github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A=
-github.com/go-asn1-ber/asn1-ber v1.5.4/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
+github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
@@ -282,8 +282,8 @@ github.com/go-git/go-git/v5 v5.8.1 h1:Zo79E4p7TRk0xoRgMq0RShiTHGKcKI4+DI6BfJc/Q+
 github.com/go-git/go-git/v5 v5.8.1/go.mod h1:FHFuoD6yGz5OSKEBK+aWN9Oah0q54Jxl0abmj6GnqAo=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-ldap/ldap/v3 v3.4.5 h1:ekEKmaDrpvR2yf5Nc/DClsGG9lAmdDixe44mLzlW5r8=
-github.com/go-ldap/ldap/v3 v3.4.5/go.mod h1:bMGIq3AGbytbaMwf8wdv5Phdxz0FWHTIYMSzyrYgnQs=
+github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
+github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
 github.com/go-logr/logr v1.2.4 h1:g01GSCwiDw2xSZfjJ2/T9M+S6pFdcNtFYsp+Y43HYDQ=
 github.com/go-logr/logr v1.2.4/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/zapr v1.2.4 h1:QHVo+6stLbfJmYGkQ7uGHUCu5hnAFAj6mDe6Ea0SeOo=
@@ -304,6 +304,7 @@ github.com/goccy/go-json v0.10.0 h1:mXKd9Qw4NuzShiRlOXKews24ufknHO7gx30lsDyokKA=
 github.com/goccy/go-json v0.10.0/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 h1:ZpnhV/YsD2/4cESfV5+Hoeu/iUR3ruzNvZ+yQfO03a0=
 github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY=
 github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
@@ -382,9 +383,11 @@ github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8I
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
 github.com/google/s2a-go v0.1.4 h1:1kZ/sQM3srePvKs3tXAvQzo66XfcReoqFpIpIccE7Oc=
 github.com/google/s2a-go v0.1.4/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
+github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/enterprise-certificate-proxy v0.2.5 h1:UR4rDjcgpgEnqpIEvkiqTYKBCKLNmlge2eVjoZfySzM=
 github.com/googleapis/enterprise-certificate-proxy v0.2.5/go.mod h1:RxW0N9901Cko1VOCW3SXCpWP+mlIEkk2tP7jnHy9a3w=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
@@ -489,13 +492,15 @@ github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69
 github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/marusama/semaphore/v2 v2.5.0 h1:o/1QJD9DBYOWRnDhPwDVAXQn6mQYD0gZaS1Tpx6DJGM=
+github.com/marusama/semaphore/v2 v2.5.0/go.mod h1:z9nMiNUekt/LTpTUQdpp+4sJeYqUGpwMHfW0Z8V8fnQ=
 github.com/matryer/is v1.2.0 h1:92UTHpy8CDwaJ08GqLDzhhuixiBUUD1p3AU6PHddz4A=
 github.com/matryer/is v1.2.0/go.mod h1:2fLPjFQM9rhQ15aVEtbuwhJinnOqrmgXPNdZsdwlWXA=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
 github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
-github.com/mattn/go-isatty v0.0.18 h1:DOKFKCQ7FNG2L1rbrmstDN4QVRdS89Nkh85u68Uwp98=
-github.com/mattn/go-isatty v0.0.18/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
 github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
@@ -518,8 +523,9 @@ github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8Ie
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
-github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe h1:iruDEfMl2E6fbMZ9s0scYfZQ84/6SPL6zC8ACM2oIL0=
 github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
+github.com/montanaflynn/stats v0.6.6 h1:Duep6KMIDpY4Yo11iFsvyqJDyfzLF9+sndUKT+v64GQ=
+github.com/montanaflynn/stats v0.6.6/go.mod h1:etXPPgVO6n31NxCd9KQUMvCM+ve0ruNzt6R8Bnaayow=
 github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
 github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
 github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70 h1:kMlmsLSbjkikxQJ1IPwaM+7LJ9ltFu/fi8CRzvSnQmA=
@@ -565,6 +571,7 @@ github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTw
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
 github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pkg/browser v0.0.0-20210115035449-ce105d075bb4/go.mod h1:N6UoU20jOqggOuDwUaBQpluzLNDqif3kq9z2wpdYEfQ=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
 github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
 github.com/pkg/diff v0.0.0-20200914180035-5b29258ca4f7 h1:+/+DxvQaYifJ+grD4klzrS5y+KJXldn/2YTl5JG+vZ8=
@@ -701,8 +708,8 @@ golang.org/x/crypto v0.0.0-20220314234659-1baeb1ce4c0b/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.12.0 h1:tFM/ta59kqch6LlvYnPa0yx5a83cL2nHflFhYKvv9Yk=
-golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -767,16 +774,16 @@ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.14.0 h1:BONx9s002vGdD9umnlX1Po8vOZmrgH34qlHcD1MfK14=
-golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
+golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -835,16 +842,16 @@ golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.11.0 h1:F9tnn/DA/Im8nCwm+fX+1/eBwi4qFjRT++MhtVC4ZX0=
-golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -857,8 +864,8 @@ golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
@@ -910,8 +917,8 @@ google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsb
 google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
 google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
 google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.131.0 h1:AcgWS2edQ4chVEt/SxgDKubVu/9/idCJy00tBGuGB4M=
-google.golang.org/api v0.131.0/go.mod h1:7vtkbKv2REjJbxmHSkBTBQ5LUGvPdAqjjvt84XAfhpA=
+google.golang.org/api v0.132.0 h1:8t2/+qZ26kAOGSmOiHwVycqVaDg7q3JDILrNi/Z6rvc=
+google.golang.org/api v0.132.0/go.mod h1:AeTBC6GpJnJSRJjktDcPX0QwtS8pGYZOV6MSuSCusw0=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -934,12 +941,12 @@ google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvx
 google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20230629202037-9506855d4529 h1:9JucMWR7sPvCxUFd6UsOUNmA5kCcWOfORaT3tpAsKQs=
-google.golang.org/genproto v0.0.0-20230629202037-9506855d4529/go.mod h1:xZnkP7mREFX5MORlOPEzLMr+90PPZQ2QWzrVTWfAq64=
-google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529 h1:s5YSX+ZH5b5vS9rnpGymvIyMpLRJizowqDlOuyjXnTk=
-google.golang.org/genproto/googleapis/api v0.0.0-20230629202037-9506855d4529/go.mod h1:vHYtlOoi6TsQ3Uk2yxR7NI5z8uoV+3pZtR4jmHIkRig=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 h1:2FZP5XuJY9zQyGM5N0rtovnoXjiMUEIUMvw0m9wlpLc=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:8mL13HKkDa+IuJ8yruA3ci0q+0vsUz4m//+ottjwS5o=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130 h1:Au6te5hbKUV8pIYWHqOUZ1pva5qK/rwbIhoXEUB9Lu8=
+google.golang.org/genproto v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:O9kGHb51iE/nOGvQaDUuadVYqovW56s5emA88lQnj6Y=
+google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130 h1:XVeBY8d/FaK4848myy41HBqnDwvxeV3zMZhwN1TvAMU=
+google.golang.org/genproto/googleapis/api v0.0.0-20230706204954-ccb25ca9f130/go.mod h1:mPBs5jNgx2GuQGvFwUvVKqtn6HsUw9nP64BedgvqEsQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 h1:bVf09lpb+OJbByTj913DRJioFFAjf/ZGxEz7MajTp2U=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1,6 +1,6 @@
 # trufflesecurity/protos:1.18-0

-FROM golang:1.18-buster
+FROM golang:1.21-bullseye

 ARG TARGETARCH
 ARG TARGETOS
@@ -15,9 +15,9 @@ The purpose of Secret Detectors is to discover secrets with exceptionally high s
    + [Sourcing Guidelines](#sourcing-guidelines)
    + [Development Guidelines](#development-guidelines)
    + [Development Dependencies](#development-dependencies)
-    + [Creating a new Secret Scanner](#creating-a-new-secret-scanner)
+    + [Creating a new Secret Detector](#creating-a-new-secret-detector)
+    + [Testing the Detector](#testing-the-detector)
  * [Addendum](#addendum)
-    + [Using a test secret file](#using-a-test-secret-file)
    + [Adding Protos in Windows](#adding-protos-in-windows)

 ## Getting Started
@@ -52,37 +52,77 @@ Note: Be sure to update the tests to reference the new secret values in GSM, or

 3. Proceed from step 3 of [Creating a new Secret Scanner](#creating-a-new-secret-scanner)

-### Creating a new Secret Scanner
+### Creating a new Secret Detector

-1. Identify the Secret Detector name from the [/proto/detectors.proto](/proto/detectors.proto) `DetectorType` enum. If necessary, run `make protos` when adding new ones.
+1. Add a new Secret Detector enum to the [`DetectorType` list here](/proto/detectors.proto).

-2. Generate the Secret Detector
+2. Run `make protos` to update the `.pb` files.
+
+3. Generate the Secret Detector

   ```bash
   go run hack/generate/generate.go detector <DetectorType enum name>
+   example: go run hack/generate/generate.go detector SampleAPI
   ```
-3. Add Secret Scanner
+4. Add the Secret Detector to TruffleHog's Default Detectors

-   Add the secret scanner to the `pkg/engine/defaults.go` file like `github.com/trufflesecurity/trufflehog/v3/pkg/detectors/<detector_name>` and 
-   `<detector_name>.Scanner{},`
+   Add the secret scanner to the [`pkg/engine/defaults.go`](https://github.com/trufflesecurity/trufflehog/blob/main/pkg/engine/defaults.go) file like [`github.com/trufflesecurity/trufflehog/v3/pkg/detectors/<detector_name>`](https://github.com/trufflesecurity/trufflehog/blob/b71ea27a696bdf1c3141f637fda4ee4936c2f2d6/pkg/engine/defaults.go#L9) and 
+   [`<detector_name>.Scanner{}`](https://github.com/trufflesecurity/trufflehog/blob/b71ea27a696bdf1c3141f637fda4ee4936c2f2d6/pkg/engine/defaults.go#L1546)

-4. Complete the secret detector.
+5. Complete the Secret Detector.

   The previous step templated a boilerplate + some example code as a package in the `pkg/detectors` folder for you to work on.
-   The secret detector can be completed with these general steps:
+   The Secret Detector can be completed with these general steps:

-   1. Create a [test secrets file, and export the variable](#using-a-test-secret-file)
-   2. Update the pattern regex and keywords. Try iterating with [regex101.com](http://regex101.com/).
-   3. Update the verifier code to use a non-destructive API call that can determine whether the secret is valid or not.
+   1. Update the pattern regex and keywords. Try iterating with [regex101.com](http://regex101.com/).
+   2. Update the verifier code to use a non-destructive API call that can determine whether the secret is valid or not.
      * Make sure you understand [verification indeterminacy](#verification-indeterminacy).
-   4. Update the tests with these test cases at minimum:
-      1. Found and verified (using a credential loaded from GCP Secrets)
-      2. Found and unverified (determinately, i.e. the secret is invalid)
-      3. Found and unverified (indeterminately due to timeout)
-      4. Found and unverified (indeterminately due to an unexpected API response)
-      5. Not found
-      6. Any false positive cases that you come across
-   5. Create a pull request for review.
+   3. Create a [test for the detector](#testing-the-detector)
+   4. Create a pull request for review.
+
+### Testing the Detector
+To ensure the quality of your PR, make sure your tests are passing with verified credentials.
+
+1. Create a file called `.env` with this env file format:
+
+   ```bash
+   SECRET_TYPE_ONE=value
+   SECRET_TYPE_ONE_INACTIVE=v@lue
+   ```
+
+2. Export the `TEST_SECRET_FILE` variable, pointing to the env file:
+
+   ```bash
+   export TEST_SECRET_FILE=".env"
+   ```
+   The `.env` file should be in the new detector's directory like this:
+   ```
+   ├── tailscale
+   │   ├── .env
+   │   ├── tailscale.go
+   │   └── tailscale_test.go
+   ```
+   Now that a `.env` file is present, the test file can load secrets locally.
+
+3. Next, update the tests as necessary. A test file has already been generated by the `go run hack/generate/generate.go` command from earlier. There are 5 cases that have been generated:
+   1. Found and verified (using a credential loaded from the .env file)
+   2. Found and unverified (determinately, i.e. the secret is invalid)
+   3. Found and unverified (indeterminately due to timeout)
+   4. Found and unverified (indeterminately due to an unexpected API response)
+   5. Not found
+
+    Make any necessary updates to the tests. Note there might not be any changes required as the tests generated by the `go run hack/generate/generate.go` command are pretty good. 
+   [Here is an exemplary test file for a detector which covers all 5 test cases](https://github.com/trufflesecurity/trufflehog/blob/6f9065b0aae981133a7fa3431c17a5c6213be226/pkg/detectors/browserstack/browserstack_test.go).
+
+4. Now run the tests and check to make sure they are passing ✔️!
+```bash
+   go test ./pkg/detectors/<detector> -tags=detectors
+   ```
+
+If the tests are passing, feel free to open a PR! 
+
+
+

 ## Addendum

@@ -99,23 +139,6 @@ For example, consider a hypothetical authentication endpoint that returns `200 O
 * A `403` response would indicate that verification failed **determinately** and no error object should be returned.
 * Any other response would indicate that verification failed **indeterminately** and an error object should be returned.

-### Using a test secret file
-
-1. Create a file called `.env` with this env file format:
-
-   ```bash
-   SECRET_TYPE_ONE=value
-   SECRET_TYPE_ONE_INACTIVE=v@lue
-   ```
-
-2. Export the `TEST_SECRET_FILE` variable, pointing to the env file:
-
-   ```bash
-   export TEST_SECRET_FILE=".env"
-   ```
-
-Now, the detector test should attempt to load the given env key from that file.
-
 ### Adding Protos in Windows

 1. Install Ubuntu App in Microsoft Store https://www.microsoft.com/en-us/p/ubuntu/9nblggh4msv6.
@@ -133,7 +156,3 @@ Now, the detector test should attempt to load the given env key from that file.
   make protos
   ```

-### Testing a detector
-```bash
-   go test ./pkg/detectors/<detector> -tags=detectors
-   ```
@@ -87,6 +87,8 @@ var (
 	githubScanIssueComments = githubScan.Flag("issue-comments", "Include issue comments in scan.").Bool()
 	githubScanPRComments    = githubScan.Flag("pr-comments", "Include pull request comments in scan.").Bool()
 	githubScanGistComments  = githubScan.Flag("gist-comments", "Include gist comments in scan.").Bool()
+	githubScanIssues        = githubScan.Flag("issues", "Include issues and issue comments in scan.").Bool()
+	githubScanPRs           = githubScan.Flag("prs", "Include pull requests and pull request comments in scan.").Bool()

 	gitlabScan = cli.Command("gitlab", "Find credentials in GitLab repositories.")
 	// TODO: Add more GitLab options
@@ -105,11 +107,11 @@ var (
 	filesystemScanIncludePaths = filesystemScan.Flag("include-paths", "Path to file with newline separated regexes for files to include in scan.").Short('i').String()
 	filesystemScanExcludePaths = filesystemScan.Flag("exclude-paths", "Path to file with newline separated regexes for files to exclude in scan.").Short('x').String()

-	s3Scan    = cli.Command("s3", "Find credentials in S3 buckets.")
-	s3ScanKey = s3Scan.Flag("key", "S3 key used to authenticate. Can be provided with environment variable AWS_ACCESS_KEY_ID.").Envar("AWS_ACCESS_KEY_ID").String()
-	s3ScanRoleArns     = s3Scan.Flag("role-arn", "Specify the ARN of an IAM role to assume for scanning. You can repeat this flag.").Strings()
-	s3ScanSecret       = s3Scan.Flag("secret", "S3 secret used to authenticate. Can be provided with environment variable AWS_SECRET_ACCESS_KEY.").Envar("AWS_SECRET_ACCESS_KEY").String()
-	s3ScanSessionToken = s3Scan.Flag("session-token", "S3 session token used to authenticate temporary credentials. Can be provided with environment variable AWS_SESSION_TOKEN.").Envar("AWS_SESSION_TOKEN").String()
+	s3Scan              = cli.Command("s3", "Find credentials in S3 buckets.")
