reworked to apply docker identification in handlers.go

.github/workflows/lint.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v4
         with:
-          go-version: '1.21'
+          go-version: '1.20'
       - uses: actions/checkout@v3
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3

.github/workflows/performance.yml

@@ -1,4 +1,4 @@
-name: Performance Test
+name: Performance Test 
 
 on: [pull_request]
 
@@ -7,13 +7,13 @@ jobs:
     #   skip if PR is from a fork.
     # TODO: this could probabaly be refactored a bit so that it runs on forks
     if: ${{ ! github.event.pull_request.head.repo.fork }}
-
+    
     runs-on: ubuntu-latest
     steps:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
 
     - name: Checkout code
       uses: actions/checkout@v3

.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.21'
+          go-version: '1.20'
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v4
         with:

.github/workflows/secrets.yml

@@ -16,7 +16,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
     - name: Checkout code
       uses: actions/checkout@v3
       with:

.github/workflows/smoke.yml

@@ -11,7 +11,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
     - name: Checkout code
       uses: actions/checkout@v3
     - name: Smoke

.github/workflows/snifftest.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v4
         with:
-          go-version: '1.21'
+          go-version: '1.20'
       - uses: actions/checkout@v3
       - name: Run Snifftest
-        run: make snifftest
+        run: make snifftest

.github/workflows/test.yml

@@ -21,7 +21,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
     - name: Checkout code
       uses: actions/checkout@v3
     - id: 'auth'
@@ -42,7 +42,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
     - name: Checkout code
       uses: actions/checkout@v3
     - id: 'auth'
@@ -63,7 +63,7 @@ jobs:
     - name: Install Go
       uses: actions/setup-go@v4
       with:
-        go-version: '1.21'
+        go-version: '1.20'
     - name: Checkout code
       uses: actions/checkout@v3
     - name: Test

pkg/detectors/alchemy/alchemy_test.go

@@ -133,7 +133,7 @@ func TestAlchemy_FromChunk(t *testing.T) {
 					t.Fatalf("no raw secret present: \n %+v", got[i])
 				}
 				if (got[i].VerificationError != nil) != tt.wantVerificationErr {
-					t.Fatalf("wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError)
+					t.Fatalf(" wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError)
 				}
 			}
 			ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "VerificationError")

pkg/detectors/huggingface/huggingface.go

@@ -1,91 +0,0 @@
-package huggingface
-
-import (
-	"context"
-	"fmt"
-	"net/http"
-	"regexp"
-	"strings"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
-)
-
-type Scanner struct {
-	client *http.Client
-}
-
-// Ensure the Scanner satisfies the interface at compile time.
-var _ detectors.Detector = (*Scanner)(nil)
-
-var (
-	defaultClient = common.SaneHttpClient()
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
-	keyPat = regexp.MustCompile(`\bhf_[a-zA-Z]{34}\b`)
-)
-
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"huggingface", "hugging_face", "hf"} // Huggingface docs occasionally use "hf" instead of "huggingface"
-}
-
-// FromData will find and optionally verify Huggingface secrets in a given set of bytes.
-func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-
-	for _, match := range matches {
-		if len(match) != 1 {
-			continue
-		}
-		resMatch := strings.TrimSpace(match[0])
-
-		s1 := detectors.Result{
-			DetectorType: detectorspb.DetectorType_HuggingFace,
-			Raw:          []byte(resMatch),
-		}
-
-		if verify {
-			client := s.client
-			if client == nil {
-				client = defaultClient
-			}
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://huggingface.co/api/whoami-v2", nil)
-			if err != nil {
-				continue
-			}
-
-			req.Header.Set("Authorization", "Bearer "+resMatch)
-
-			res, err := client.Do(req)
-			if err == nil {
-				defer res.Body.Close()
-				if res.StatusCode >= 200 && res.StatusCode < 300 {
-					s1.Verified = true
-				} else if res.StatusCode == 401 {
-					// The secret is determinately not verified (nothing to do)
-				} else {
-					s1.VerificationError = fmt.Errorf("unexpected HTTP response status %d", res.StatusCode)
-				}
-			} else {
-				s1.VerificationError = err
-			}
-		}
-
-		// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
-		if !s1.Verified && detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-			continue
-		}
-
-		results = append(results, s1)
-	}
-
-	return results, nil
-}
-
-func (s Scanner) Type() detectorspb.DetectorType {
-	return detectorspb.DetectorType_HuggingFace
-}

