PR 28 of 40

pkg/detectors/rechargepayments/rechargepayments.go

@@ -1,6 +1,7 @@
 package rechargepayments
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
@@ -16,9 +17,8 @@ type Scanner struct{}
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
-	verifyURL = "https://api.rechargeapps.com/token_information"
+	verifyURL = []byte("https://api.rechargeapps.com/token_information")
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	tokenPats = map[string]*regexp.Regexp{
 		"Newer API Keys":        regexp.MustCompile(`\bsk(_test)?_(1|2|3|5|10)x[123]_[0-9a-fA-F]{64}\b`),
 		"Old API key (SHA-224)": regexp.MustCompile(`\b[0-9a-fA-F]{56}\b`),
@@ -26,47 +26,42 @@ var (
 	}
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"sk_1x1", "sk_1x3", "sk_2x1", "sk_2x2", "sk_3x3", "sk_5x3", "sk_10x3", "sk_test_1x1", "sk_test_1x3", "sk_test_2x1", "sk_test_2x2", "sk_test_3x3", "sk_test_5x3", "sk_test_10x3", "X-Recharge-Access-Token"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("sk_1x1"), []byte("sk_1x3"), []byte("sk_2x1"), []byte("sk_2x2"), []byte("sk_3x3"), []byte("sk_5x3"), []byte("sk_10x3"), []byte("sk_test_1x1"), []byte("sk_test_1x3"), []byte("sk_test_2x1"), []byte("sk_test_2x2"), []byte("sk_test_3x3"), []byte("sk_test_5x3"), []byte("sk_test_10x3"), []byte("X-Recharge-Access-Token")}
 }
 
-// FromData will find and optionally verify Recharge Payment secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
 	for _, tokenPat := range tokenPats {
-		tokens := tokenPat.FindAllString(dataStr, -1)
+		tokens := tokenPat.FindAll(data, -1)
 
 		for _, token := range tokens {
-			s := detectors.Result{
+			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_RechargePayments,
-				Raw:          []byte(token),
+				Raw:          bytes.TrimSpace(token),
 			}
 			if verify {
 				client := common.SaneHttpClient()
-				req, err := http.NewRequestWithContext(ctx, "GET", verifyURL, nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", string(verifyURL), nil)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Content-Type", "application/json")
-				req.Header.Add("X-Recharge-Access-Token", token)
+				req.Header.Add("X-Recharge-Access-Token", string(token))
 				res, err := client.Do(req)
 				if err == nil {
-					res.Body.Close() // The request body is unused.
+					defer res.Body.Close()
 
 					if res.StatusCode == http.StatusOK {
-						s.Verified = true
+						s1.Verified = true
 					}
 				}
 			}
 
-			if !s.Verified && detectors.IsKnownFalsePositive(string(s.Raw), detectors.DefaultFalsePositives, true) {
+			if !s1.Verified && detectors.IsKnownFalsePositive(s1.Raw, detectors.DefaultFalsePositives, true) {
 				continue
 			}
 
-			results = append(results, s)
+			results = append(results, s1)
 		}
 	}
 

pkg/detectors/redis/redis.go

@@ -1,48 +1,40 @@
 package redis
 
 import (
+	"bytes"
 	"context"
 	"net/url"
 	"regexp"
-	"strings"
 
 	"github.com/go-redis/redis"
-
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
 )
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	keyPat = regexp.MustCompile(`\bredis://[\S]{3,50}:([\S]{3,50})@[-.%\w\/:]+\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"redis"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("redis")}
 }
 
-// FromData will find and optionally verify URI secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
-		urlMatch := match[0]
-		password := match[1]
+		urlMatch := bytes.TrimSpace(match[0])
+		password := bytes.TrimSpace(match[1])
 
-		// Skip findings where the password only has "*" characters, this is a redacted password
-		if strings.Trim(password, "*") == "" {
+		if bytes.Equal(password, []byte("*")) {
 			continue
 		}
 
-		parsedURL, err := url.Parse(urlMatch)
+		parsedURL, err := url.Parse(string(urlMatch))
 		if err != nil {
 			continue
 		}
@@ -50,26 +42,23 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			continue
 		}
 