+	s3ScanKey           = s3Scan.Flag("key", "S3 key used to authenticate. Can be provided with environment variable AWS_ACCESS_KEY_ID.").Envar("AWS_ACCESS_KEY_ID").String()
+	s3ScanRoleArns      = s3Scan.Flag("role-arn", "Specify the ARN of an IAM role to assume for scanning. You can repeat this flag.").Strings()
+	s3ScanSecret        = s3Scan.Flag("secret", "S3 secret used to authenticate. Can be provided with environment variable AWS_SECRET_ACCESS_KEY.").Envar("AWS_SECRET_ACCESS_KEY").String()
+	s3ScanSessionToken  = s3Scan.Flag("session-token", "S3 session token used to authenticate temporary credentials. Can be provided with environment variable AWS_SESSION_TOKEN.").Envar("AWS_SESSION_TOKEN").String()
 	s3ScanCloudEnv      = s3Scan.Flag("cloud-environment", "Use IAM credentials in cloud environment.").Bool()
 	s3ScanBuckets       = s3Scan.Flag("bucket", "Name of S3 bucket to scan. You can repeat this flag.").Strings()
 	s3ScanMaxObjectSize = s3Scan.Flag("max-object-size", "Maximum size of objects to scan. Objects larger than this will be skipped. (Byte units eg. 512B, 2KB, 4MB)").Default("250MB").Bytes()
@@ -354,6 +356,10 @@ func run(state overseer.State) {
 		printer = new(output.PlainPrinter)
 	}

+	if !*jsonLegacy && !*jsonOut {
+		fmt.Fprintf(os.Stderr, "🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷\n\n")
+	}
+
 	e, err := engine.Start(ctx,
 		engine.WithConcurrency(uint8(*concurrency)),
 		engine.WithDecoders(decoders.DefaultDecoders()...),
@@ -425,6 +431,8 @@ func run(state overseer.State) {
 			IncludeIssueComments:       *githubScanIssueComments,
 			IncludePullRequestComments: *githubScanPRComments,
 			IncludeGistComments:        *githubScanGistComments,
+			IncludeIssues:              *githubScanIssues,
+			IncludePullRequests:        *githubScanPRs,
 			Filter:                     filter,
 		}
 		if err := e.ScanGitHub(ctx, cfg); err != nil {
@@ -469,7 +477,7 @@ func run(state overseer.State) {
 			Secret:        *s3ScanSecret,
 			SessionToken:  *s3ScanSessionToken,
 			Buckets:       *s3ScanBuckets,
-			Roles:	       *s3ScanRoleArns,
+			Roles:         *s3ScanRoleArns,
 			CloudCred:     *s3ScanCloudEnv,
 			MaxObjectSize: int64(*s3ScanMaxObjectSize),
 		}
@@ -525,10 +533,6 @@ func run(state overseer.State) {
 		}
 	}

-	if !*jsonLegacy && !*jsonOut {
-		fmt.Fprintf(os.Stderr, "🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷\n\n")
-	}
-
 	// Wait for all workers to finish.
 	if err = e.Finish(ctx); err != nil {
 		logFatal(err, "engine failed to finish execution")
@@ -8,12 +8,11 @@ import (
 	"regexp"
 	"strings"

-	"golang.org/x/sync/errgroup"
-
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/custom_detectorspb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
+	"golang.org/x/sync/errgroup"
 )

 // The maximum number of matches from one chunk. This const is used when
@@ -181,12 +180,8 @@ func (c *customRegexWebhook) createResults(ctx context.Context, match map[string
 	}
 }

-func (c *customRegexWebhook) Keywords() [][]byte {
-	keywords := make([][]byte, 0, len(c.GetKeywords()))
-	for _, keyword := range c.GetKeywords() {
-		keywords = append(keywords, []byte(keyword))
-	}
-	return keywords
+func (c *customRegexWebhook) Keywords() []string {
+	return c.GetKeywords()
 }

 // productIndices produces a permutation of indices for each length. Example:
@@ -1,10 +1,10 @@
 package abbysale

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,23 +25,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("abbysale")}
+func (s Scanner) Keywords() []string {
+	return []string{"abbysale"}
 }

 // FromData will find and optionally verify Abbysale secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Abbysale,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -49,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("x-api-key", string(resMatch))
+			req.Header.Add("x-api-key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package abstract

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,27 +26,29 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("abstract")}
+func (s Scanner) Keywords() []string {
+	return []string{"abstract"}
 }

 // FromData will find and optionally verify Abstract secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Abstract,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://exchange-rates.abstractapi.com/v1/live/?api_key=%s&base=USD", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://exchange-rates.abstractapi.com/v1/live/?api_key=%s&base=USD", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -57,6 +59,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,12 @@
 package abuseipdb

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	// "log"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -27,23 +27,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("abuseipdb")}
+func (s Scanner) Keywords() []string {
+	return []string{"abuseipdb"}
 }

 // FromData will find and optionally verify AbuseIPDB secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AbuseIPDB,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -51,12 +53,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Key", string(resMatch))
+			req.Header.Add("Key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				bodyBytes, err := io.ReadAll(res.Body)
 				if err == nil {
-					validResponse := bytes.Contains(bodyBytes, []byte(`ipAddress`))
+					bodyString := string(bodyBytes)
+					validResponse := strings.Contains(bodyString, `ipAddress`)
+					// errCode := strings.Contains(bodyString, `AbuseIPDB APIv2 Server.`)

 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
@@ -66,6 +70,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 							s1.Verified = false
 						}
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -73,7 +78,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				}
 			}
 		}
-
 		results = append(results, s1)
 	}

@@ -1,10 +1,10 @@
 package accuweather

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,27 +25,29 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("accuweather")}
+func (s Scanner) Keywords() []string {
+	return []string{"accuweather"}
 }

 // FromData will find and optionally verify Accuweather secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Accuweather,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://dataservice.accuweather.com/locations/v1/cities/autocomplete?apikey="+string(resMatch)+"&q=----&language=en-us", nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://dataservice.accuweather.com/locations/v1/cities/autocomplete?apikey="+resMatch+"&q=----&language=en-us", nil)
 			if err != nil {
 				continue
 			}
@@ -55,6 +57,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package adafruitio

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,27 +25,29 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aio_")}
+func (s Scanner) Keywords() []string {
+	return []string{"aio_"}
 }

 // FromData will find and optionally verify AdafruitIO secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AdafruitIO,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://io.adafruit.com/api/v2/ladybugtest/feeds/?x-aio-key="+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://io.adafruit.com/api/v2/ladybugtest/feeds/?x-aio-key="+resMatch, nil)
 			if err != nil {
 				continue
 			}
@@ -55,6 +57,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package adobeio

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,31 +26,32 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("adobe")}
+func (s Scanner) Keywords() []string {
+	return []string{"adobe"}
 }

 // FromData will find and optionally verify AdobeIO secrets in a given set of bytes.
-
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AdobeIO,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
@@ -58,14 +59,15 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.Header.Add("x-api-key", string(resMatch))
-				req.Header.Add("x-product", string(resIdMatch))
+				req.Header.Add("x-api-key", resMatch)
+				req.Header.Add("x-product", resIdMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,11 +1,11 @@
 package adzuna

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -27,35 +27,36 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("adzuna")}
+func (s Scanner) Keywords() []string {
+	return []string{"adzuna"}
 }

 // FromData will find and optionally verify Adzuna secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Adzuna,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.adzuna.com/v1/api/jobs/gb/search/1?app_id=%s&app_key=%s", string(resIdMatch), string(resMatch)), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.adzuna.com/v1/api/jobs/gb/search/1?app_id=%s&app_key=%s", resIdMatch, resMatch), nil)
 				if err != nil {
 					continue
 				}
@@ -65,6 +66,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -74,7 +76,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result

 			results = append(results, s1)
 		}
-
 	}

 	return results, nil
@@ -1,10 +1,10 @@
 package aeroworkflow

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,46 +26,49 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aeroworkflow")}
+func (s Scanner) Keywords() []string {
+	return []string{"aeroworkflow"}
 }

 // FromData will find and optionally verify Aeroworkflow secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idmatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idmatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idmatch := range idmatches {
 			if len(idmatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idmatch[1])
+			resIdMatch := strings.TrimSpace(idmatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Aeroworkflow,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
-				req, err := http.NewRequest("GET", "https://api.aeroworkflow.com/api/"+string(resIdMatch)+"/v1/AeroAppointments", nil)
+				req, err := http.NewRequest("GET", "https://api.aeroworkflow.com/api/"+resIdMatch+"/v1/AeroAppointments", nil)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Accept", "application/json")
-				req.Header.Add("apikey", string(resMatch))
+				req.Header.Add("apikey", resMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,10 +1,10 @@
 package agora

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,31 +26,34 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("agora")}
+func (s Scanner) Keywords() []string {
+	return []string{"agora"}
 }

 // FromData will find and optionally verify Agora secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+
+		resMatch := strings.TrimSpace(match[1])

 		for _, secret := range secretMatches {
 			if len(secret) != 2 {
 				continue
 			}
-			resSecret := bytes.TrimSpace(secret[1])
+			resSecret := strings.TrimSpace(secret[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Agora,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resSecret...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resSecret),
 			}

 			if verify {
@@ -58,7 +61,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.SetBasicAuth(string(resSecret), string(resMatch))
+				req.SetBasicAuth(resSecret, resMatch)
 				res, err := client.Do(req)

 				if err == nil {
@@ -1,11 +1,11 @@
 package aha

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,23 +26,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aha")}
+func (s Scanner) Keywords() []string {
+	return []string{"aha"}
 }

 // FromData will find and optionally verify Aha secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Aha,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -51,7 +53,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Accept", "application/vnd.aha+json; version=3")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -1,7 +1,6 @@
 package airbrakeprojectkey

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
@@ -27,36 +26,40 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("airbrake")}
+func (s Scanner) Keywords() []string {
+	return []string{"airbrake"}
 }

 // FromData will find and optionally verify AirbrakeProjectKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
+
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AirbrakeProjectKey,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
 				payload := strings.NewReader(`{"environment":"production","username":"john","email":"john@smith.com","repository":"https://github.com/airbrake/airbrake","revision":"38748467ea579e7ae64f7815452307c9d05e05c5","version":"v2.0"}`)
-				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.airbrake.io/api/v4/projects/"+string(resIdMatch)+"/deploys?key="+string(resMatch), payload)
+
+				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.airbrake.io/api/v4/projects/"+resIdMatch+"/deploys?key="+resMatch, payload)
 				if err != nil {
 					continue
 				}
@@ -71,13 +74,15 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			}

 			if !s1.Verified {
-				if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+				if detectors.IsKnownFalsePositive(string(s1.Raw), detectors.DefaultFalsePositives, true) {
 					continue
 				}
 			}

 			results = append(results, s1)
+
 		}
+
 	}

 	return results, nil
@@ -1,10 +1,10 @@
 package airbrakeuserkey

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,27 +25,29 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("airbrake")}
+func (s Scanner) Keywords() []string {
+	return []string{"airbrake"}
 }

 // FromData will find and optionally verify AirbrakeUserKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AirbrakeUserKey,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.airbrake.io/api/v4/projects?key="+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.airbrake.io/api/v4/projects?key="+resMatch, nil)
 			if err != nil {
 				continue
 			}
@@ -1,11 +1,11 @@
 package airship

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,23 +26,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("airship")}
+func (s Scanner) Keywords() []string {
+	return []string{"airship"}
 }

 // FromData will find and optionally verify Airship secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Airship,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -51,7 +53,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Accept", "application/vnd.urbanairship+json; version=3")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -1,11 +1,11 @@
 package airtableapikey

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,40 +26,42 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("airtable")}
+func (s Scanner) Keywords() []string {
+	return []string{"airtable"}
 }

 // FromData will find and optionally verify AirtableApiKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	appMatches := appPat.FindAllSubmatch(data, -1)
-	keyMatches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	appMatches := appPat.FindAllStringSubmatch(dataStr, -1)
+	keyMatches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, keyMatch := range keyMatches {
 		if len(keyMatch) != 2 {
 			continue
 		}
-		keyRes := bytes.TrimSpace(keyMatch[1])
+		keyRes := strings.TrimSpace(keyMatch[1])

 		for _, appMatch := range appMatches {
 			if len(appMatch) != 2 {
 				continue
 			}
-			appRes := bytes.TrimSpace(appMatch[1])
+			appRes := strings.TrimSpace(appMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AirtableApiKey,
-				Redacted:     string(appRes),
-				Raw:          keyRes,
-				RawV2:        append(keyRes, appRes...),
+				Redacted:     appRes,
+				Raw:          []byte(keyRes),
+				RawV2:        []byte(keyRes + appRes),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", "https://api.airtable.com/v0/"+string(appRes)+"/Projects", nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", "https://api.airtable.com/v0/"+appRes+"/Projects", nil)
 				if err != nil {
 					continue
 				}
-				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(keyRes)))
+				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", keyRes))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
@@ -1,11 +1,11 @@
 package airvisual

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,32 +26,34 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("airvisual")}
+func (s Scanner) Keywords() []string {
+	return []string{"airvisual"}
 }

 // FromData will find and optionally verify AirVisual secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AirVisual,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.airvisual.com/v2/countries?key=%s", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.airvisual.com/v2/countries?key=%s", resMatch), nil)
 			if err != nil {
 				continue
 			}
 			req.Header.Add("Accept", "application/vnd.airvisual+json; version=3")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -1,11 +1,11 @@
 package aiven

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,23 +26,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aiven")}
+func (s Scanner) Keywords() []string {
+	return []string{"aiven"}
 }

 // FromData will find and optionally verify Aiven secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Aiven,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -50,7 +52,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("aivenv1 %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("aivenv1 %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -1,11 +1,11 @@
 package alchemy

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -27,23 +27,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("alchemy")}
+func (s Scanner) Keywords() []string {
+	return []string{"alchemy"}
 }

 // FromData will find and optionally verify Alchemy secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Alchemy,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -51,7 +53,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if client == nil {
 				client = defaultClient
 			}
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://eth-mainnet.g.alchemy.com/v2/"+string(resMatch)+"/getNFTs/?owner=vitalik.eth", nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://eth-mainnet.g.alchemy.com/v2/"+resMatch+"/getNFTs/?owner=vitalik.eth", nil)
 			if err != nil {
 				continue
 			}
@@ -1,12 +1,12 @@
 package alconost

 import (
-	"bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -27,28 +27,30 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("alconost")}
+func (s Scanner) Keywords() []string {
+	return []string{"alconost"}
 }

 // FromData will find and optionally verify Alconost secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Alconost,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			data := append(resMatch, ':')
-			sEnc := b64.StdEncoding.EncodeToString(data)
+			data := fmt.Sprintf("%s:", resMatch)
+			sEnc := b64.StdEncoding.EncodeToString([]byte(data))
 			req, err := http.NewRequestWithContext(ctx, "GET", "https://nitro.alconost.com/api/v1/account", nil)
 			if err != nil {
 				continue
@@ -1,10 +1,10 @@
 package alegra

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,32 +26,34 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("alegra")}
+func (s Scanner) Keywords() []string {
+	return []string{"alegra"}
 }

 // FromData will find and optionally verify Alegra secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		tokenPatMatch := bytes.TrimSpace(match[1])
+		tokenPatMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}

-			userPatMatch := bytes.TrimSpace(idMatch[1])
+			userPatMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Alegra,
-				Raw:          tokenPatMatch,
-				RawV2:        append(tokenPatMatch, userPatMatch...),
+				Raw:          []byte(tokenPatMatch),
+				RawV2:        []byte(tokenPatMatch + userPatMatch),
 			}

 			if verify {
@@ -59,13 +61,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.SetBasicAuth(string(userPatMatch), string(tokenPatMatch))
+				req.SetBasicAuth(userPatMatch, tokenPatMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(tokenPatMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,10 +1,10 @@
 package aletheiaapi

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"
 	"time"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
@@ -14,30 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"aletheiaapi"}) + `\b([A-Z0-9]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aletheiaapi")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"aletheiaapi"}
 }

+// FromData will find and optionally verify AletheiaApi secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AletheiaApi,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -47,13 +54,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Key", string(resMatch))
+			req.Header.Add("Key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package algoliaadminkey

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,54 +13,61 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"algolia"}) + `\b([a-zA-Z0-9]{32})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"algolia"}) + `\b([A-Z0-9]{10})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("algolia")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"algolia"}
 }

+// FromData will find and optionally verify AlgoliaAdminKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AlgoliaAdminKey,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+string(resIdMatch)+"-dsn.algolia.net/1/keys", nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+resIdMatch+"-dsn.algolia.net/1/keys", nil)
 				if err != nil {
 					continue
 				}
-				req.Header.Add("X-Algolia-Application-Id", string(resIdMatch))
-				req.Header.Add("X-Algolia-API-Key", string(resMatch))
+				req.Header.Add("X-Algolia-Application-Id", resIdMatch)
+				req.Header.Add("X-Algolia-API-Key", resMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -71,7 +78,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			results = append(results, s1)
 		}
 	}
-
 	return results, nil
 }

@@ -1,7 +1,6 @@
 package alibaba

 import (
-	"bytes"
 	"context"
 	"crypto/hmac"
 	"crypto/rand"
@@ -21,17 +20,21 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b([a-zA-Z0-9]{30})\b`)
 	idPat  = regexp.MustCompile(`\b(LTAI[a-zA-Z0-9]{17,21})[\"';\s]*`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("LTAI")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"LTAI"}
 }

 func randString(n int) string {
@@ -50,7 +53,6 @@ func GetSignature(input, key string) string {
 	h.Write([]byte(input))
 	return base64.StdEncoding.EncodeToString(h.Sum(nil))
 }
-
 func buildStringToSign(method, input string) string {
 	filter := strings.Replace(input, "+", "%20", -1)
 	filter = strings.Replace(filter, "%7E", "~", -1)
@@ -59,27 +61,29 @@ func buildStringToSign(method, input string) string {
 	return filter
 }

+// FromData will find and optionally verify Alibaba secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}

-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Alibaba,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
@@ -89,7 +93,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				}
 				dateISO := time.Now().UTC().Format("2006-01-02T15:04:05Z07:00")
 				params := req.URL.Query()
-				params.Add("AccessKeyId", string(resIdMatch))
+				params.Add("AccessKeyId", resIdMatch)
 				params.Add("Action", "DescribeRegions")
 				params.Add("Format", "JSON")
 				params.Add("SignatureMethod", "HMAC-SHA1")
@@ -99,7 +103,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				params.Add("Version", "2014-05-26")

 				stringToSign := buildStringToSign(req.Method, params.Encode())
-				signature := GetSignature(stringToSign, string(resMatch)+"&") // Get Signature HMAC SHA1
+				signature := GetSignature(stringToSign, resMatch+"&") // Get Signature HMAC SHA1
 				params.Add("Signature", signature)
 				req.URL.RawQuery = params.Encode()

@@ -118,6 +122,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					}
 				}
 			}
+
 			results = append(results, s1)
 		}
 	}
@@ -1,10 +1,10 @@
 package alienvault

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,23 +25,25 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("alienvault")}
+func (s Scanner) Keywords() []string {
+	return []string{"alienvault"}
 }

 // FromData will find and optionally verify AlienVault secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AlienVault,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -49,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("X-OTX-API-KEY", string(resMatch))
+			req.Header.Add("X-OTX-API-KEY", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,12 @@
 package allsports

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
+	// "log"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,33 +15,41 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"allsports"}) + `\b([0-9a-zA-Z]{64})\b`)
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"allsports"}) + `\b([0-9a-z]{64})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("allsports")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"allsports"}
 }

+// FromData will find and optionally verify Allsports secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Allsports,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://apiv2.allsportsapi.com/football/?met=Countries&APIkey="+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://apiv2.allsportsapi.com/football/?met=Countries&APIkey="+resMatch, nil)
 			if err != nil {
 				continue
 			}
@@ -51,7 +60,9 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				if bytes.Contains(bodyBytes, []byte("success")) {
+				body := string(bodyBytes)
+
+				if strings.Contains(body, "success") {
 					s1.Verified = true
 				} else {
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
@@ -60,8 +71,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				}
 			}
 		}
+
 		results = append(results, s1)
 	}
+
 	return results, nil
 }

@@ -1,11 +1,11 @@
 package amadeus

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,42 +14,49 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
-	client    = common.SaneHttpClient()
+	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"amadeus"}) + `\b([0-9A-Za-z]{32})\b`)
 	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"amadeus"}) + `\b([0-9A-Za-z]{16})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("amadeus")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"amadeus"}
 }

+// FromData will find and optionally verify Amadeus secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, secretMatch := range secretMatches {
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecret := bytes.TrimSpace(secretMatch[1])
+			resSecret := strings.TrimSpace(secretMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Amadeus,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resSecret...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resSecret),
 			}

 			if verify {
-				payload := bytes.NewReader(append(append([]byte("grant_type=client_credentials&client_id="), resMatch...), append([]byte("&client_secret="), resSecret...)...))