pkg/detectors/huggingface/huggingface_test.go

@@ -1,160 +0,0 @@
-//go:build detectors
-// +build detectors
-
-package huggingface
-
-import (
-	"context"
-	"fmt"
-	"github.com/google/go-cmp/cmp"
-	"github.com/google/go-cmp/cmp/cmpopts"
-	"testing"
-	"time"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
-
-	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
-	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/detectorspb"
-)
-
-func TestHuggingface_FromChunk(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
-	defer cancel()
-	testSecrets, err := common.GetSecret(ctx, "trufflehog-testing", "detectors5")
-	if err != nil {
-		t.Fatalf("could not get test secrets from GCP: %s", err)
-	}
-	secret := testSecrets.MustGetField("HUGGINGFACE")
-	inactiveSecret := testSecrets.MustGetField("HUGGINGFACE_INACTIVE")
-
-	type args struct {
-		ctx    context.Context
-		data   []byte
-		verify bool
-	}
-	tests := []struct {
-		name                string
-		s                   Scanner
-		args                args
-		want                []detectors.Result
-		wantErr             bool
-		wantVerificationErr bool
-	}{
-		{
-			name: "found, verified",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a huggingface secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_HuggingFace,
-					Verified:     true,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "found, unverified",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a huggingface secret %s within but not valid", inactiveSecret)), // the secret would satisfy the regex but not pass validation
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_HuggingFace,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "not found",
-			s:    Scanner{},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte("You cannot find the secret within"),
-				verify: true,
-			},
-			want:                nil,
-			wantErr:             false,
-			wantVerificationErr: false,
-		},
-		{
-			name: "found, would be verified if not for timeout",
-			s:    Scanner{client: common.SaneHttpClientTimeOut(1 * time.Microsecond)},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a huggingface secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_HuggingFace,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: true,
-		},
-		{
-			name: "found, verified but unexpected api surface",
-			s:    Scanner{client: common.ConstantResponseHttpClient(404, "")},
-			args: args{
-				ctx:    context.Background(),
-				data:   []byte(fmt.Sprintf("You can find a huggingface secret %s within", secret)),
-				verify: true,
-			},
-			want: []detectors.Result{
-				{
-					DetectorType: detectorspb.DetectorType_HuggingFace,
-					Verified:     false,
-				},
-			},
-			wantErr:             false,
-			wantVerificationErr: true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := tt.s.FromData(tt.args.ctx, tt.args.verify, tt.args.data)
-			if (err != nil) != tt.wantErr {
-				t.Errorf("Huggingface.FromData() error = %v, wantErr %v", err, tt.wantErr)
-				return
-			}
-			for i := range got {
-				if len(got[i].Raw) == 0 {
-					t.Fatalf("no raw secret present: \n %+v", got[i])
-				}
-				if (got[i].VerificationError != nil) != tt.wantVerificationErr {
-					t.Fatalf(" wantVerificationError = %v, verification error = %v", tt.wantVerificationErr, got[i].VerificationError)
-				}
-			}
-			ignoreOpts := cmpopts.IgnoreFields(detectors.Result{}, "Raw", "VerificationError")
-			if diff := cmp.Diff(got, tt.want, ignoreOpts); diff != "" {
-				t.Errorf("Huggingface.FromData() %s diff: (-got +want)\n%s", tt.name, diff)
-			}
-		})
-	}
-}
-
-func BenchmarkFromData(benchmark *testing.B) {
-	ctx := context.Background()
-	s := Scanner{}
-	for name, data := range detectors.MustGetBenchmarkData() {
-		benchmark.Run(name, func(b *testing.B) {
-			for n := 0; n < b.N; n++ {
-				_, err := s.FromData(ctx, false, data)
-				if err != nil {
-					b.Fatal(err)
-				}
-			}
-		})
-	}
-}

pkg/detectors/launchdarkly/launchdarkly.go

@@ -20,13 +20,13 @@ var (
 	client = common.SaneHttpClient()
 
 	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
-	keyPat = regexp.MustCompile(`\b((?:api|sdk|mob)-[a-z0-9]{8}-[a-z0-9]{4}-4[a-z0-9]{3}-[a-z0-9]{4}-[a-z0-9]{12})\b`)
+	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"launchdarkly", "launch_darkly"}) + `\b([a-z0-9-]{40})\b`)
 )
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
 func (s Scanner) Keywords() []string {
-	return []string{"api", "sdk", "mob"}
+	return []string{"launchdarkly", "launch_darkly"}
 }
 
 // FromData will find and optionally verify LaunchDarkly secrets in a given set of bytes.

pkg/detectors/opsgenie/opsgenie.go

@@ -52,7 +52,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.opsgenie.com/v2/alerts", nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.opsgenie.com/v2/users", nil)
 			if err != nil {
 				continue
 			}

pkg/engine/engine.go

@@ -595,20 +595,17 @@ func SupportsLineNumbers(sourceType sourcespb.SourceType) bool {
 