-		redact := strings.TrimSpace(strings.Replace(urlMatch, password, "********", -1))
+		redact := bytes.Replace(urlMatch, password, []byte("********"), -1)
 
 		s := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Redis,
-			Raw:          []byte(urlMatch),
-			Redacted:     redact,
+			Raw:          urlMatch,
+			Redacted:     string(redact),
 		}
 
 		if verify {
 			s.Verified = verifyRedis(ctx, parsedURL)
 		}
 
-		if !s.Verified {
-			// Skip unverified findings where the password starts with a `$` - it's almost certainly a variable.
-			if strings.HasPrefix(password, "$") {
-				continue
-			}
+		if !s.Verified && bytes.HasPrefix(password, []byte("$")) {
+			continue
 		}
 
-		if !s.Verified && detectors.IsKnownFalsePositive(string(s.Raw), detectors.DefaultFalsePositives, false) {
+		if !s.Verified && detectors.IsKnownFalsePositive(s.Raw, detectors.DefaultFalsePositives, false) {
 			continue
 		}
 

pkg/detectors/refiner/refiner.go

@@ -1,11 +1,11 @@
 package refiner
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -24,44 +24,39 @@ var (
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"refiner"}) + `\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"refiner"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("refiner")}
 }
 
 // FromData will find and optionally verify Refiner secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Refiner,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			payload := strings.NewReader("id=Your-User-Id&event=Your%20event%20name")
+			payload := bytes.NewReader([]byte("id=Your-User-Id&event=Your%20event%20name"))
 			req, err := http.NewRequestWithContext(ctx, "POST", "https://api.refiner.io/v1/identify-user", payload)
 			if err != nil {
 				continue
 			}
 			req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/rentman/rentman.go

@@ -1,11 +1,11 @@
 package rentman
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,37 +14,31 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"rentman"}) + `\b(ey[a-zA-Z0-9]{34}.ey[a-zA-Z0-9._-]{250,300})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rentman"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rentman")}
 }
 
-// FromData will find and optionally verify Rentman secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Rentman,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -60,7 +54,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/repairshopr/repairshopr.go

@@ -1,11 +1,11 @@
 package repairshopr
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -20,65 +20,63 @@ var _ detectors.Detector = (*Scanner)(nil)
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	// Make sure that your group is surrounded in boundary characters to reduce false positives.
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"repairshopr"}) + `\b([a-zA-Z0-9-]{51})\b`)
 	domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"repairshopr"}) + `\b([a-zA-Z0-9_.!+$#^*]{3,32})\b`)
 )
 
 // Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"repairshopr"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("repairshopr")}
 }
 
 // FromData will find and optionally verify Sugester secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	domainMatches := domainPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	domainMatches := domainPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		for _, domainmatch := range domainMatches {
 			if len(match) != 2 {
 				continue
 			}
-			resDomainMatch := strings.TrimSpace(domainmatch[1])
+			resDomainMatch := bytes.TrimSpace(domainmatch[1])
+
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Repairshopr,
-				Raw:          []byte(resMatch),
+				Raw:          resMatch,
 			}
 
 			if verify {
-				req, err := http.NewRequest("GET", "https://"+resDomainMatch+".repairshopr.com/api/v1/appointment_types", nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://%s.repairshopr.com/api/v1/appointment_types", string(resDomainMatch)), nil)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Accept", "application/vnd.sugester+json; version=3")
-				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
+				req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
 
 				res, err := client.Do(req)
+
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
 				}
+
 			}
 
 			results = append(results, s1)
 		}
-
 	}
 
 	return results, nil

pkg/detectors/restpack/restpack.go

@@ -1,11 +1,11 @@
 package restpack
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,51 +14,43 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"restpack"}) + `\b([a-zA-Z0-9]{48})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"restpack"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("restpack")}
 }
 
-// FromData will find and optionally verify Restpack secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Restpack,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://restpack.io/api/screenshot/usage?access_token=%s", resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://restpack.io/api/screenshot/usage?access_token=%s", string(resMatch)), nil)
 			if err != nil {
 				continue
 			}
+			req.Header.Add("Content-Type", "application/json")
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/restpackhtmltopdfapi/restpackhtmltopdfapi.go

@@ -1,10 +1,10 @@
 package restpackhtmltopdfapi
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -23,27 +23,23 @@ var (
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"restpack"}) + `\b([0-9A-Za-z]{48})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"restpack"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("restpack")}
 }
 