+				payload := strings.NewReader("grant_type=client_credentials&client_id=" + resMatch + "&client_secret=" + resSecret)

 				req, err := http.NewRequestWithContext(ctx, "POST", "https://test.api.amadeus.com/v1/security/oauth2/token", payload)
 				if err != nil {
@@ -63,9 +70,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if err != nil {
 						continue
 					}
-					if res.StatusCode >= 200 && res.StatusCode < 300 && bytes.Contains(bodyBytes, []byte("access_token")) {
+					body := string(bodyBytes)
+					if (res.StatusCode >= 200 && res.StatusCode < 300) && strings.Contains(body, "access_token") {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,10 +1,10 @@
 package ambee

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,27 +13,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ambee"}) + `\b([0-9a-f]{64})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("ambee")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"ambee"}
 }

+// FromData will find and optionally verify Ambee secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
+
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Ambee,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -41,22 +51,25 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("x-api-key", string(resMatch))
+			req.Header.Add("x-api-key", resMatch)
 			res, err := client.Do(req)
-
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
-				} else if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-					continue
+				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+						continue
+					}
 				}
 			}
 		}
+
 		results = append(results, s1)
 	}
+
 	return results, nil
 }

@@ -1,10 +1,10 @@
 package amplitudeapikey

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,40 +13,46 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"amplitude"}) + `\b([0-9a-f]{32})\b`)
 	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"amplitude"}) + `\b([0-9a-f]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("amplitude")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"amplitude"}
 }

+// FromData will find and optionally verify AmplitudeApiKey secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, secretMatch := range secretMatches {
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecretMatch := bytes.TrimSpace(secretMatch[1])
+			resSecretMatch := strings.TrimSpace(secretMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AmplitudeApiKey,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resSecretMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resSecretMatch),
 			}

 			if verify {
@@ -54,13 +60,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.SetBasicAuth(string(resMatch), string(resSecretMatch))
+				req.SetBasicAuth(resMatch, resSecretMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,11 +1,11 @@
 package anypoint

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,53 +14,61 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b`)
 	orgPat = regexp.MustCompile(detectors.PrefixRegex([]string{"org"}) + `\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("anypoint")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"anypoint"}
 }

+// FromData will find and optionally verify Anypoint secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	orgMatches := orgPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	orgMatches := orgPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, orgMatch := range orgMatches {
 			if len(orgMatch) != 2 {
 				continue
 			}
-			orgRes := bytes.TrimSpace(orgMatch[1])
+			orgRes := strings.TrimSpace(orgMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Anypoint,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, orgRes...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + orgRes),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://anypoint.mulesoft.com/apiplatform/repository/v2/organizations/%s/apis/by-name?apiName=%s", string(orgRes), ""), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://anypoint.mulesoft.com/apiplatform/repository/v2/organizations/%s/apis/by-name?apiName=%s", orgRes, ""), nil)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Content-Type", "application/json")
-				req.Header.Add("Authorization", "Bearer "+string(resMatch))
+				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,11 +1,11 @@
 package apacta

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,34 +14,41 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apacta"}) + `\b([a-z0-9-]{36})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apacta")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apacta"}
 }

+// FromData will find and optionally verify Apacta secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Apacta,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://app.apacta.com/api/v1/time_entries?api_key=%s", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://app.apacta.com/api/v1/time_entries?api_key=%s", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -51,6 +58,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,13 @@
 package api2cart

 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,33 +16,40 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"api2cart"}) + `\b([0-9a-f]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("api2cart")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"api2cart"}
 }

+// FromData will find and optionally verify Api2Cart secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Api2Cart,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.api2cart.com/v1.1/account.cart.list.json?api_key=%s", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.api2cart.com/v1.1/account.cart.list.json?api_key=%s", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -49,15 +57,22 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
+				body, errBody := io.ReadAll(res.Body)

 				var result Response
-				err := json.NewDecoder(res.Body).Decode(&result)
-				if err == nil && res.StatusCode >= 200 && res.StatusCode < 300 && result.ReturnCode == 0 {
-					s1.Verified = true
-				} else {
-					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+				if errBody == nil {
+					if err := json.Unmarshal(body, &result); err != nil {
 						continue
 					}
+
+					if res.StatusCode >= 200 && res.StatusCode < 300 && result.ReturnCode == 0 {
+						s1.Verified = true
+					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+							continue
+						}
+					}
 				}
 			}
 		}
@@ -1,11 +1,11 @@
 package apideck

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,40 +14,46 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b(sk_live_[a-z0-9A-Z-]{93})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"apideck"}) + `\b([a-z0-9A-Z]{40})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apideck")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apideck"}
 }

+// FromData will find and optionally verify ApiDeck secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idmatch := range idMatches {
 			if len(idmatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idmatch[1])
+			resIdMatch := strings.TrimSpace(idmatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_ApiDeck,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
@@ -55,15 +61,16 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.Header.Add("x-apideck-app-id", string(resIdMatch))
-				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+				req.Header.Add("x-apideck-app-id", resIdMatch)
+				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						if detectors.IsKnownFalsePositive([]byte(resMatch), detectors.DefaultFalsePositives, true) {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
@@ -1,11 +1,11 @@
 package apiflash

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,43 +14,49 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apiflash"}) + `\b([a-z0-9]{32})\b`)
 	urlPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apiflash"}) + `\b([a-zA-Z0-9\S]{21,30})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apiflash")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apiflash"}
 }

+// FromData will find and optionally verify Apiflash secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	urlMatches := urlPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	urlMatches := urlPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, urlMatch := range urlMatches {
 			if len(urlMatch) != 2 {
 				continue
 			}

-			resUrlMatch := bytes.TrimSpace(urlMatch[1])
+			resUrlMatch := strings.TrimSpace(urlMatch[1])
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Apiflash,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resUrlMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resUrlMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.apiflash.com/v1/urltoimage?url=%s&access_key=%s", string(resUrlMatch), string(resMatch)), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.apiflash.com/v1/urltoimage?url=%s&access_key=%s", resUrlMatch, resMatch), nil)
 				if err != nil {
 					continue
 				}
@@ -60,6 +66,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,36 +15,52 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apifonica"}) + `\b([0-9a-z]{11}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apifonica")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apifonica"}
 }

+// FromData will find and optionally verify Apifonica secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	tokenMatches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := match[1]
+		resMatch := strings.TrimSpace(match[1])
+		for _, tokenMatch := range tokenMatches {
+			if len(tokenMatch) != 2 {
+				continue
+			}
+			resToken := strings.TrimSpace(tokenMatch[1])

-		s1 := detectors.Result{
-			DetectorType: detectorspb.DetectorType_ApiFonica,
-			Raw:          resMatch,
-		}
+			s1 := detectors.Result{
+				DetectorType: detectorspb.DetectorType_ApiFonica,
+				Raw:          []byte(resMatch),
+			}

-		if verify {
-			data := append(resMatch, []byte(":")...)
-			sEnc := b64.StdEncoding.EncodeToString(data)
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apifonica.com/v2/accounts", nil)
-			if err == nil {
+			if verify {
+				data := fmt.Sprintf("%s:%s", resMatch, resToken)
+				sEnc := b64.StdEncoding.EncodeToString([]byte(data))
+				req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apifonica.com/v2/accounts", nil)
+				if err != nil {
+					continue
+				}
 				req.Header.Add("Content-Type", "application/json")
 				req.Header.Add("Authorization", fmt.Sprintf("Basic %s", sEnc))
 				res, err := client.Do(req)
@@ -51,14 +68,17 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
-					} else if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-						continue
+					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+							continue
+						}
 					}
 				}
 			}
-		}

-		results = append(results, s1)
+			results = append(results, s1)
+		}
 	}

 	return results, nil
@@ -1,10 +1,10 @@
 package apify

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,34 +13,41 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b(apify\_api\_[a-zA-Z-0-9]{36})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apify")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apify"}
 }

+// FromData will find and optionally verify Apify secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Apify,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apify.com/v2/acts?token="+string(resMatch)+"&my=true&offset=10&limit=99&desc=true", nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apify.com/v2/acts?token="+resMatch+"&my=true&offset=10&limit=99&desc=true", nil)
 			if err != nil {
 				continue
 			}
@@ -50,6 +57,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package apilayer

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,42 +13,52 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apilayer"}) + `\b([a-zA-Z0-9]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apilayer")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apilayer"}
 }

+// FromData will find and optionally verify Apilayer secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Apilayer,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apilayer.com/number_verification/countries?access_key="+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apilayer.com/number_verification/countries", nil)
 			if err != nil {
 				continue
 			}
+			req.Header.Add("apikey", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,11 @@
 package apimatic

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"
+	"time"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,50 +14,56 @@ import (

 type Scanner struct{}

-// Ensures Scanner satisfies the interface at compile time.
+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

-	// Ensure your group is surrounded in boundary characters to reduce false positives.