 // FragmentLineOffset sets the line number for a provided source chunk with a given detector result.
 func FragmentLineOffset(chunk *sources.Chunk, result *detectors.Result) (int64, bool) {
-	before, after, found := bytes.Cut(chunk.Data, result.Raw)
-	if !found {
-		return 0, false
+	lines := bytes.Split(chunk.Data, []byte("\n"))
+	for i, line := range lines {
+		if bytes.Contains(line, result.Raw) {
+			// if the line contains the ignore tag, we should ignore the result
+			if bytes.Contains(line, []byte(ignoreTag)) {
+				return int64(i), true
+			}
+			return int64(i), false
+		}
 	}
-	lineNumber := int64(bytes.Count(before, []byte("\n")))
-	// If the line contains the ignore tag, we should ignore the result.
-	endLine := bytes.Index(after, []byte("\n"))
-	if endLine == -1 {
-		endLine = len(after)
-	}
-	if bytes.Contains(after[:endLine], []byte(ignoreTag)) {
-		return lineNumber, true
-	}
-	return lineNumber, false
+	return 0, false
 }
 
 // FragmentFirstLine returns the first line number of a fragment along with a pointer to the value to update in the

pkg/engine/engine_test.go

@@ -1,7 +1,6 @@
 package engine
 
 import (
-	"fmt"
 	"testing"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/decoders"
@@ -51,39 +50,6 @@ func TestFragmentLineOffset(t *testing.T) {
 			expectedLine: 4,
 			ignore:       false,
 		},
-		{
-			name: "match on consecutive lines",
-			chunk: &sources.Chunk{
-				Data: []byte("line1\nline2\ntrufflehog:ignore\nline4\nsecret\nhere\nline6"),
-			},
-			result: &detectors.Result{
-				Raw: []byte("secret\nhere"),
-			},
-			expectedLine: 4,
-			ignore:       false,
-		},
-		{
-			name: "ignore on last consecutive lines",
-			chunk: &sources.Chunk{
-				Data: []byte("line1\nline2\nline3\nsecret\nhere // trufflehog:ignore\nline5"),
-			},
-			result: &detectors.Result{
-				Raw: []byte("secret\nhere"),
-			},
-			expectedLine: 3,
-			ignore:       true,
-		},
-		{
-			name: "ignore on last line",
-			chunk: &sources.Chunk{
-				Data: []byte("line1\nline2\nline3\nsecret here // trufflehog:ignore"),
-			},
-			result: &detectors.Result{
-				Raw: []byte("secret here"),
-			},
-			expectedLine: 3,
-			ignore:       true,
-		},
 	}
 
 	for _, tt := range tests {
@@ -99,43 +65,6 @@ func TestFragmentLineOffset(t *testing.T) {
 	}
 }
 
-func setupFragmentLineOffsetBench(totalLines, needleLine int) (*sources.Chunk, *detectors.Result) {
-	data := make([]byte, 0, 4096)
-	needle := []byte("needle")
-	for i := 0; i < totalLines; i++ {
-		if i != needleLine {
-			data = append(data, []byte(fmt.Sprintf("line%d\n", i))...)
-			continue
-		}
-		data = append(data, needle...)
-		data = append(data, '\n')
-	}
-	chunk := &sources.Chunk{Data: data}
-	result := &detectors.Result{Raw: needle}
-	return chunk, result
-}
-
-func BenchmarkFragmentLineOffsetStart(b *testing.B) {
-	chunk, result := setupFragmentLineOffsetBench(512, 2)
-	for i := 0; i < b.N; i++ {
-		_, _ = FragmentLineOffset(chunk, result)
-	}
-}
-
-func BenchmarkFragmentLineOffsetMiddle(b *testing.B) {
-	chunk, result := setupFragmentLineOffsetBench(512, 256)
-	for i := 0; i < b.N; i++ {
-		_, _ = FragmentLineOffset(chunk, result)
-	}
-}
-
-func BenchmarkFragmentLineOffsetEnd(b *testing.B) {
-	chunk, result := setupFragmentLineOffsetBench(512, 510)
-	for i := 0; i < b.N; i++ {
-		_, _ = FragmentLineOffset(chunk, result)
-	}
-}
-
 // Test to make sure that DefaultDecoders always returns the UTF8 decoder first.
 // Technically a decoder test but we want this to run and fail in CI
 func TestDefaultDecoders(t *testing.T) {

pkg/handlers/handlers.go

@@ -1,10 +1,20 @@
 package handlers
 
 import (
+	"archive/tar"
 	"context"
+	"fmt"
 	"io"
+	"math/rand"
+	"os"
+	"runtime"
 
+	"github.com/google/go-containerregistry/pkg/v1/tarball"
+	context2 "github.com/trufflesecurity/trufflehog/v3/pkg/context"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/pb/sourcespb"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/sources"
+	"github.com/trufflesecurity/trufflehog/v3/pkg/sources/docker"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 func DefaultHandlers() []Handler {
@@ -19,8 +29,8 @@ type Handler interface {
 	New()
 }
 