-// FromData will find and optionally verify RestpackHtmlToPdfAPI secrets in a given set of bytes.
-func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) ([]detectors.Result, error) {
+	var results []detectors.Result
 
+	matches := keyPat.FindAllSubmatch(data, -1)
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_RestpackHtmlToPdfAPI,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,14 +48,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("X-Access-Token", resMatch)
+			req.Header.Add("X-Access-Token", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/restpackscreenshotapi/restpackscreenshotapi.go

@@ -1,10 +1,10 @@
 package restpackscreenshotapi
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,37 +13,30 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"restpack"}) + `\b([0-9A-Za-z]{48})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"restpack"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("restpack")}
 }
 
-// FromData will find and optionally verify RestpackScreenshotAPI secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_RestpackScreenshotAPI,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,14 +45,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Content-Type", "application/json")
-			req.Header.Add("X-Access-Token", resMatch)
+			req.Header.Add("X-Access-Token", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/rev/rev.go

@@ -1,11 +1,11 @@
 package rev
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,45 +14,38 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
-
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	userKeyPat   = regexp.MustCompile(detectors.PrefixRegex([]string{"rev"}) + `\b([0-9a-zA-Z\/\+]{27}\=[ \r\n]{1})`)
 	clientKeyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"rev"}) + `\b([0-9a-zA-Z\-]{27}[ \r\n]{1})`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rev"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rev")}
 }
 
-// FromData will find and optionally verify Rev secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	userMatches := userKeyPat.FindAllStringSubmatch(dataStr, -1)
-	clientMatches := clientKeyPat.FindAllStringSubmatch(dataStr, -1)
+	userMatches := userKeyPat.FindAllSubmatch(data, -1)
+	clientMatches := clientKeyPat.FindAllSubmatch(data, -1)
 
 	for _, userMatch := range userMatches {
 		if len(userMatch) != 2 {
 			continue
 		}
-		resUserMatch := strings.TrimSpace(userMatch[1])
+		resUserMatch := bytes.TrimSpace(userMatch[1])
 
 		for _, clientMatch := range clientMatches {
 			if len(clientMatch) != 2 {
 				continue
 			}
-			resClientMatch := strings.TrimSpace(clientMatch[1])
+			resClientMatch := bytes.TrimSpace(clientMatch[1])
 
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Rev,
-				Raw:          []byte(resUserMatch),
+				Raw:          resUserMatch,
 			}
 
 			if verify {
@@ -60,14 +53,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.Header.Add("Authorization", fmt.Sprintf("Rev %s:%s", resClientMatch, resUserMatch))
+				req.Header.Add("Authorization", fmt.Sprintf("Rev %s:%s", string(resClientMatch), string(resUserMatch)))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resUserMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}

pkg/detectors/revampcrm/revampcrm.go

@@ -1,10 +1,10 @@
 package revampcrm
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,71 +13,61 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"revamp"}) + `\b([a-zA-Z0-9]{40}\b)`)
-	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"revamp"}) + `\b([a-zA-Z0-9.-@]{25,30})\b`)
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"revamp"}) + `(b[a-zA-Z0-9]{40}\b)`)
+	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"revamp"}) + `\b([a-zA-Z0-9.@-]{25,30})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"revampcrm"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("revampcrm")}
 }
 
-// FromData will find and optionally verify RevampCRM secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	idMatches := idPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		tokenPatMatch := strings.TrimSpace(match[1])
+
+		tokenPatMatch := bytes.TrimSpace(match[1])
 
 		for _, idMatch := range idMatches {
 			if len(idMatch) != 2 {
 				continue
 			}
 
-			userPatMatch := strings.TrimSpace(idMatch[1])
+			userPatMatch := bytes.TrimSpace(idMatch[1])
 
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_RevampCRM,
-				Raw:          []byte(tokenPatMatch),
+				Raw:          tokenPatMatch,
 			}
 			if verify {
 				req, err := http.NewRequestWithContext(ctx, "GET", "https://app.revampcrm.com/api/1.0/User/WhoAmI", nil)
 				if err != nil {
 					continue
 				}
-				req.SetBasicAuth(userPatMatch, tokenPatMatch)
+				req.SetBasicAuth(string(userPatMatch), string(tokenPatMatch))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(tokenPatMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}
 				}
 			}
-
 			results = append(results, s1)
 		}
 	}
-
 	return results, nil
 }
 

pkg/detectors/ringcentral/ringcentral.go

@@ -1,11 +1,11 @@
 package ringcentral
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,48 +14,41 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ringcentral"}) + `\b([0-9A-Za-z_-]{22})\b`)
 	uriPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ringcentral"}) + `\b(https://www.[0-9A-Za-z_-]{1,}.com)\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"ringcentral"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("ringcentral")}
 }
 