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"apimatic"}) + `\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b`)
 	passPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apimatic"}) + `\b([a-z0-9-\S]{8,32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apimatic")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apimatic"}
 }

+// FromData will find and optionally verify APIMatic secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	passMatches := passPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	passMatches := passPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		userPatMatch := bytes.TrimSpace(match[1])
+		userPatMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range passMatches {
 			if len(idMatch) != 2 {
 				continue
 			}

-			passPatMatch := bytes.TrimSpace(idMatch[1])
+			passPatMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_APIMatic,
-				Raw:          userPatMatch,
-				RawV2:        append(userPatMatch, passPatMatch...),
+				Raw:          []byte(userPatMatch),
+				RawV2:        []byte(userPatMatch + passPatMatch),
 			}
-
 			if verify {
+				timeout := 10 * time.Second
+				client.Timeout = timeout
 				req, err := http.NewRequestWithContext(ctx, "GET", "https://www.apimatic.io/api/code-generations", nil)
 				if err != nil {
 					continue
 				}
-				req.SetBasicAuth(string(userPatMatch), string(passPatMatch))
+				req.SetBasicAuth(userPatMatch, passPatMatch)
 				res, err := client.Do(req)

 				if err == nil {
@@ -64,12 +71,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(passPatMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
 				}
 			}
+
 			results = append(results, s1)
 		}
 	}
@@ -1,11 +1,11 @@
 package apiscience

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,30 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apiscience"}) + `\b([a-bA-Z0-9\S]{22})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apiscience")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apiscience"}
 }

+// FromData will find and optionally verify ApiScience secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ApiScience,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,10 @@
 package apitemplate

 import (
-	"bytes"
 	"context"
-	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,38 +25,41 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apitemplate")}
+func (s Scanner) Keywords() []string {
+	return []string{"apitemplate"}
 }

 // FromData will find and optionally verify APITemplate secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_APITemplate,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.apitemplate.io/v1/list-templates?api_key=%s", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.apitemplate.io/v1/list-templates", nil)
 			if err != nil {
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("X-API-KEY", string(resMatch))
+			req.Header.Add("X-API-KEY", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package apollo

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,29 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apollo"}) + `\b([a-zA-Z0-9]{22})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apollo")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apollo"}
 }

+// FromData will find and optionally verify Apollo secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Apollo,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -44,13 +52,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Content-Type", "application/json")
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package appcues

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,59 +20,64 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"appcues"}) + `\b([a-z0-9-]{36})\b`)
 	userPat = regexp.MustCompile(detectors.PrefixRegex([]string{"appcues"}) + `\b([a-z0-9-]{39})\b`)
 	idPat   = regexp.MustCompile(detectors.PrefixRegex([]string{"appcues"}) + `\b([0-9]{5})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("appcues")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"appcues"}
 }

+// FromData will find and optionally verify Appcues secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	keyMatches := keyPat.FindAllSubmatch(data, -1)
-	userMatches := userPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	userMatches := userPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

-	for _, match := range keyMatches {
+	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, userMatch := range userMatches {
 			if len(userMatch) != 2 {
 				continue
 			}

-			resUserMatch := bytes.TrimSpace(userMatch[1])
+			resUserMatch := strings.TrimSpace(userMatch[1])

 			for _, idMatch := range idMatches {
 				if len(idMatch) != 2 {
 					continue
 				}

-				resIdMatch := bytes.TrimSpace(idMatch[1])
+				resIdMatch := strings.TrimSpace(idMatch[1])

 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_Appcues,
-					Raw:          resMatch,
-					RawV2:        append(resMatch, resUserMatch...),
+					Raw:          []byte(resMatch),
+					RawV2:        []byte(resMatch + resUserMatch),
 				}
-
 				if verify {
-					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.appcues.com/v2/accounts/%s/flows", string(resIdMatch)), nil)
+					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.appcues.com/v2/accounts/%s/flows", resIdMatch), nil)
 					if err != nil {
 						continue
 					}
-					req.SetBasicAuth(string(resUserMatch), string(resMatch))
+					req.SetBasicAuth(resUserMatch, resMatch)
 					res, err := client.Do(req)
 					if err == nil {
 						defer res.Body.Close()
 						if res.StatusCode >= 200 && res.StatusCode < 300 {
 							s1.Verified = true
 						} else {
+							// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 							if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 								continue
 							}
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,35 +15,42 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"appfollow"}) + `\b([0-9A-Za-z]{20})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("appfollow")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"appfollow"}
 }

+// FromData will find and optionally verify Appfollow secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-
-		resMatch := match[1]
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Appfollow,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			data := append(resMatch, ':')
-			sEnc := b64.StdEncoding.EncodeToString(data)
+			data := fmt.Sprintf("%s:", resMatch)
+			sEnc := b64.StdEncoding.EncodeToString([]byte(data))
 			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.appfollow.io/test", nil)
 			if err != nil {
 				continue
@@ -54,6 +62,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package appointedd

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,53 +14,66 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"appointedd"}) + `\b([a-zA-Z0-9=+]{88})`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("appointedd")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"appointedd"}
 }

+// FromData will find and optionally verify appointedd secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Appointedd,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}
 		if verify {
 			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.appointedd.com/v1/availability/slots", nil)
 			if err != nil {
 				continue
 			}
-			req.Header.Add("X-API-KEY", string(resMatch))
+			req.Header.Add("X-API-KEY", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
+				bodyBytes, err := io.ReadAll(res.Body)
+				if err != nil {
+					continue
+				}
+				body := string(bodyBytes)

-				if bodyBytes, err := io.ReadAll(res.Body); err == nil {
-					if bytes.Contains(bodyBytes, []byte("total")) {
-						s1.Verified = true
-					} else {
-						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-							continue
-						}
+				if strings.Contains(body, "total") {
+					s1.Verified = true
+				} else {
+					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+						continue
 					}
 				}
 			}
 		}
+
 		results = append(results, s1)
 	}
+
 	return results, nil
 }

@@ -1,11 +1,11 @@
 package appsynergy

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,34 +14,42 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"appsynergy"}) + `\b([a-z0-9]{64})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("appsynergy")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"appsynergy"}
 }

+// FromData will find and optionally verify AppSynergy secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AppSynergy,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			payload := bytes.NewBuffer([]byte(`{"html":"<html><body><h1>Hello World</h1></body></html>","filename":"HelloWorld.pdf"}`))
-			req, err := http.NewRequestWithContext(ctx, "POST", fmt.Sprintf("https://www.appsynergy.com/api?action=HTML2PDF&apiKey=%s", string(resMatch)), payload)
+			payload := strings.NewReader(`{"html":"<html><body><h1>Hello World</h1></body></html>","filename":"HelloWorld.pdf"}`)
+			req, err := http.NewRequestWithContext(ctx, "POST", fmt.Sprintf("https://www.appsynergy.com/api?action=HTML2PDF&apiKey=%s", resMatch), payload)
 			if err != nil {
 				continue
 			}
@@ -51,6 +59,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,13 +1,12 @@
 package apptivo

 import (
-	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 	"regexp"
-
-	"io/ioutil"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -16,52 +15,60 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"apptivo"}) + `\b([a-z0-9-]{36})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"apptivo"}) + `\b([a-zA-Z0-9-]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("apptivo")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"apptivo"}
 }

+// FromData will find and optionally verify Apptivo secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Apptivo,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.apptivo.com/app/dao/v6/leads?a=getConfigData&apiKey=%s&accessKey=%s", string(resMatch), string(resIdMatch)), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.apptivo.com/app/dao/v6/leads?a=getConfigData&apiKey=%s&accessKey=%s", resMatch, resIdMatch), nil)
 				if err != nil {
 					continue
 				}
 				res, err := client.Do(req)
 				if err == nil {
-					bodyBytes, err := ioutil.ReadAll(res.Body)
+					bodyBytes, err := io.ReadAll(res.Body)
 					if err != nil {
 						continue
 					}
-					validResponse := bytes.Contains(bodyBytes, []byte(`displayName`))
+					bodyString := string(bodyBytes)
+					validResponse := strings.Contains(bodyString, `displayName`)
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						if validResponse {
@@ -70,6 +77,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 							s1.Verified = false
 						}
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,10 +1,10 @@
 package artifactory

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,54 +19,58 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

-	// Keep the regexp patterns unchanged
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b([a-zA-Z0-9]{73})`)
 	URLPat = regexp.MustCompile(`\b([A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])\.jfrog\.io)`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("artifactory")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"artifactory"}
 }

 // FromData will find and optionally verify Artifactory secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	URLmatches := URLPat.FindAllSubmatch(data, -1)
-	matches := keyPat.FindAllSubmatch(data, -1)
-
-	var resURLMatch []byte
+	dataStr := string(data)
+	URLmatches := URLPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

+	resURLMatch := ""
 	for _, URLmatch := range URLmatches {
 		if len(URLmatch) != 2 {
 			continue
 		}
-		resURLMatch = bytes.TrimSpace(URLmatch[1])
+		resURLMatch = strings.TrimSpace(URLmatch[1])
+
 	}

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ArtifactoryAccessToken,
-			Raw:          resMatch,
-			RawV2:        append(resMatch, resURLMatch...),
+			Raw:          []byte(resMatch),
+			RawV2:        []byte(resMatch + resURLMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://"+string(resURLMatch)+"/artifactory/api/storageinfo", nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://"+resURLMatch+"/artifactory/api/storageinfo", nil)
 			if err != nil {
 				continue
 			}
-			req.Header.Add("X-JFrog-Art-Api", string(resMatch))
+
+			req.Header.Add("X-JFrog-Art-Api", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package artsy

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,44 +13,51 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"artsy"}) + `\b([0-9a-zA-Z]{32})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"artsy"}) + `\b([0-9a-zA-Z]{20})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("artsy")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"artsy"}
 }

+// FromData will find and optionally verify Artsy secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idmatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idmatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}

-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idmatch := range idmatches {
 			if len(idmatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idmatch[1])
+			resIdMatch := strings.TrimSpace(idmatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Artsy,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resIdMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.artsy.net/api/tokens/xapp_token?client_id="+string(resIdMatch)+"&client_secret="+string(resMatch), nil)
+				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.artsy.net/api/tokens/xapp_token?client_id="+resIdMatch+"&client_secret="+resMatch, nil)
 				if err != nil {
 					continue
 				}
@@ -60,7 +67,8 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						if detectors.IsKnownFalsePositive(bytes.Join([][]byte{resMatch, resIdMatch}, nil), detectors.DefaultFalsePositives, true) {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
@@ -69,6 +77,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result

 			results = append(results, s1)
 		}
+
 	}

 	return results, nil
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,25 +20,31 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"asana"}) + `\b([a-z\/:0-9]{51})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("asana")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"asana"}
 }

+// FromData will find and optionally verify AsanaOauth secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := match[1]
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AsanaOauth,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
-			if err == nil && res.Body != nil {
+			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package asanapersonalaccesstoken

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,6 +14,7 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
@@ -22,22 +23,27 @@ var (
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"asana"}) + `\b([0-9]{1,}\/[0-9]{16,}:[A-Za-z0-9]{32,})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("asana")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"asana"}
 }

+// FromData will find and optionally verify AsanaPersonalAccessToken secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AsanaPersonalAccessToken,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package assemblyai

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,28 +19,31 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

-	// Keep the regexp patterns unchanged
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"assemblyai"}) + `\b([0-9a-z]{32})\b`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("assemblyai")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"assemblyai"}
 }

 // FromData will find and optionally verify Assemblyai secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AssemblyAI,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -49,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("Authorization", string(resMatch))
+			req.Header.Add("Authorization", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package atera

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -18,27 +18,32 @@ var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"atera"}) + `\b([0-9a-z]{32})\b`)
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"atera"}) + `\b([[0-9a-z]{32})\b`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("atera")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"atera"}
 }

 // FromData will find and optionally verify Atera secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Atera,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -47,14 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Accept", "application/json")
-			req.Header.Add("X-API-KEY", string(resMatch))
+			req.Header.Add("X-API-KEY", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// Consider adding the []byte conversion here if the input also changed to a []byte.
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,12 @@
 package audd

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,26 +26,30 @@ var (
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("audd")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"audd"}
 }

+// FromData will find and optionally verify Audd secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Audd,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.audd.io/setCallbackUrl/?api_token=%s&url=https://yourwebsite.com/callbacks_handler/", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.audd.io/setCallbackUrl/?api_token=%s&url=https://yourwebsite.com/callbacks_handler/", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -53,8 +57,9 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err == nil {
 				bodyBytes, err := io.ReadAll(res.Body)
 				if err == nil {
+					bodyString := string(bodyBytes)
+					validResponse := strings.Contains(bodyString, `"status":"success"`)
 					defer res.Body.Close()
-					validResponse := bytes.Contains(bodyBytes, []byte(`"status":"success"`))
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						if validResponse {
 							s1.Verified = true
@@ -62,6 +67,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 							s1.Verified = false
 						}
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,28 +14,36 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// long jwt token but note this is default 8640000 seconds = 24 hours but could be set to maximum 2592000 seconds = 720 hours = 30 days
+	// at https://manage.auth0.com/dashboard/us/dev-63memjo3/apis/management/explorer
 	managementApiTokenPat = regexp.MustCompile(detectors.PrefixRegex([]string{"auth0"}) + `\b(ey[a-zA-Z0-9._-]+)\b`)
-	domainPat             = regexp.MustCompile(`([a-zA-Z0-9\-]{2,16}\.[a-zA-Z0-9_-]{2,3}\.auth0\.com)`)
+	domainPat             = regexp.MustCompile(`([a-zA-Z0-9\-]{2,16}\.[a-zA-Z0-9_-]{2,3}\.auth0\.com)`) // could be part of url
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("auth0")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"auth0"}
 }

+// FromData will find and optionally verify Auth0ManagementApiToken secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	managementApiTokenMatches := managementApiTokenPat.FindAllSubmatch(data, -1)
-	domainMatches := domainPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	managementApiTokenMatches := managementApiTokenPat.FindAllStringSubmatch(dataStr, -1)
+	domainMatches := domainPat.FindAllStringSubmatch(dataStr, -1)

 	for _, managementApiTokenMatch := range managementApiTokenMatches {
 		if len(managementApiTokenMatch) != 2 {
 			continue
 		}
-		managementApiTokenRes := managementApiTokenMatch[1]
+		managementApiTokenRes := strings.TrimSpace(managementApiTokenMatch[1])
 		if len(managementApiTokenRes) < 2000 || len(managementApiTokenRes) > 5000 {
 			continue
 		}
@@ -43,22 +52,25 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if len(domainMatch) != 2 {
 				continue
 			}
-
-			domainRes := domainMatch[1]
+			domainRes := strings.TrimSpace(domainMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Auth0ManagementApiToken,
-				Redacted:     string(domainRes),
-				Raw:          managementApiTokenRes,
-				RawV2:        append(managementApiTokenRes, domainRes...),
+				Redacted:     domainRes,
+				Raw:          []byte(managementApiTokenRes),
+				RawV2:        []byte(managementApiTokenRes + domainRes),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+string(domainRes)+"/api/v2/users", nil)
+				/*
+				   curl -H "Authorization: Bearer $token" https://domain/api/v2/users
+				*/
+
+				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+domainRes+"/api/v2/users", nil)
 				if err != nil {
 					continue
 				}
-				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(managementApiTokenRes)))
+				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", managementApiTokenRes))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
@@ -1,7 +1,6 @@
 package auth0oauth

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
@@ -16,6 +15,7 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
@@ -23,54 +23,64 @@ var (

 	clientIdPat     = regexp.MustCompile(detectors.PrefixRegex([]string{"auth0"}) + `\b([a-zA-Z0-9_-]{32,60})\b`)
 	clientSecretPat = regexp.MustCompile(`\b([a-zA-Z0-9_-]{64,})\b`)
-	domainPat       = regexp.MustCompile(`\b([a-zA-Z0-9][a-zA-Z0-9._-]*auth0\.com)\b`)
+	domainPat       = regexp.MustCompile(`\b([a-zA-Z0-9][a-zA-Z0-9._-]*auth0\.com)\b`) // could be part of url
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("auth0")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"auth0"}
 }

+// FromData will find and optionally verify Auth0oauth secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	clientIdMatches := clientIdPat.FindAllSubmatch(data, -1)
-	clientSecretMatches := clientSecretPat.FindAllSubmatch(data, -1)
-	domainMatches := domainPat.FindAllSubmatch(data, -1)
+	clientIdMatches := clientIdPat.FindAllStringSubmatch(dataStr, -1)
+	clientSecretMatches := clientSecretPat.FindAllStringSubmatch(dataStr, -1)
+	domainMatches := domainPat.FindAllStringSubmatch(dataStr, -1)

 	for _, clientIdMatch := range clientIdMatches {
 		if len(clientIdMatch) != 2 {
 			continue
 		}
-		clientIdRes := bytes.TrimSpace(clientIdMatch[1])
+		clientIdRes := strings.TrimSpace(clientIdMatch[1])

 		for _, clientSecretMatch := range clientSecretMatches {
 			if len(clientSecretMatch) != 2 {
 				continue
 			}
-			clientSecretRes := bytes.TrimSpace(clientSecretMatch[1])
+			clientSecretRes := strings.TrimSpace(clientSecretMatch[1])

 			for _, domainMatch := range domainMatches {
 				if len(domainMatch) != 2 {
 					continue
 				}
-				domainRes := bytes.TrimSpace(domainMatch[1])
+				domainRes := strings.TrimSpace(domainMatch[1])

 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_Auth0oauth,
-					Redacted:     string(clientIdRes),
-					Raw:          clientSecretRes,
-					RawV2:        append(clientIdRes, clientSecretRes...),
+					Redacted:     clientIdRes,
+					Raw:          []byte(clientSecretRes),
+					RawV2:        []byte(clientIdRes + clientSecretRes),
 				}

 				if verify {
+					/*
+					   curl --request POST \
+					     --url 'https://YOUR_DOMAIN/oauth/token' \
+					     --header 'content-type: application/x-www-form-urlencoded' \
+					     --data 'grant_type=authorization_code&client_id=W44JmL3qD6LxHeEJyKe9lMuhcwvPOaOq&client_secret=YOUR_CLIENT_SECRET&code=AUTHORIZATION_CODE&redirect_uri=undefined'
+					*/

 					data := url.Values{}
 					data.Set("grant_type", "authorization_code")
-					data.Set("client_id", string(clientIdRes))
-					data.Set("client_secret", string(clientSecretRes))
+					data.Set("client_id", clientIdRes)
+					data.Set("client_secret", clientSecretRes)
 					data.Set("code", "AUTHORIZATION_CODE")
 					data.Set("redirect_uri", "undefined")

-					req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://"+string(domainRes)+"/oauth/token", strings.NewReader(data.Encode()))
+					req, err := http.NewRequestWithContext(ctx, http.MethodPost, "https://"+domainRes+"/oauth/token", strings.NewReader(data.Encode())) // URL-encoded payload
 					if err != nil {
 						continue
 					}
@@ -84,7 +94,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						}
 						body := string(bodyBytes)

-						if !bytes.Contains(bodyBytes, []byte("access_denied")) {
+						// if client_id and client_secret is valid -> 403 {"error":"invalid_grant","error_description":"Invalid authorization code"}
+						// if invalid -> 401 {"error":"access_denied","error_description":"Unauthorized"}
+						// ingenious!
+
+						if !strings.Contains(body, "access_denied") {
 							s1.Verified = true
 						} else {
 							if detectors.IsKnownFalsePositive(clientIdRes, detectors.DefaultFalsePositives, true) {
@@ -1,11 +1,11 @@
 package autodesk

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,41 +14,49 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
-	client    = common.SaneHttpClient()
+	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"autodesk"}) + `\b([0-9A-Za-z]{32})\b`)
 	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"autodesk"}) + `\b([0-9A-Za-z]{16})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("autodesk")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"autodesk"}
 }

+// FromData will find and optionally verify Autodesk secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
 		for _, secretMatch := range secretMatches {
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecret := bytes.TrimSpace(secretMatch[1])
+			resSecret := strings.TrimSpace(secretMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Autodesk,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resSecret...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resSecret),
 			}

 			if verify {
-				payload := bytes.NewReader([]byte(fmt.Sprintf(`grant_type=client_credentials&client_id=%s&client_secret=%s`, string(resMatch), string(resSecret))))
+				payload := strings.NewReader(fmt.Sprintf(`grant_type=client_credentials&client_id=%s&client_secret=%s`, resMatch, resSecret))
 				req, err := http.NewRequestWithContext(ctx, "POST", "https://developer.api.autodesk.com/authentication/v1/authenticate", payload)
 				if err != nil {
 					continue
@@ -60,6 +68,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,13 +1,13 @@
 package autoklose

 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"fmt"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -16,34 +16,41 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"autoklose"}) + `\b([a-zA-Z0-9-]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("autoklose")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"autoklose"}
 }

+// FromData will find and optionally verify Autoklose secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Autoklose,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.autoklose.com/api/campaigns/?api_token=%s", string(resMatch)), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.autoklose.com/api/campaigns/?api_token=%s", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -61,6 +68,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						s1.Verified = false
 					}
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package autopilot

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,30 +13,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"autopilot"}) + `\b([0-9a-f]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("autopilot")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"autopilot"}
 }

+// FromData will find and optionally verify AutoPilot secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AutoPilot,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -44,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("autopilotapikey", string(resMatch))
+			req.Header.Add("autopilotapikey", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package avazapersonalaccesstoken

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,43 +14,53 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	// The number prefix increments for every Personal Access Token created.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"avaza"}) + `\b([0-9]+-[0-9a-f]{40})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("avaza")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"avaza"}
 }

+// FromData will find and optionally verify AvazaPersonalAccessToken secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AvazaPersonalAccessToken,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.avaza.com/api/Account", nil)
+			req, err := http.NewRequest("GET", "https://api.avaza.com/api/Account", nil)
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,12 @@
 package aviationstack

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"
+	"time"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,31 +21,37 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"aviationstack"}) + `\b([a-z0-9]{32})\b`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aviationstack")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"aviationstack"}
 }

 // FromData will find and optionally verify AviationStack secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_AviationStack,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.aviationstack.com/v1/flights?access_key=%s", string(resMatch)), nil)
+			timeout := 10 * time.Second
+			client.Timeout = timeout
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.aviationstack.com/v1/flights?access_key=%s", resMatch), nil)
 			if err != nil {
 				continue
 			}
@@ -54,6 +61,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,7 +1,6 @@
 package aws

 import (
-	"bytes"
 	"context"
 	"crypto/hmac"
 	"crypto/sha256"
@@ -20,8 +19,7 @@ import (

 type scanner struct {
 	verificationClient *http.Client
-
-	skipIDs map[string]struct{}
+	skipIDs            map[string]struct{}
 }

 func New(opts ...func(*scanner)) *scanner {
@@ -63,13 +61,14 @@ var (
 	falsePositiveSecretCheck = regexp.MustCompile(`[a-f0-9]{40}`)
 )

-// Returning the keywords as byte arrays
-func (s scanner) Keywords() [][]byte {
-	return [][]byte{
-		[]byte("AKIA"),
-		[]byte("ABIA"),
-		[]byte("ACCA"),
-		[]byte("ASIA"),
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s scanner) Keywords() []string {
+	return []string{
+		"AKIA",
+		"ABIA",
+		"ACCA",
+		"ASIA",
 	}
 }

@@ -88,17 +87,19 @@ func GetHMAC(key []byte, data []byte) []byte {

 // FromData will find and optionally verify AWS secrets in a given set of bytes.
 func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	idMatches := idPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, idMatch := range idMatches {
 		if len(idMatch) != 2 {
 			continue
 		}
-		resIDMatch := bytes.TrimSpace(idMatch[1])
+		resIDMatch := strings.TrimSpace(idMatch[1])

 		if s.skipIDs != nil {
-			if _, ok := s.skipIDs[string(resIDMatch)]; ok {
+			if _, ok := s.skipIDs[resIDMatch]; ok {
 				continue
 			}
 		}
@@ -107,128 +108,31 @@ func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecretMatch := bytes.TrimSpace(secretMatch[1])
+			resSecretMatch := strings.TrimSpace(secretMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_AWS,
-				Raw:          resIDMatch,
-				Redacted:     string(resIDMatch),
-				RawV2:        append(append([]byte(nil), resIDMatch...), resSecretMatch...),
+				Raw:          []byte(resIDMatch),
+				Redacted:     resIDMatch,
+				RawV2:        []byte(resIDMatch + resSecretMatch),
 			}

 			if verify {
-				// REQUEST VALUES.
-				method := "GET"
-				service := "sts"
-				host := "sts.amazonaws.com"
-				region := "us-east-1"
-				endpoint := "https://sts.amazonaws.com"
-				now := time.Now().UTC()
-				datestamp := now.Format("20060102")
-				amzDate := now.Format("20060102T150405Z0700")
-
-				req, err := http.NewRequestWithContext(ctx, method, endpoint, nil)
-				if err != nil {
-					continue
-				}
-				req.Header.Set("Accept", "application/json")
-
-				// TASK 1: CREATE A CANONICAL REQUEST.
-				// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
-				canonicalURI := "/"
-				canonicalHeaders := "host:" + host + "\n"
-				signedHeaders := "host"
-				algorithm := "AWS4-HMAC-SHA256"
-				credentialScope := fmt.Sprintf("%s/%s/%s/aws4_request", datestamp, region, service)
-
-				params := req.URL.Query()
-				params.Add("Action", "GetCallerIdentity")
-				params.Add("Version", "2011-06-15")
-				params.Add("X-Amz-Algorithm", algorithm)
-				params.Add("X-Amz-Credential", string(resIDMatch)+"/"+credentialScope)
-				params.Add("X-Amz-Date", amzDate)
-				params.Add("X-Amz-Expires", "30")
-				params.Add("X-Amz-SignedHeaders", signedHeaders)
-
-				canonicalQuerystring := params.Encode()
-				payloadHash := GetHash("") // empty payload
-				canonicalRequest := string(method) + "\n" + string(canonicalURI) + "\n" + string(canonicalQuerystring) + "\n" + string(canonicalHeaders) + "\n" + string(signedHeaders) + "\n" + string(payloadHash)
-
-				// TASK 2: CREATE THE STRING TO SIGN.
-				stringToSign := string(algorithm) + "\n" + string(amzDate) + "\n" + string(credentialScope) + "\n" + string(GetHash(canonicalRequest))
-
-				// TASK 3: CALCULATE THE SIGNATURE.
-				// https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
-				hash := GetHMAC([]byte(fmt.Sprintf("AWS4%s", resSecretMatch)), []byte(datestamp))
-				hash = GetHMAC(hash, []byte(region))
-				hash = GetHMAC(hash, []byte(service))
-				hash = GetHMAC(hash, []byte("aws4_request"))
-
-				signature2 := GetHMAC(hash, []byte(stringToSign)) // Get Signature HMAC SHA256
-				signature := hex.EncodeToString(signature2)
-
-				// TASK 4: ADD SIGNING INFORMATION TO THE REQUEST.
-				params.Add("X-Amz-Signature", signature)
-				req.Header.Add("Content-type", "application/x-www-form-urlencoded; charset=utf-8")
-				req.URL.RawQuery = params.Encode()
-
-				client := s.verificationClient
-				if client == nil {
-					client = defaultVerificationClient
-				}
-				res, err := client.Do(req)
-				if err == nil {
-
-					if res.StatusCode >= 200 && res.StatusCode < 300 {
-						identityInfo := identityRes{}
-						err := json.NewDecoder(res.Body).Decode(&identityInfo)
-						if err == nil {
-							s1.Verified = true
-							s1.ExtraData = map[string]string{
-								"account": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Account,
-								"user_id": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.UserID,
-								"arn":     identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Arn,
-							}
-						} else {
-							s1.VerificationError = err
-						}
-						res.Body.Close()
-					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears "random" enough to be a real key.
-						if detectors.IsKnownFalsePositive(resSecretMatch, detectors.DefaultFalsePositives, true) {
-							continue
-						}
-
-						if res.StatusCode == 403 {
-							var body awsErrorResponseBody
-							err = json.NewDecoder(res.Body).Decode(&body)
-							res.Body.Close()
-							if err == nil {
-								// All instances of the code I've seen in the wild are PascalCased but this check is
-								// case-insensitive out of an abundance of caution
-								if strings.EqualFold(body.Error.Code, "InvalidClientTokenId") {
-									// determinate failure - nothing to do
-								} else {
-									// We see a surprising number of false-negative signature mismatch errors here
-									// (The official SDK somehow elicits even more than just making the request
-									// ourselves)
-									s1.VerificationError = fmt.Errorf("request to %v returned status %d with an unexpected reason (%s: %s)", res.Request.URL, res.StatusCode, body.Error.Code, body.Error.Message)
-								}
-							} else {
-								s1.VerificationError = fmt.Errorf("couldn't parse the sts response body (%v)", err)
-							}
-						} else {
-							s1.VerificationError = fmt.Errorf("request to %v returned unexpected status %d", res.Request.URL, res.StatusCode)
-						}
-					}
-				} else {
-					s1.VerificationError = err
-				}
+				verified, extraData, verificationErr := s.verifyMatch(ctx, resIDMatch, resSecretMatch, true)
+				s1.Verified = verified
+				s1.ExtraData = extraData
+				s1.VerificationError = verificationErr
 			}

-			// If the result is unverified and matches something like a git hash, don't include it in the results.
-			if !s1.Verified && falsePositiveSecretCheck.Match(resSecretMatch) {
-				continue
+			if !s1.Verified {
+				// Unverified results that contain common test words are probably not secrets
+				if detectors.IsKnownFalsePositive(resSecretMatch, detectors.DefaultFalsePositives, true) {
+					continue
+				}
+				// Unverified results that look like hashes are probably not secrets
+				if falsePositiveSecretCheck.MatchString(resSecretMatch) {
+					continue
+				}
 			}

 			results = append(results, s1)
@@ -241,156 +145,122 @@ func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 	return awsCustomCleanResults(results), nil
 }

-// func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-// 	idMatches := idPat.FindAllSubmatch(data, -1)
-// 	secretMatches := secretPat.FindAllSubmatch(data, -1)
-//
-// 	for _, idMatch := range idMatches {
-// 		if len(idMatch) != 2 {
-// 			continue
-// 		}
-// 		resIDMatch := bytes.TrimSpace(idMatch[1])
-//
-// 		if s.skipIDs != nil {
-// 			if _, ok := s.skipIDs[string(resIDMatch)]; ok {
-// 				continue
-// 			}
-// 		}
-//
-// 		for _, secretMatch := range secretMatches {
-// 			if len(secretMatch) != 2 {
-// 				continue
-// 			}
-// 			resSecretMatch := bytes.TrimSpace(secretMatch[1])
-//
-// 			s1 := detectors.Result{
-// 				DetectorType: detectorspb.DetectorType_AWS,
-// 				Raw:          resIDMatch,
-// 				Redacted:     string(resIDMatch),
-// 				RawV2:        append(append([]byte(nil), resIDMatch...), resSecretMatch...),
-// 			}
-//
-// 			if verify {
-// 				// Each string operation is converted into byte operations
-//
-// 				method := []byte("GET")
-// 				service := []byte("sts")
-// 				host := []byte("sts.amazonaws.com")
-// 				region := []byte("us-east-1")
-// 				endpoint := []byte("https://sts.amazonaws.com")
-// 				datestamp := []byte(time.Now().UTC().Format("20060102"))
-// 				amzDate := []byte(time.Now().UTC().Format("20060102T150405Z0700"))
-//
-// 				req, err := http.NewRequestWithContext(ctx, string(method), string(endpoint), nil)
-// 				if err != nil {
-// 					continue
-// 				}
-// 				req.Header.Set("Accept", "application/json")
-//
-// 				// Byte operations for the subsequent string operations
-//
-// 				canonicalURI := []byte("/")
-// 				canonicalHeaders := []byte("host:" + string(host) + "\n")
-// 				signedHeaders := []byte("host")
-// 				algorithm := []byte("AWS4-HMAC-SHA256")
-// 				credentialScope := []byte(fmt.Sprintf("%s/%s/%s/aws4_request", datestamp, region, service))
-//
-// 				params := req.URL.Query()
-// 				params.Add("Action", "GetCallerIdentity")
-// 				params.Add("Version", "2011-06-15")
-// 				params.Add("X-Amz-Algorithm", string(algorithm))
-// 				params.Add("X-Amz-Credential", string(resIDMatch)+"/"+string(credentialScope))
-// 				params.Add("X-Amz-Date", string(amzDate))
-// 				params.Add("X-Amz-Expires", "30")
-// 				params.Add("X-Amz-SignedHeaders", string(signedHeaders))
-//
-// 				canonicalQuerystring := params.Encode()
-// 				payloadHash := GetHash([]byte("")) // empty payload
-// 				canonicalRequest := string(method) + "\n" + string(canonicalURI) + "\n" + string(canonicalQuerystring) + "\n" + string(canonicalHeaders) + "\n" + string(signedHeaders) + "\n" + string(payloadHash)
-//
-// 				// TASK 2: CREATE THE STRING TO SIGN.
-// 				stringToSign := string(algorithm) + "\n" + string(amzDate) + "\n" + string(credentialScope) + "\n" + string(GetHash([]byte(canonicalRequest)))
-//
-// 				hash := GetHMAC([]byte(fmt.Sprintf("AWS4%s", string(resSecretMatch))), datestamp)
-// 				hash = GetHMAC(hash, region)
-// 				hash = GetHMAC(hash, service)
-// 				hash = GetHMAC(hash, []byte("aws4_request"))
-//
-// 				signature2 := GetHMAC(hash, []byte(stringToSign)) // Get Signature HMAC SHA256
-// 				signature := hex.EncodeToString(signature2)
-//
-// 				params.Add("X-Amz-Signature", signature)
-// 				req.Header.Add("Content-type", "application/x-www-form-urlencoded; charset=utf-8")
-// 				req.URL.RawQuery = params.Encode()
-//
-// 				client := s.verificationClient
-// 				if client == nil {
-// 					client = defaultVerificationClient
-// 				}
-// 				res, err := client.Do(req)
-// 				if err == nil {
-//
-// 					if res.StatusCode >= 200 && res.StatusCode < 300 {
-// 						identityInfo := identityRes{}
-// 						err := json.NewDecoder(res.Body).Decode(&identityInfo)
-// 						if err == nil {
-// 							s1.Verified = true
-// 							s1.ExtraData = map[string]string{
-// 								"account": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Account,
-// 								"user_id": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.UserID,
-// 								"arn":     identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Arn,
-// 							}
-// 						} else {
-// 							s1.VerificationError = err
-// 						}
-// 						res.Body.Close()
-// 					} else {
-// 						// This function will check false positives for common test words, but also it will make sure the key appears "random" enough to be a real key.
-// 						if detectors.IsKnownFalsePositive(resSecretMatch, detectors.DefaultFalsePositives, true) {
-// 							continue
-// 						}
-//
-// 						if res.StatusCode == 403 {
-// 							var body awsErrorResponseBody
-// 							err = json.NewDecoder(res.Body).Decode(&body)
-// 							res.Body.Close()
-// 							if err == nil {
-// 								// All instances of the code I've seen in the wild are PascalCased but this check is
-// 								// case-insensitive out of an abundance of caution
-// 								if strings.EqualFold(body.Error.Code, "InvalidClientTokenId") {
-// 									// determinate failure - nothing to do
-// 								} else {
-// 									// We see a surprising number of false-negative signature mismatch errors here
-// 									// (The official SDK somehow elicits even more than just making the request
-// 									// ourselves)
-// 									s1.VerificationError = fmt.Errorf("request to %v returned status %d with an unexpected reason (%s: %s)", res.Request.URL, res.StatusCode, body.Error.Code, body.Error.Message)
-// 								}
-// 							} else {
-// 								s1.VerificationError = fmt.Errorf("couldn't parse the sts response body (%v)", err)
-// 							}
-// 						} else {
-// 							s1.VerificationError = fmt.Errorf("request to %v returned unexpected status %d", res.Request.URL, res.StatusCode)
-// 						}
-// 					}
-// 				} else {
-// 					s1.VerificationError = err
-// 				}
-// 			}
-//
-// 			// If the result is unverified and matches something like a git hash, don't include it in the results.