-// FromData will find and optionally verify Ringcentral secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	uriMatches := uriPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	uriMatches := uriPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		for _, uriMatch := range uriMatches {
 			if len(uriMatch) != 2 {
 				continue
 			}
-			resURI := strings.TrimSpace(uriMatch[1])
+			resURI := bytes.TrimSpace(uriMatch[1])
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_RingCentral,
-				Raw:          []byte(resMatch),
+				Raw:          resMatch,
 			}
 
 			if verify {
-				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://platform.devtest.ringcentral.com/restapi/oauth/authorize?response_type=code&redirect_uri=%s&client_id=%s", resURI, resMatch), nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://platform.devtest.ringcentral.com/restapi/oauth/authorize?response_type=code&redirect_uri=%s&client_id=%s", string(resURI), string(resMatch)), nil)
 				if err != nil {
 					continue
 				}
@@ -66,7 +59,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}

pkg/detectors/ritekit/ritekit.go

@@ -1,11 +1,11 @@
 package ritekit
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -19,36 +19,29 @@ var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ritekit"}) + `\b([0-9a-f]{44})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"ritekit"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("ritekit")}
 }
 
-// FromData will find and optionally verify RiteKit secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_RiteKit,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.ritekit.com/v1/stats/multiple-hashtags?tags=hello&client_id=%s", resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.ritekit.com/v1/stats/multiple-hashtags?tags=hello&client_id=%s", string(resMatch)), nil)
 			if err != nil {
 				continue
 			}
@@ -58,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/roaring/roaring.go

@@ -1,12 +1,12 @@
 package roaring
 
 import (
+	"bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,64 +15,57 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	clientPat = regexp.MustCompile(detectors.PrefixRegex([]string{"roaring"}) + `\b([0-9A-Za-z_-]{28})\b`)
 	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"roaring"}) + `\b([0-9A-Za-z_-]{28})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"roaring"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("roaring")}
 }
 
-// FromData will find and optionally verify Roaring secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	clientMatches := clientPat.FindAllStringSubmatch(dataStr, -1)
-	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)
+	clientMatches := clientPat.FindAllSubmatch(data, -1)
+	secretMatches := secretPat.FindAllSubmatch(data, -1)
 
 	for _, clientMatch := range clientMatches {
 		if len(clientMatch) != 2 {
 			continue
 		}
-		resClient := strings.TrimSpace(clientMatch[1])
+		resClient := bytes.TrimSpace(clientMatch[1])
 
 		for _, secretMatch := range secretMatches {
 			if len(secretMatch) != 2 {
 				continue
 			}
-			resSecret := strings.TrimSpace(secretMatch[1])
+			resSecret := bytes.TrimSpace(secretMatch[1])
 
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_Roaring,
-				Raw:          []byte(resClient),
-				RawV2:        []byte(resClient + resSecret),
+				Raw:          resClient,
+				RawV2:        append(resClient, resSecret...),
 			}
 
 			if verify {
-				data := fmt.Sprintf("%s:%s", resClient, resSecret)
-				sEnc := b64.StdEncoding.EncodeToString([]byte(data))
-				payload := strings.NewReader("grant_type=client_credentials")
+				data := append(resClient, []byte(":")...)
+				data = append(data, resSecret...)
+				sEnc := b64.StdEncoding.EncodeToString(data)
+				payload := bytes.NewBuffer([]byte("grant_type=client_credentials"))
 				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.roaring.io/token", payload)
 				if err != nil {
 					continue
 				}
 				req.Header.Add("Authorization", fmt.Sprintf("Basic %s", sEnc))
 				res, err := client.Do(req)
-				if err == nil {
+				if err == nil && res != nil {
 					defer res.Body.Close()
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resSecret, detectors.DefaultFalsePositives, true) {
 							continue
 						}

pkg/detectors/rocketreach/rocketreach.go

@@ -1,10 +1,10 @@
 package rocketreach
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,25 +25,23 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rocketreach"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rocketreach")}
 }
 