-// 			if !s1.Verified && falsePositiveSecretCheck.Match(resSecretMatch) {
-// 				continue
-// 			}
-//
-// 			results = append(results, s1)
-// 			// If we've found a verified match with this ID, we don't need to look for any more. So move on to the next ID.
-// 			if s1.Verified {
-// 				break
-// 			}
-// 		}
-// 	}
-// 	return awsCustomCleanResults(results), nil
-// }
+func (s scanner) verifyMatch(ctx context.Context, resIDMatch, resSecretMatch string, retryOn403 bool) (bool, map[string]string, error) {
+	// REQUEST VALUES.
+	method := "GET"
+	service := "sts"
+	host := "sts.amazonaws.com"
+	region := "us-east-1"
+	endpoint := "https://sts.amazonaws.com"
+	now := time.Now().UTC()
+	datestamp := now.Format("20060102")
+	amzDate := now.Format("20060102T150405Z0700")
+
+	req, err := http.NewRequestWithContext(ctx, method, endpoint, nil)
+	if err != nil {
+		return false, nil, err
+	}
+	req.Header.Set("Accept", "application/json")
+
+	// TASK 1: CREATE A CANONICAL REQUEST.
+	// http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
+	canonicalURI := "/"
+	canonicalHeaders := "host:" + host + "\n"
+	signedHeaders := "host"
+	algorithm := "AWS4-HMAC-SHA256"
+	credentialScope := fmt.Sprintf("%s/%s/%s/aws4_request", datestamp, region, service)
+
+	params := req.URL.Query()
+	params.Add("Action", "GetCallerIdentity")
+	params.Add("Version", "2011-06-15")
+	params.Add("X-Amz-Algorithm", algorithm)
+	params.Add("X-Amz-Credential", resIDMatch+"/"+credentialScope)
+	params.Add("X-Amz-Date", amzDate)
+	params.Add("X-Amz-Expires", "30")
+	params.Add("X-Amz-SignedHeaders", signedHeaders)
+
+	canonicalQuerystring := params.Encode()
+	payloadHash := GetHash("") // empty payload
+	canonicalRequest := method + "\n" + canonicalURI + "\n" + canonicalQuerystring + "\n" + canonicalHeaders + "\n" + signedHeaders + "\n" + payloadHash
+
+	// TASK 2: CREATE THE STRING TO SIGN.
+	stringToSign := algorithm + "\n" + amzDate + "\n" + credentialScope + "\n" + GetHash(canonicalRequest)
+
+	// TASK 3: CALCULATE THE SIGNATURE.
+	// https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
+	hash := GetHMAC([]byte(fmt.Sprintf("AWS4%s", resSecretMatch)), []byte(datestamp))
+	hash = GetHMAC(hash, []byte(region))
+	hash = GetHMAC(hash, []byte(service))
+	hash = GetHMAC(hash, []byte("aws4_request"))
+
+	signature2 := GetHMAC(hash, []byte(stringToSign)) // Get Signature HMAC SHA256
+	signature := hex.EncodeToString(signature2)
+
+	// TASK 4: ADD SIGNING INFORMATION TO THE REQUEST.
+	params.Add("X-Amz-Signature", signature)
+	req.Header.Add("Content-type", "application/x-www-form-urlencoded; charset=utf-8")
+	req.URL.RawQuery = params.Encode()
+
+	client := s.verificationClient
+	if client == nil {
+		client = defaultVerificationClient
+	}
+
+	res, err := client.Do(req)
+	if err == nil {
+		defer res.Body.Close()
+		if res.StatusCode >= 200 && res.StatusCode < 300 {
+			identityInfo := identityRes{}
+			err := json.NewDecoder(res.Body).Decode(&identityInfo)
+			if err == nil {
+				extraData := map[string]string{
+					"account": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Account,
+					"user_id": identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.UserID,
+					"arn":     identityInfo.GetCallerIdentityResponse.GetCallerIdentityResult.Arn,
+				}
+				return true, extraData, nil
+			} else {
+				return false, nil, err
+			}
+		} else if res.StatusCode == 403 {
+			// Experimentation has indicated that if you make two GetCallerIdentity requests within five seconds that
+			// share a key ID but are signed with different secrets the second one will be rejected with a 403 that
+			// carries a SignatureDoesNotMatch code in its body. This happens even if the second ID-secret pair is
+			// valid. Since this is exactly our access pattern, we need to work around it.
+			//
+			// Fortunately, experimentation has also revealed a workaround: simply resubmit the second request. The
+			// response to the resubmission will be as expected. But there's a caveat: You can't have closed the body of
+			// the response to the original second request, or read to its end, or the resubmission will also yield a
+			// SignatureDoesNotMatch. For this reason, we have to re-request all 403s. We can't re-request only
+			// SignatureDoesNotMatch responses, because we can only tell whether a given 403 is a SignatureDoesNotMatch
+			// after decoding its response body, which requires reading the entire response body, which disables the
+			// workaround.
+			//
+			// We are clearly deep in the guts of AWS implementation details here, so this all might change with no
+			// notice. If you're here because something in this detector broke, you have my condolences.
+			if retryOn403 {
+				return s.verifyMatch(ctx, resIDMatch, resSecretMatch, false)
+			}
+			var body awsErrorResponseBody
+			err = json.NewDecoder(res.Body).Decode(&body)
+			if err == nil {
+				// All instances of the code I've seen in the wild are PascalCased but this check is
+				// case-insensitive out of an abundance of caution
+				if strings.EqualFold(body.Error.Code, "InvalidClientTokenId") {
+					return false, nil, nil
+				} else {
+					return false, nil, fmt.Errorf("request to %v returned status %d with an unexpected reason (%s: %s)", res.Request.URL, res.StatusCode, body.Error.Code, body.Error.Message)
+				}
+			} else {
+				return false, nil, fmt.Errorf("couldn't parse the sts response body (%v)", err)
+			}
+		} else {
+			return false, nil, fmt.Errorf("request to %v returned unexpected status %d", res.Request.URL, res.StatusCode)
+		}
+	} else {
+		return false, nil, err
+	}
+}

 func awsCustomCleanResults(results []detectors.Result) []detectors.Result {
 	if len(results) == 0 {
@@ -248,6 +248,28 @@ func TestAWS_FromChunk(t *testing.T) {
 			wantErr:               false,
 			wantVerificationError: true,
 		},
+		{
+			name: "verified secret checked directly after unverified secret with same key id",
+			s:    scanner{},
+			args: args{
+				ctx:    context.Background(),
+				data:   []byte(fmt.Sprintf("%s\n%s\n%s", inactiveSecret, id, secret)),
+				verify: true,
+			},
+			want: []detectors.Result{
+				{
+					DetectorType: detectorspb.DetectorType_AWS,
+					Verified:     true,
+					Redacted:     "AKIASP2TPHJSQH3FJRUX",
+					ExtraData: map[string]string{
+						"account": "171436882533",
+						"arn":     "arn:aws:iam::171436882533:user/canarytokens.com@@4dxkh0pdeop3bzu9zx5wob793",
+						"user_id": "AIDASP2TPHJSUFRSTTZX4",
+					},
+				},
+			},
+			wantErr: false,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1,10 +1,10 @@
 package axonaut

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,29 +13,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"axonaut"}) + `\b([a-z0-9]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("axonaut")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"axonaut"}
 }

+// FromData will find and optionally verify Axonaut secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Axonaut,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -43,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("userApiKey", string(resMatch))
+			req.Header.Add("userApiKey", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package aylien

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,48 +26,49 @@ var (

 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("aylien")}
+func (s Scanner) Keywords() []string {
+	return []string{"aylien"}
 }

 // FromData will find and optionally verify Aylien secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resIdMatch := bytes.TrimSpace(idMatch[1])
-			newSecret := append(resMatch, resIdMatch...)
+
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Aylien,
-				Raw:          resMatch,
-				RawV2:        newSecret,
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resIdMatch),
 			}
-
 			if verify {
 				req, err := http.NewRequestWithContext(ctx, "GET", "https://api.aylien.com/news/stories", nil)
 				if err != nil {
 					continue
 				}
-				req.Header.Add("X-AYLIEN-NewsAPI-Application-ID", string(resMatch))
-				req.Header.Add("X-AYLIEN-NewsAPI-Application-Key", string(resIdMatch))
+				req.Header.Add("X-AYLIEN-NewsAPI-Application-ID", resIdMatch)
+				req.Header.Add("X-AYLIEN-NewsAPI-Application-Key", resMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						if detectors.IsKnownFalsePositive(newSecret, detectors.DefaultFalsePositives, true) {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
@@ -1,11 +1,11 @@
 package ayrshare

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,28 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ayrshare"}) + `\b([A-Z]{7}-[A-Z0-9]{7}-[A-Z0-9]{7}-[A-Z0-9]{7})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("ayrshare")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"ayrshare"}
 }

+// FromData will find and optionally verify Ayrshare secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])
+
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Ayrshare,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -43,21 +52,24 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
 				}
 			}
 		}
+
 		results = append(results, s1)
 	}
+
 	return results, nil
 }

@@ -7,6 +7,7 @@ import (
 	"strings"

 	"github.com/Azure/go-autorest/autorest/azure/auth"
+
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 )
@@ -30,33 +31,35 @@ var (
 	tenantIDPat = mustFmtPat("tenant_id", idPatFmt)

 	// TODO: support old patterns
-	secretPatFmt    = `(?i)(%s).{0,20}([a-z0-9_.\-~]{34})`
+	secretPatFmt    = `(?i)(%s).{0,20}([a-z0-9_\.\-~]{34})`
 	clientSecretPat = mustFmtPat("client_secret", secretPatFmt)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("azure")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"azure"}
 }

 // FromData will find and optionally verify Azure secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	clientSecretMatches := clientSecretPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)

+	clientSecretMatches := clientSecretPat.FindAllStringSubmatch(dataStr, -1)
 	for _, clientSecret := range clientSecretMatches {
-		tenantIDMatches := tenantIDPat.FindAllSubmatch(data, -1)
+		tenantIDMatches := tenantIDPat.FindAllStringSubmatch(dataStr, -1)
 		for _, tenantID := range tenantIDMatches {
-			clientIDMatches := clientIDPat.FindAllSubmatch(data, -1)
+			clientIDMatches := clientIDPat.FindAllStringSubmatch(dataStr, -1)
 			for _, clientID := range clientIDMatches {
 				s := detectors.Result{
 					DetectorType: detectorspb.DetectorType_Azure,
-					Raw:          clientSecret[2],
-					RawV2:        append(clientID[2], append(clientSecret[2], tenantID[2]...)...),
-					Redacted:     string(clientID[2]),
+					Raw:          []byte(clientSecret[2]),
+					RawV2:        []byte(clientID[2] + clientSecret[2] + tenantID[2]),
+					Redacted:     clientID[2],
 				}

 				if verify {
-					cred := auth.NewClientCredentialsConfig(string(clientID[2]), string(clientSecret[2]), string(tenantID[2]))
+					cred := auth.NewClientCredentialsConfig(clientID[2], clientSecret[2], tenantID[2])
 					token, err := cred.ServicePrincipalToken()
 					if err != nil {
 						continue
@@ -68,10 +71,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				}

 				if !s.Verified {
-					if detectors.IsKnownFalsePositive([]byte(s.Redacted), detectors.DefaultFalsePositives, true) {
+					if detectors.IsKnownFalsePositive(s.Redacted, detectors.DefaultFalsePositives, true) {
 						continue
 					}
-					if detectors.IsKnownFalsePositive(s.Raw, detectors.DefaultFalsePositives, true) {
+					if detectors.IsKnownFalsePositive(string(s.Raw), detectors.DefaultFalsePositives, true) {
 						continue
 					}
 				}
@@ -1,11 +1,11 @@
 package bannerbear

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,29 +20,31 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

-	// Keep the regexp patterns unchanged
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bannerbear"}) + `\b([0-9a-zA-Z]{22}tt)\b`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bannerbear")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bannerbear"}
 }

 // FromData will find and optionally verify Bannerbear secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Bannerbear,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -57,6 +59,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package baremetrics

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,30 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"baremetrics"}) + `\b([a-zA-Z0-9_]{25})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("baremetrics")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"baremetrics"}
 }

+// FromData will find and optionally verify Baremetrics secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Baremetrics,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,12 @@
 package baseapiio

 import (
-	"bytes"
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,30 +15,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"baseapi", "base-api"}) + `\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("baseapi"), []byte("base-api")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"baseapi", "base-api"}
 }

+// FromData will find and optionally verify BaseApiIO secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BaseApiIO,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,17 +53,24 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
-				if bytes.Contains(resMatch, []byte("items")) {
+				bodyBytes, err := io.ReadAll(res.Body)
+				if err != nil {
+					continue
+				}
+				body := string(bodyBytes)
+
+				if strings.Contains(body, "items") {
 					s1.Verified = true
 				} else {
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
 				}
+
 			}
 		}

@@ -1,10 +1,10 @@
 package beamer

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,27 +19,31 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"beamer"}) + `\b([a-zA-Z0-9_+/]{45}=)`)
 )

 // Keywords are used for efficiently pre-filtering chunks.
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("beamer")}
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"beamer"}
 }

 // FromData will find and optionally verify Beamer secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Beamer,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -47,14 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Beamer-Api-Key", string(resMatch))
+			req.Header.Add("Beamer-Api-Key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,12 @@
 package beebole

 import (
-	"bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,50 +15,56 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"beebole"}) + `\b([0-9a-z]{40})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("beebole")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"beebole"}
 }

+// FromData will find and optionally verify Beebole secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Beebole,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			data := fmt.Sprintf("%s:X", string(resMatch))
+			data := fmt.Sprintf("%s:X", resMatch)
 			sEnc := b64.StdEncoding.EncodeToString([]byte(data))
-			payload := bytes.NewReader([]byte(`{"service": "custom_field.list"}`))
+			payload := strings.NewReader(`{"service": "custom_field.list"}`)
 			req, err := http.NewRequestWithContext(ctx, "POST", "https://beebole-apps.com/api/v2", payload)
 			if err != nil {
 				continue
 			}
-
 			req.Header.Add("Content-Type", "application/json")
 			req.Header.Add("Authorization", fmt.Sprintf("Basic %s", sEnc))
 			res, err := client.Do(req)
-
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,12 @@
 package besnappy

 import (
-	b "bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,30 +15,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"besnappy"}) + `\b([a-f0-9]{64})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("besnappy")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"besnappy"}
 }

+// FromData will find and optionally verify Besnappy secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := b.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Besnappy,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}
 		if verify {
 			data := fmt.Sprintf("%s:x", resMatch)
@@ -54,6 +61,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package besttime

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,54 +14,61 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"besttime"}) + `\b([0-9A-Za-z_]{36})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("besttime")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"besttime"}
 }

+// FromData will find and optionally verify Besttime secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Besttime,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://besttime.app/api/v1/keys/"+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://besttime.app/api/v1/keys/"+resMatch, nil)
 			if err != nil {
 				continue
 			}
-
 			res, err := client.Do(req)
-			if err != nil {
-				continue
-			}
-			defer res.Body.Close()
-			bodyBytes, err := io.ReadAll(res.Body)
-			if err != nil {
-				continue
-			}
-
-			if bytes.Contains(bodyBytes, []byte(`"status": "OK"`)) {
-				s1.Verified = true
-			} else {
-				if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+			if err == nil {
+				defer res.Body.Close()
+				bodyBytes, err := io.ReadAll(res.Body)
+				if err != nil {
 					continue
 				}
+				body := string(bodyBytes)
+
+				if strings.Contains(body, `"status": "OK"`) {
+					s1.Verified = true
+				} else {
+					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+						continue
+					}
+				}
+
 			}
 		}

@@ -1,11 +1,11 @@
 package billomat

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,49 +20,55 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"billomat"}) + `\b([0-9a-z]{32})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"billomat"}) + `\b([0-9a-z]{1,})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("billomat")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"billomat"}
 }

+// FromData will find and optionally verify Billomat secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
-
+		resMatch := strings.TrimSpace(match[1])
 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
-			resId := bytes.TrimSpace(idMatch[1])
+			resId := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Billomat,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resId...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resId),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://%s.billomat.net/api/v2/clients/myself", string(resId)), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://%s.billomat.net/api/v2/clients/myself", resId), nil)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Content-Type", "application/json")
-				req.Header.Add("X-BillomatApiKey", string(resMatch))
+				req.Header.Add("X-BillomatApiKey", resMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,34 +15,42 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitbar"}) + `\b([0-9a-z]{32})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bitbar")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bitbar"}
 }

+// FromData will find and optionally verify Bitbar secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := match[1]
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Bitbar,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			data := []byte(fmt.Sprintf("%s:", resMatch))
-			baseToken := b64.StdEncoding.EncodeToString(data)
+			data := fmt.Sprintf("%s:", resMatch)
+			baseToken := b64.StdEncoding.EncodeToString([]byte(data))
 			req, err := http.NewRequestWithContext(ctx, "GET", "https://cloud.bitbar.com/api/me", nil)
 			if err != nil {
 				continue
@@ -54,6 +63,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package bitcoinaverage

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,38 +19,45 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitcoinaverage"}) + `\b([a-zA-Z0-9]{43})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bitcoinaverage")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bitcoinaverage"}
 }

+// FromData will find and optionally verify BitcoinAverage secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BitcoinAverage,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}
 		if verify {
 			req, err := http.NewRequestWithContext(ctx, "GET", "https://apiv2.bitcoinaverage.com/websocket/get_ticket", nil)
 			if err != nil {
 				continue
 			}
-			req.Header.Add("x-ba-key", string(resMatch))
+			req.Header.Add("x-ba-key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,80 +1,99 @@
 package bitfinex

 import (
-	"bytes"
 	"context"
+	"flag"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/bitfinexcom/bitfinex-api-go/v2/rest"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 )

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
-	client       = common.SaneHttpClient()
+	client = common.SaneHttpClient()
+
+	// related resource https://medium.com/@Bitfinex/api-development-update-april-65fe52f84124
 	apiKeyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"bitfinex"}) + `\b([A-Za-z0-9_-]{43})\b`)
 	apiSecretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitfinex"}) + `\b([A-Za-z0-9_-]{43})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bitfinex")}
+var (
+	api = flag.String("api", "https://api-pub.bitfinex.com/v2/", "v2 REST API URL")
+)
+
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bitfinex"}
 }

+// FromData will find and optionally verify Bitfinex secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	apiKeyMatches := apiKeyPat.FindAllSubmatch(data, -1)
-	apiSecretMatches := apiSecretPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	apiKeyMatches := apiKeyPat.FindAllStringSubmatch(dataStr, -1)
+	apiSecretMatches := apiSecretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, apiKeyMatch := range apiKeyMatches {
 		if len(apiKeyMatch) != 2 {
 			continue
 		}
-		apiKeyRes := bytes.TrimSpace(apiKeyMatch[1])
+		apiKeyRes := strings.TrimSpace(apiKeyMatch[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Bitfinex,
-			Raw:          apiKeyRes,
+			Raw:          []byte(apiKeyRes),
 		}

 		for _, apiSecretMatch := range apiSecretMatches {
 			if len(apiSecretMatch) != 2 {
 				continue
 			}
-			apiSecretRes := bytes.TrimSpace(apiSecretMatch[1])
+			apiSecretRes := strings.TrimSpace(apiSecretMatch[1])

-			if bytes.Equal(apiKeyRes, apiSecretRes) {
+			if apiKeyRes == apiSecretRes {
 				continue
 			}

 			if verify {
-				key := string(apiKeyRes)
-				secret := string(apiSecretRes)
-				http.DefaultClient = client
-				c := rest.NewClient().Credentials(key, secret)
+				// thankfully official golang examples exist but you just need to dig their many repos https://github.com/bitfinexcom/bitfinex-api-go/blob/master/examples/v2/rest-orders/main.go
+				key := apiKeyRes
+				secret := apiSecretRes
+				http.DefaultClient = client // filed https://github.com/bitfinexcom/bitfinex-api-go/issues/238 to improve this
+				c := rest.NewClientWithURL(*api).Credentials(key, secret)

-				isValid := true
+				isValid := true // assume valid
 				_, err = c.Orders.AllHistory()
 				if err != nil {
-					if bytes.HasPrefix([]byte(err.Error()), []byte("POST https://")) {
+					if strings.HasPrefix(err.Error(), "POST https://") { // eg POST https://api-pub.bitfinex.com/v2/auth/r/orders/hist: 500 apikey: digest invalid (10100)
 						isValid = false
-					} else if detectors.IsKnownFalsePositive(apiKeyRes, detectors.DefaultFalsePositives, true) {
-						continue
+					} else {
+						if detectors.IsKnownFalsePositive(apiKeyRes, detectors.DefaultFalsePositives, true) {
+							continue
+						}
 					}
 				}

 				s1.Verified = isValid
+				// If there is a valid one, we need to stop iterating now and return the valid result
 				if isValid {
 					break
 				}
 			}
 		}

+		// By appending resutls in the outer loop we can reduce false positives if there are multiple
+		// combinations of secrets and IDs found.
 		if len(apiSecretMatches) > 0 {
 			results = append(results, s1)
 		}
@@ -1,11 +1,11 @@
 package bitlyaccesstoken

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,30 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitly"}) + `\b([a-zA-Z-0-9]{40})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bitly")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bitly"}
 }

+// FromData will find and optionally verify BitLyAccessToken secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BitLyAccessToken,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -45,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,7 +1,6 @@
 package bitmex

 import (
-	"bytes"
 	"context"
 	"crypto/hmac"
 	"crypto/sha256"
@@ -10,6 +9,7 @@ import (
 	"net/url"
 	"regexp"
 	"strconv"
+	"strings"
 	"time"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
@@ -19,40 +19,46 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

-	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"bitmex"}) + string([]byte{32, 13, 10}) + `[0-9a-zA-Z\-\_]{24}` + string([]byte{32, 13, 10}))
-	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitmex"}) + string([]byte{32, 13, 10}) + `[0-9a-zA-Z\-\_]{48}` + string([]byte{32, 13, 10}))
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"bitmex"}) + `([ \r\n]{1}[0-9a-zA-Z\-\_]{24}[ \r\n]{1})`)
+	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bitmex"}) + `([ \r\n]{1}[0-9a-zA-Z\-\_]{48}[ \r\n]{1})`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bitmex")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bitmex"}
 }

+// FromData will find and optionally verify Bitmex secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
-	secretMatches := secretPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, secretMatch := range secretMatches {
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecretMatch := bytes.TrimSpace(secretMatch[1])
+			resSecretMatch := strings.TrimSpace(secretMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Bitmex,
-				Raw:          resSecretMatch,
-				RawV2:        append(resMatch, resSecretMatch...),
+				Raw:          []byte(resSecretMatch),
+				RawV2:        []byte(resMatch + resSecretMatch),
 			}

 			if verify {
@@ -62,15 +68,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				path := "/api/v1/user"
 				payload := url.Values{}

-				signature := getBitmexSignature(timestamp, string(resSecretMatch), action, path, payload.Encode())
-
-				req, err := http.NewRequestWithContext(ctx, action, "https://www.bitmex.com"+path, bytes.NewReader([]byte(payload.Encode())))
+				signature := getBitmexSignature(timestamp, resSecretMatch, action, path, payload.Encode())

+				req, err := http.NewRequestWithContext(ctx, action, "https://www.bitmex.com"+path, strings.NewReader(payload.Encode()))
 				if err != nil {
 					continue
 				}
 				req.Header.Add("api-expires", timestamp)
-				req.Header.Add("api-key", string(resMatch))
+				req.Header.Add("api-key", resMatch)
 				req.Header.Add("api-signature", signature)
 				res, err := client.Do(req)
 				if err == nil {
@@ -78,6 +83,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,11 +1,11 @@
 package blablabus

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,30 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"blablabus"}) + `\b([0-9A-Za-z]{22})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("blablabus")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"blablabus"}
 }

+// FromData will find and optionally verify Blablabus secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)

-	matches := keyPat.FindAllSubmatch(data, -1)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Blablabus,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -46,13 +53,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("Authorization", fmt.Sprintf("Token %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Token %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package blazemeter

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,25 +20,31 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"blazemeter", "runscope"}) + `\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("blazemeter"), []byte("runscope")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"blazemeter", "runscope"}
 }

+// FromData will find and optionally verify Blazemeter secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Blazemeter,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -47,13 +53,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package blitapp

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,30 +13,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"blitapp"}) + `\b([a-zA-Z0-9_-]{39})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("blitapp")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"blitapp"}
 }

+// FromData will find and optionally verify BlitApp secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BlitApp,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -44,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("API-Key", string(resMatch))
+			req.Header.Add("API-Key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package blocknative

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,29 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"blocknative"}) + `\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("blocknative")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"blocknative"}
 }

+// FromData will find and optionally verify Blocknative secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BlockNative,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -44,8 +52,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-
-			req.Header.Add("Authorization", string(resMatch))
+			req.Header.Add("Authorization", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -53,9 +60,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				if !bytes.Contains(bodyBytes, []byte("valid")) {
+				body := string(bodyBytes)
+				if !strings.Contains(body, "valid") {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package blogger

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,33 +13,40 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"blogger"}) + `\b([0-9A-Za-z-]{39})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("blogger")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"blogger"}
 }

+// FromData will find and optionally verify Blogger secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Blogger,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://www.googleapis.com/blogger/v3/blogs/2399953?key="+string(resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://www.googleapis.com/blogger/v3/blogs/2399953?key="+resMatch, nil)
 			if err != nil {
 				continue
 			}
@@ -49,6 +56,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,10 +1,10 @@
 package bombbomb

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,29 +13,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bombbomb"}) + `\b([a-zA-Z0-9-._]{704})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("bombbomb")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"bombbomb"}
 }

+// FromData will find and optionally verify BombBomb secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BombBomb,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -43,13 +51,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", string(resMatch))
+			req.Header.Add("Authorization", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,11 +1,11 @@
 package boostnote

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,29 +14,37 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"boostnote"}) + `\b([0-9a-f]{64})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("boostnote")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"boostnote"}
 }

+// FromData will find and optionally verify BoostNote secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_BoostNote,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
@@ -44,13 +52,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,12 +1,12 @@
 package borgbase

 import (
-	"bytes"
 	"context"
 	"fmt"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"
 	"time"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
@@ -16,50 +16,55 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"borgbase"}) + `\b([a-zA-Z0-9/_.-]{148,152})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("borgbase")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"borgbase"}
 }

+// FromData will find and optionally verify Borgbase secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Borgbase,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
 			timeout := 10 * time.Second
 			client.Timeout = timeout
-			payload := bytes.NewBuffer([]byte(`{ "query": "{ sshList {id, name}}" }`))
-
+			payload := strings.NewReader(`{"query":"{ sshList {id, name}}"}`)
 			req, err := http.NewRequest("POST", "https://api.borgbase.com/graphql", payload)
 			if err != nil {
 				continue
 			}
-
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
 			res, err := client.Do(req)
-
 			if err == nil {
 				bodyBytes, err := io.ReadAll(res.Body)
 				if err == nil {
-					validResponse := bytes.Contains(bodyBytes, []byte(`"sshList":[]`))
-
+					bodyString := string(bodyBytes)
+					validResponse := strings.Contains(bodyString, `"sshList":[]`)
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						if validResponse {
@@ -67,8 +72,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						} else {
 							s1.Verified = false
 						}
-					} else if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-						continue
+					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+							continue
+						}
 					}
 				}
 			}
@@ -1,11 +1,11 @@
 package braintreepayments

 import (
-	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,50 +14,57 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"braintree"}) + `\b([0-9a-f]{32})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"braintree"}) + `\b([0-9a-z]{16})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("braintree")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"braintree"}
 }

+// FromData will find and optionally verify BraintreePayments secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
-	idMatches := idPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}

-			resIdMatch := bytes.TrimSpace(idMatch[1])
+			resIdMatch := strings.TrimSpace(idMatch[1])

 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_BraintreePayments,
-				Raw:          resMatch,
+				Raw:          []byte(resMatch),
 			}

 			if verify {
-				payload := bytes.NewBufferString(`{"query": "query { ping }"}`)
+				payload := strings.NewReader(`{"query": "query { ping }"}`)
 				req, err := http.NewRequestWithContext(ctx, "POST", "https://payments.braintree-api.com/graphql", payload)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Content-Type", "application/json")
 				req.Header.Add("Braintree-Version", "2019-01-01")
-				req.SetBasicAuth(string(resIdMatch), string(resMatch))
+				req.SetBasicAuth(resIdMatch, resMatch)
 				res, err := client.Do(req)
 				if err == nil {
 					bodyBytes, err := io.ReadAll(res.Body)
@@ -65,12 +72,14 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						continue
 					}

-					validResponse := bytes.Contains(bodyBytes, []byte(`"data":{`))
+					bodyString := string(bodyBytes)
+					validResponse := strings.Contains(bodyString, `"data":{`)

 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 && validResponse {
 						s1.Verified = true
 					} else {
+						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -1,10 +1,10 @@
 package brandfetch

 import (
-	"bytes"
 	"context"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,48 +13,56 @@ import (

 type Scanner struct{}

+// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)

 var (
 	client = common.SaneHttpClient()

+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"brandfetch"}) + `\b([0-9A-Za-z]{40})\b`)
 )

-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("brandfetch")}
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"brandfetch"}
 }

+// FromData will find and optionally verify Brandfetch secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	matches := keyPat.FindAllSubmatch(data, -1)
+	dataStr := string(data)
+
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)

 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Brandfetch,
-			Raw:          resMatch,
+			Raw:          []byte(resMatch),
 		}

 		if verify {
-			payload := bytes.NewReader([]byte(`{
+			payload := strings.NewReader(`{
 				"domain": "www.example.com"
-				}`))
+				}`)
 			req, err := http.NewRequestWithContext(ctx, "POST", "https://api.brandfetch.io/v1/color", payload)
 			if err != nil {
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("x-api-key", string(resMatch))
+			req.Header.Add("x-api-key", resMatch)
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
+					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}
@@ -1,80 +1,110 @@
 package browserstack

 import (
-	"bytes"
 	"context"
+	"fmt"
 	"net/http"
 	"regexp"
+	"strings"

 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 )

-type Scanner struct{}
-
-var _ detectors.Detector = (*Scanner)(nil)
-
-var (
-	client = common.SaneHttpClient()
-
-	keyPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"https://", "http://", "hub-cloud.browserstack.com", "accessKey", "\"access_Key\":", "ACCESS_KEY", "key", "browserstackKey", "BS_AUTHKEY", "BROWSERSTACK_ACCESS_KEY"}) + `\b([0-9a-zA-Z]{20})\b`)
-	userPat = regexp.MustCompile(detectors.PrefixRegex([]string{"https://", "http://", "hub-cloud.browserstack.com", "userName", "\"username\":", "USER_NAME", "user", "browserstackUser", "BS_USERNAME", "BROWSERSTACK_USERNAME"}) + `\b([a-zA-Z\d]{3,18}[._-]+[a-zA-Z\d]{6})\b`)
-)
-
-func (s Scanner) Keywords() [][]byte {
-	return [][]byte{[]byte("browserstack")}
+type Scanner struct {
+	client *http.Client
 }

-func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	keyMatches := keyPat.FindAllSubmatch(data, -1)
-	userMatches := userPat.FindAllSubmatch(data, -1)
+// Ensure the Scanner satisfies the interface at compile time.
+var _ detectors.Detector = (*Scanner)(nil)

-	for _, match := range keyMatches {
+const browserStackAPIURL = "https://www.browserstack.com/automate/plan.json"
+
+var (
+	defaultClient = common.SaneHttpClient()
+
+	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	keyPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"hub-cloud.browserstack.com", "accessKey", "\"access_Key\":", "ACCESS_KEY", "key", "browserstackKey", "BS_AUTHKEY", "BROWSERSTACK_ACCESS_KEY"}) + `\b([0-9a-zA-Z]{20})\b`)
+	userPat = regexp.MustCompile(detectors.PrefixRegex([]string{"hub-cloud.browserstack.com", "userName", "\"username\":", "USER_NAME", "user", "browserstackUser", "BS_USERNAME", "BROWSERSTACK_USERNAME"}) + `\b([a-zA-Z\d]{3,18}[._-]?[a-zA-Z\d]{6,11})\b`)
+)
+
+// Keywords are used for efficiently pre-filtering chunks.