 // FromData will find and optionally verify RocketReach secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_RocketReach,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -51,14 +49,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Api-Key", resMatch)
+			req.Header.Add("Api-Key", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/rockset/rockset.go

@@ -1,11 +1,11 @@
 package rockset
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,25 +26,23 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rockset"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rockset")}
 }
 
 // FromData will find and optionally verify Rockset secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Rockset,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,14 +50,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("ApiKey %s", resMatch))
+			req.Header.Add("Authorization", fmt.Sprintf("ApiKey %s", string(resMatch)))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/roninapp/roninapp.go

@@ -2,12 +2,10 @@ package roninapp
 
 import (
 	"context"
-	"fmt"
-	"regexp"
-	"strings"
-
 	b64 "encoding/base64"
+	"fmt"
 	"net/http"
+	"regexp"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -16,50 +14,43 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"ronin"}) + `\b([0-9a-zA-Z]{26})\b`)
 	idPat  = regexp.MustCompile(detectors.PrefixRegex([]string{"ronin"}) + `\b([0-9Aa-zA-Z]{3,32})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"roninapp"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("roninapp")}
 }
 
-// FromData will find and optionally verify RoninApp secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	idmatches := idPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	idmatches := idPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := match[1]
 
 		for _, idmatch := range idmatches {
 			if len(idmatch) != 2 {
 				continue
 			}
-			resIdMatch := strings.TrimSpace(idmatch[1])
+			resIdMatch := idmatch[1]
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_RoninApp,
-				Raw:          []byte(resMatch),
+				Raw:          resMatch,
 			}
 
 			if verify {
 				data := fmt.Sprintf("%s:", resMatch)
 				sEnc := b64.StdEncoding.EncodeToString([]byte(data))
-				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+resIdMatch+".roninapp.com/api/v2/invoices", nil)
+				req, err := http.NewRequestWithContext(ctx, "GET", "https://"+string(resIdMatch)+".roninapp.com/api/v2/invoices", nil)
 				if err != nil {
 					continue
 				}
@@ -71,7 +62,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
@@ -81,7 +71,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 
 			results = append(results, s1)
 		}
-
 	}
 
 	return results, nil

pkg/detectors/route4me/route4me.go

@@ -1,10 +1,11 @@
 package route4me
 
 import (
+	"bytes"
 	"context"
+	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,41 +14,35 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"route4me"}) + `\b([0-9A-Z]{32})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"route4me"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("route4me")}
 }
 
-// FromData will find and optionally verify Route4me secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Route4me,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.route4me.com/api.v4/address_book.php?api_key="+resMatch, nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.route4me.com/api.v4/address_book.php?api_key=%s", string(resMatch)), nil)
 			if err != nil {
 				continue
 			}
@@ -57,7 +52,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/rownd/rownd.go

@@ -1,10 +1,10 @@
 package rownd
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,84 +13,71 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
-	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
+	client    = common.SaneHttpClient()
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"rownd"}) + `\b([a-z0-9]{8}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{12})\b`)
 	secretPat = regexp.MustCompile(detectors.PrefixRegex([]string{"rownd"}) + `\b([a-z0-9]{48})\b`)
 	idPat     = regexp.MustCompile(detectors.PrefixRegex([]string{"rownd"}) + `\b([0-9]{18})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rownd"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rownd")}
 }
 
-// FromData will find and optionally verify Rownd secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)
-	keyMatches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	secretMatches := secretPat.FindAllStringSubmatch(dataStr, -1)
+	idMatches := idPat.FindAllSubmatch(data, -1)
+	keyMatches := keyPat.FindAllSubmatch(data, -1)
+	secretMatches := secretPat.FindAllSubmatch(data, -1)
 
 	for _, idMatch := range idMatches {
 		if len(idMatch) != 2 {
 			continue
 		}
-		resId := strings.TrimSpace(idMatch[1])
+		resId := bytes.TrimSpace(idMatch[1])
 
 		for _, match := range keyMatches {
 			if len(match) != 2 {
 				continue
 			}
-			keyMatch := strings.TrimSpace(match[1])
+			keyMatch := bytes.TrimSpace(match[1])
 
 			for _, secret := range secretMatches {
 				if len(secret) != 2 {
 					continue
 				}
-
-				secretMatch := strings.TrimSpace(secret[1])
+				secretMatch := bytes.TrimSpace(secret[1])
 
 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_Rownd,
-					Raw:          []byte(keyMatch),
-					RawV2:        []byte(keyMatch + secretMatch),
+					Raw:          keyMatch,
+					RawV2:        append(keyMatch, secretMatch...),
 				}
 
 				if verify {
-
-					req, err := http.NewRequestWithContext(ctx, "GET", "https://api.rownd.io/applications/"+resId+"/users/data", nil)
+					req, err := http.NewRequestWithContext(ctx, "GET", "https://api.rownd.io/applications/"+string(resId)+"/users/data", nil)
 					if err != nil {
 						continue
 					}
-					req.Header.Add("x-rownd-app-key", keyMatch)
-					req.Header.Add("x-rownd-app-secret", secretMatch)
+					req.Header.Add("x-rownd-app-key", string(keyMatch))
+					req.Header.Add("x-rownd-app-secret", string(secretMatch))
 					res, err := client.Do(req)
 					if err == nil {
 						defer res.Body.Close()
 						if res.StatusCode >= 200 && res.StatusCode < 300 {
 							s1.Verified = true
 						} else {
-							// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 							if detectors.IsKnownFalsePositive(keyMatch, detectors.DefaultFalsePositives, true) {
 								continue
 							}
 						}
 					}
 				}
-
 				results = append(results, s1)
 			}
 		}
 	}
-
 	return results, nil
 }
 

pkg/detectors/rubygems/rubygems.go

@@ -1,10 +1,10 @@
 package rubygems
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,37 +13,29 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`\b(rubygems_[a-zA0-9]{48})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"rubygems"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("rubygems")}
 }
 
-// FromData will find and optionally verify RubyGems secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_RubyGems,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,18 +44,15 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Accept", "*/*")
-			req.Header.Add("Authorization", resMatch)
+			req.Header.Add("Authorization", string(resMatch))
 			res, err := client.Do(req)
-			if err == nil {
-				defer res.Body.Close()
-				if res.StatusCode >= 200 && res.StatusCode < 300 {
-					s1.Verified = true
-				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
-					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-						continue
-					}
+			if err != nil || res.StatusCode < 200 || res.StatusCode >= 300 {
+				if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+					continue
 				}
+			} else {
+				defer res.Body.Close()
+				s1.Verified = true
 			}
 		}
 

pkg/detectors/runrunit/runrunit.go

@@ -1,10 +1,10 @@
 package runrunit
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,45 +13,40 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat       = regexp.MustCompile(detectors.PrefixRegex([]string{"runrunit"}) + `\b([0-9a-f]{32})\b`)
 	userTokenPat = regexp.MustCompile(detectors.PrefixRegex([]string{"runrunit"}) + `\b([0-9A-Za-z]{18,20})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"runrunit"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("runrunit")}
 }
 
-// FromData will find and optionally verify RunRunIt secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	userTokenMatches := userTokenPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	userTokenMatches := userTokenPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+
+		resMatch := bytes.TrimSpace(match[1])
 
 		for _, userTokenMatch := range userTokenMatches {
 			if len(userTokenMatch) != 2 {
 				continue
 			}
-			resUserTokenMatch := strings.TrimSpace(userTokenMatch[1])
+
+			resUserTokenMatch := bytes.TrimSpace(userTokenMatch[1])
 
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_RunRunIt,
-				Raw:          []byte(resMatch),
+				Raw:          resMatch,
 			}
 
 			if verify {
@@ -59,20 +54,17 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				req.Header.Add("App-Key", resMatch)
-				req.Header.Add("User-Token", resUserTokenMatch)
+
+				req.Header.Add("App-Key", string(resMatch))
+				req.Header.Add("User-Token", string(resUserTokenMatch))
 				res, err := client.Do(req)
 				if err == nil {
 					defer res.Body.Close()
+
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
-						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-							continue
-						}
-
-						if detectors.IsKnownFalsePositive(resUserTokenMatch, detectors.DefaultFalsePositives, true) {
+						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) || detectors.IsKnownFalsePositive(resUserTokenMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}
 					}