+// Use identifiers in the secret preferably, or the provider name.
+func (s Scanner) Keywords() []string {
+	return []string{"browserstack"}
+}
+
+// FromData will find and optionally verify BrowserStack secrets in a given set of bytes.
+func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
+	dataStr := string(data)
+	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	userMatches := userPat.FindAllStringSubmatch(dataStr, -1)
+
+	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := bytes.TrimSpace(match[1])
+		resMatch := strings.TrimSpace(match[1])

 		for _, userMatch := range userMatches {
 			if len(userMatch) != 2 {
 				continue
 			}

-			resUserMatch := bytes.TrimSpace(userMatch[1])
+			resUserMatch := strings.TrimSpace(userMatch[1])

-			result := detectors.Result{
+			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_BrowserStack,
-				Raw:          resMatch,
-				RawV2:        append(resMatch, resUserMatch...),
+				Raw:          []byte(resMatch),
+				RawV2:        []byte(resMatch + resUserMatch),
 			}

 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", "https://www.browserstack.com/automate/plan.json", nil)
-				if err != nil {
-					continue
-				}
-				req.Header.Add("Content-Type", "application/json")
-				req.SetBasicAuth(string(resUserMatch), string(resMatch))
-				res, err := client.Do(req)
-				if err != nil {
-					continue
+				client := s.client
+				if client == nil {
+					client = defaultClient
 				}

-				defer res.Body.Close()
-				if res.StatusCode >= 200 && res.StatusCode < 300 {
-					result.Verified = true
-				} else if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-					continue
-				}
+				isVerified, verificationErr := verifyBrowserStackCredentials(ctx, client, resUserMatch, resMatch)
+				s1.Verified = isVerified
+				s1.VerificationError = verificationErr
 			}
-			results = append(results, result)
+
+			// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
+			if !s1.Verified && detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+				continue
+			}
+			results = append(results, s1)
 		}
 	}

 	return results, nil
 }

+func verifyBrowserStackCredentials(ctx context.Context, client *http.Client, username, accessKey string) (bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, browserStackAPIURL, nil)
+	if err != nil {
+		return false, err
+	}
+	req.Header.Add("Content-Type", "application/json")
+	req.SetBasicAuth(username, accessKey)
+
+	res, err := client.Do(req)
+	if err != nil {
+		return false, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode >= 200 && res.StatusCode < 300 {
+		return true, nil
+	} else if res.StatusCode != 401 {
+		return false, fmt.Errorf("unexpected HTTP response status %d", res.StatusCode)
+	}
+
+	return false, nil
+}
+
 func (s Scanner) Type() detectorspb.DetectorType {
 	return detectorspb.DetectorType_BrowserStack
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Dylan Ayrey	68b5f461f3	Update README.md	2023-09-26 21:16:35 -07:00
Zachary Rice	f2d0f809a8	Update Adding_Detectors_external.md (#1822 ) * Update Adding_Detectors_external.md * Update Adding_Detectors_external.md * Update Adding_Detectors_external.md * Lil more	2023-09-26 17:18:58 -05:00
ahrav	bf47fd69bb	Github partial scan (#1804 ) * Add ability for targetted partial scans of Github. * update comment. * add more tests. * add additiional test. * address comments.	2023-09-26 12:38:33 -07:00
joeleonjr	1e42dae734	added PR and Issue body scanning (#1816 ) * added PR and Issue body scanning; adjusted CLI args to fit * removed print statement from debugging * removed exclude-commits; adjusted CLI flags * minor changes to match main branch * fixing logic * updating README for --issues and --prs	2023-09-26 12:25:48 -04:00
Zachary Rice	44c8cfffd1	Update Adding_Detectors_external.md (#1817 )	2023-09-26 08:23:07 -05:00
Shubham Hibare	b71ea27a69	Implement an installation script with CheckSum Validation (#1808 ) * Add installation script * Update README.md * Change set -e to set -o errexit * Remove non-required dir existence test * Switch && to \|\|	2023-09-25 12:48:23 -07:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	1715e7ad23	updating browserstack detector to use tri-state verification (#1785 ) * updating browserstack detector to use tri-state verification * cleaning up nested conditions	2023-09-25 15:34:13 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	af1434e05a	updating microsoft teams webhook detector to use tri-state verification (#1792 ) * updating microsoft teams webhook detector to use tri-state verification * cleaning up nested conditions	2023-09-25 15:30:41 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	ac18096da0	updating myfreshworks detector to use tri-state verification (#1779 ) * updating secret regex to include underscores and updating tests to have secret and domain within 20char range of keyword * updating myfreshworks detector to use tri-state verification	2023-09-25 13:27:23 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	cc9f5739dd	update figma to use tri-state verification (#1814 )	2023-09-25 13:26:18 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	f4ddc8b39e	adding support for new version of figma token (#1813 )	2023-09-22 18:13:49 -04:00
Zachary Rice	2d3bb7560d	Update README.md (#1811 )	2023-09-22 16:51:14 -05:00
Zachary Rice	995eb64d38	examples folder (#1734 ) * wip examples folder * Rename examples.md to README.md	2023-09-22 15:26:20 -05:00
atkins	36aa1451bd	Update protos image to use correct go version (#1810 ) * Update protos image to use correct go version * Update image tag to match version * use bullseye * update proto image --------- Co-authored-by: Dustin Decker <dustin@trufflesec.com>	2023-09-22 14:08:56 -06:00
ahrav	6affc903e1	add line to link for azure repos. (#1801 )	2023-09-21 16:07:11 -07:00
Dustin Decker	5afc7a32ca	fix detector test action (#1805 )	2023-09-21 15:16:00 -07:00
Dustin Decker	b66bd9544c	aggregate detector tests daily (#1800 ) * aggregate detector tests daily * add manual dispatch * fix test	2023-09-21 10:32:40 -07:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	62b2195502	Adding new function SetProgressOngoing to be used when the source does not yet know how many items it is scanning and does not want to display a percentage complete. (#1802 ) Co-Authored-By: @mcastorina	2023-09-21 13:26:10 -04:00
āh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	1a1b2ca51a	updating uri detector to use tri-state verification (#1791 )	2023-09-21 11:20:40 -04:00
dependabot[bot]	590115bca4	Bump golang.org/x/oauth2 from 0.10.0 to 0.12.0 (#1799 ) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.10.0 to 0.12.0. - [Commits](https://github.com/golang/oauth2/compare/v0.10.0...v0.12.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 19:49:12 -07:00
dependabot[bot]	9b01c3d71c	Bump github.com/go-ldap/ldap/v3 from 3.4.5 to 3.4.6 (#1796 ) Bumps [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) from 3.4.5 to 3.4.6. - [Release notes](https://github.com/go-ldap/ldap/releases) - [Commits](https://github.com/go-ldap/ldap/compare/v3.4.5...v3.4.6) --- updated-dependencies: - dependency-name: github.com/go-ldap/ldap/v3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 17:58:21 -07:00
dependabot[bot]	16f885b2fc	Bump github.com/charmbracelet/bubbletea from 0.24.1 to 0.24.2 (#1798 ) Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.24.1 to 0.24.2. - [Release notes](https://github.com/charmbracelet/bubbletea/releases) - [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.24.1...v0.24.2) --- updated-dependencies: - dependency-name: github.com/charmbracelet/bubbletea dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 17:22:52 -07:00
dependabot[bot]	7ac4be481c	Bump github.com/getsentry/sentry-go from 0.22.0 to 0.24.1 (#1797 ) Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) from 0.22.0 to 0.24.1. - [Release notes](https://github.com/getsentry/sentry-go/releases) - [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md) - [Commits](https://github.com/getsentry/sentry-go/compare/v0.22.0...v0.24.1) --- updated-dependencies: - dependency-name: github.com/getsentry/sentry-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 17:21:43 -07:00
dependabot[bot]	f2a528e32b	Bump cloud.google.com/go/storage from 1.31.0 to 1.33.0 (#1795 ) Bumps [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) from 1.31.0 to 1.33.0. - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](https://github.com/googleapis/google-cloud-go/compare/pubsub/v1.31.0...pubsub/v1.33.0) --- updated-dependencies: - dependency-name: cloud.google.com/go/storage dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 17:20:27 -07:00
dependabot[bot]	b9ae7014b0	Bump github.com/mattn/go-isatty from 0.0.18 to 0.0.19 (#1794 ) Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.18 to 0.0.19. - [Commits](https://github.com/mattn/go-isatty/compare/v0.0.18...v0.0.19) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2023-09-20 16:53:24 -07:00
Miccah	efa404942a	Add ability to dynamically scale concurrently running sources (#1790 ) * Add ability to dynamically scale concurrently running sources Refactor SourceManager to use a counting semaphore to allow for dymanically changing limits. This complicated `Wait() error` which needs to return the first error encountered. We previously got that for free using `errgroup.Group`, however now we need to handle that ourselves. `Wait()` needs to return an error for use in the engine to set the correct exit code. * Group third party imports together	2023-09-20 16:49:56 -07:00
ahrav	a8c89c59b9	[bug] - fix link line (#1793 ) * fix link line. * rename.	2023-09-20 14:46:00 -07:00
ahrav	47d5ddebf2	Ability to update line number in link (#1788 ) * Add functionality to update a source's link in the metadata with the updated line number. * update comment. * add logic to engine. * only update link for non empty links. * add tests for bb.	2023-09-19 15:39:13 -07:00
Ankush Goel	63eaccd208	fixed rubygems detector (#1781 ) Co-authored-by: dsingdev-rocketx <bughunter00@protonmail.com>	2023-09-19 06:59:30 -07:00
Ankush Goel	f9ea22f72b	Update sonarcloud.go (#1784 )	2023-09-18 08:24:51 -07:00
ahrav	d2676618c0	[bug] - correclty handle nested archived directories (#1778 )	2023-09-15 04:37:15 -07:00
ahrav	22876f8381	replace interface{} with any. (#1771 )	2023-09-15 04:35:15 -07:00
Miccah	dbcb888063	Update Source interface to use SourceID and JobID types (#1774 ) The previous implementation used int64 for both, which can be mixed up easily. Using distinct types adds a layer of type safety checked by the compiler.	2023-09-14 11:28:24 -07:00
Mike Vanbuskirk	bbc3be3b6c	migrate buildpulse to integration test suite (#1775 )	2023-09-13 15:25:12 -05:00
Mike Vanbuskirk	b4329e0825	add buildpulse config to sources (#1764 ) * add buildpulse config to sources * remove tab indentation * add correct repo ID * wrap test command in gotestsum * exclusion should be detectors * fix exclusions to match community-test * update tag to reflect comm. tests	2023-09-13 11:34:53 -05:00
Cody Rose	1155ee2736	Implement Gitlab source validation (#1765 ) This PR implements validation of Gitlab source configuration. I was hoping to be able to unify more of the implementation of Validate and Chunks, but there was more divergence than I expected. Specifically, Chunks handles a fair number of Gitlab errors that aren't configuration errors (e.g. "Gitlab returned a repo with an unparseable URL"). Accommodating these in the Validate code path felt wrong, and I wasn't able to create a common code path that could accommodate both Validate and Chunks without looking awful.	2023-09-13 11:51:12 -04:00
martinohmann	31d17c4f93	fix: add missing error check in archive handler (#1770 ) Fixes #1769 The existing error check `errors.Is(err, archiver.ErrNoMatch) && depth > 0` only conditionally handled a specific error. Any other error case was not short circuited and ended up causing a nil-pointer dereference further down the method when `format.Name()` was invoked.	2023-09-13 07:07:40 -07:00
Miccah	72b6a9ec6b	Add a SourceType constant to all source packages (#1768 )	2023-09-12 17:23:25 -07:00
Miccah	be4d0bcb41	Refactor SourceManager to remove Enrollment (#1740 ) * Refactor SourceManager to remove Enrollment Initializing the Source will be the responsibility of the caller. The SourceManager exposes a GetIDs method for getting a source and job ID. * Update tests * Update engine usage * Update apiClient interface to have one GetIDs method * Update SourceManager usage in engine	2023-09-12 16:58:38 -07:00
âh̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	91340c1e00	updating sendbirdorganizationapi detector to use tri-state verification (#1763 )	2023-09-12 10:48:11 -04:00
Mike Vanbuskirk	de540652cb	verbosity updates to s3 source (#1750 )	2023-09-11 14:53:43 -05:00
ahrav	90a07f0352	[chore] - fix slackwebhook detector (#1761 ) * fix slackwebhook detector. * sort imports. * add test for 400.	2023-09-11 12:48:40 -07:00
Dustin Decker	72b3fa31a3	Improve private key detector (#1760 ) * Surface extra data and check private keys directly against gitlab and github * fix encrpypted private key test * implement feedback * mod tidy * fix change * Set timeout for SSH connections	2023-09-11 12:05:27 -07:00
Zubair Khan	3f84a6700e	add tri state verification to slack (not slack webhook) (#1731 ) * add client, add known false positive check * fix idiosyncracies * cleanup * cleanup comment * add unexpected error test case --------- Co-authored-by: Dustin Decker <dustin@trufflesec.com>	2023-09-11 08:38:43 -07:00
ahrav	fdeccf06a0	cache dupes w/ different decoders (#1754 ) * only cache dupes that have different decoders. * add test. * remove file. * update comment.	2023-09-11 08:18:48 -07:00
ahrav	70cdff915b	add test for custom providers. (#1759 )	2023-09-11 08:18:34 -07:00
Cody Rose	2c32b14df1	always close aws response body (#1758 )	2023-09-11 10:42:14 -04:00
ahrav	e53a72abd2	[chore] - Sentry detector update (#1746 ) * add test case for account deactivated. * Handle empty case.	2023-09-11 07:26:09 -07:00
Cody Rose	62ce9bac8b	Retry AWS verification 403s (#1757 ) This PR introduces retries on 403s in the AWS detector in attempt to work around erroneous SignatureDoesNotMatch errors. As part of the work, the detector has been refactored somewhat, resulting in two minor semantic changes: Errors crafting the verification HTTP request no longer result in the candidate secret being discarded. The known-words-based false positive check now runs (and potentially discards candidate secrets) even if verification is disabled. This unifies its behavior with the hash-based false positive check.	2023-09-08 15:32:53 -04:00
trufflesteeeve	e68ace5338	Always attempt to return a git link (#1756 )	2023-09-08 15:17:29 -04:00
Marwan Sulaiman	3aa5369608	Add Tailscale detector (#1719 ) * Add tailscale detector * PR feedback: match on first element	2023-09-07 19:11:17 -07:00
ah̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	8d66fde6de	updating sendgrid detector to use tri-state verification (#1735 ) * updating sendgrid detector to use tri-state verification	2023-09-07 14:21:03 -04:00
ahrav	2a9f34962d	Add optional param to Chunks (#1747 ) * Add interface for targeted chunking. * use optional args. * update Chunks method signature. * update tests. * fix test. * update QueryCriteria type.	2023-09-07 09:03:37 -07:00
ahrav	f6512ac4ca	Use common chunker for archive handler (#1717 ) * optimize the ReadToMax. * add comment. * remove dumb comment. * update comment. * fix test. * lint. * Expired invite link fix (#1713) * Use comon chunker for archive handler. --------- Co-authored-by: Zachary Rice <zachary.rice@trufflesec.com>	2023-09-06 09:26:33 -07:00
Harmon Herring	bf581ae9f9	Fix pagerdutyapikey Detector (#1749 ) * Fix pagerdutyapikey detector by broadening regex * Add 'pd' to list of pagerdutyapikey keywords	2023-09-06 09:15:39 -07:00
ah̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	d3e7c5acc2	updating jiratoken and jiratokenV2 to use tri-state verification + updating tests (#1744 )	2023-09-05 16:32:05 -04:00
ahrav	abb131e502	[chore] - update Docker source (#1708 ) * Add concurrency and common chunker. * lint. * address comments.	2023-09-05 07:40:38 -07:00
ah̳̕mͭͭͨͩ̐e̘ͬ́͋ͬ̊̓͂d	b28a2b9177	updating sendbird detector to use tri-state verification (#1737 ) * updating sendbird detector to use tri-state verification	2023-09-05 10:39:05 -04:00
Cody Rose	afe708519b	Validate S3 source (#1715 ) This PR adds S3 source validation. This is accomplished by factoring out common "bucket visiting" logic to be used by both scanning and validation.	2023-09-05 10:18:58 -04:00