-func HandleFile(ctx context.Context, file io.Reader, chunkSkel *sources.Chunk, chunksChan chan (*sources.Chunk)) bool {
-	// Find a handler for this file.
+func HandleFile(ctx context2.Context, file io.Reader, chunkSkel *sources.Chunk, chunksChan chan (*sources.Chunk)) bool {
+
 	var handler Handler
 	for _, h := range DefaultHandlers() {
 		h.New()
@@ -34,6 +44,34 @@ func HandleFile(ctx context.Context, file io.Reader, chunkSkel *sources.Chunk, c
 		return false
 	}
 
+	if IsReaderTarball(ctx, file) {
+		isDocker, path := IsDockerImage(ctx, file)
+		if isDocker {
+			// if docker image then run
+			ctx.logger.V(3).Info("Docker image detected in tarball: " + path)
+			//scan with docker scanner
+			dockerConn := sourcespb.Docker{
+				Images: []string{"file://" + path},
+				Credential: &sourcespb.Docker_DockerKeychain{
+					DockerKeychain: true,
+				},
+			}
+			anyConn, err := anypb.New(&dockerConn)
+			if err != nil {
+				ctx.logger.V(3).Info("error marshalling Docker connection", "error", err)
+			}
+			dockerSource := docker.Source{}
+			if err := dockerSource.Init(ctx, "trufflehog - docker", 0, chunkSkel.SourceID, chunkSkel.Verify, anyConn, runtime.NumCPU()); err != nil {
+				// will need to pas this in later s.jobId
+				return false
+			}
+			if err := dockerSource.Chunks(ctx, chunksChan); err != nil {
+				return false
+			}
+			return true
+		}
+	}
+
 	// Process the file and read all []byte chunks from handlerChan.
 	handlerChan := handler.FromFile(ctx, file)
 	for {
@@ -56,3 +94,38 @@ func HandleFile(ctx context.Context, file io.Reader, chunkSkel *sources.Chunk, c
 		}
 	}
 }
+
+func IsReaderTarball(ctx context2.Context, reader io.Reader) bool {
+	// Check if file is a tarball, if so, check if it is a Docker image.
+	_, err := tar.NewReader(reader).Next()
+	if err != nil {
+		return false
+	}
+	return true
+}
+
+func IsDockerImage(ctx context2.Context, file io.Reader) (isDocker bool, tmpFilename string) {
+	// Generate a random name for the temporary file.
+	tmpFilename = fmt.Sprintf("%s/temp_%d.tar", os.TempDir(), rand.Int())
+
+	// Create a temporary file to write image data from ReadCloser.
+	tmpFile, err := os.Create(tmpFilename)
+	if err != nil {
+		fmt.Printf("Error creating temporary file: %s\n", err)
+		return false, ""
+	}
+	defer os.Remove(tmpFilename)
+
+	// Copy data from ReadCloser to the temporary file.
+	if _, err := io.Copy(tmpFile, file); err != nil {
+		fmt.Printf("Error copying data to temporary file: %s\n", err)
+		return false, ""
+	}
+	tmpFile.Close()
+
+	_, err = tarball.ImageFromPath(tmpFilename, nil)
+	if err != nil {
+		return false, ""
+	}
+	return true, tmpFilename
+}

pkg/pb/detectorspb/detectors.pb.go

@@ -996,8 +996,6 @@ const (
 	DetectorType_TrufflehogEnterprise          DetectorType = 922
 	DetectorType_EnvoyApiKey                   DetectorType = 923
 	DetectorType_GitHubOauth2                  DetectorType = 924
-	// 925 reserved for Salesforce
-	DetectorType_HuggingFace DetectorType = 926
 )
 
 // Enum value maps for DetectorType.
@@ -1924,7 +1922,6 @@ var (
 		922: "TrufflehogEnterprise",
 		923: "EnvoyApiKey",
 		924: "GitHubOauth2",
-		926: "HuggingFace",
 	}
 	DetectorType_value = map[string]int32{
 		"Alibaba":                       0,
@@ -2848,7 +2845,6 @@ var (
 		"TrufflehogEnterprise":          922,
 		"EnvoyApiKey":                   923,
 		"GitHubOauth2":                  924,
-		"HuggingFace":                   926,
 	}
 )
 
@@ -3227,7 +3223,7 @@ var file_detectors_proto_rawDesc = []byte{
 	0x44, 0x65, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55,
 	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x4c, 0x41, 0x49,
 	0x4e, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x42, 0x41, 0x53, 0x45, 0x36, 0x34, 0x10, 0x02, 0x12,
-	0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x2a, 0xeb, 0x73, 0x0a, 0x0c, 0x44,
+	0x09, 0x0a, 0x05, 0x55, 0x54, 0x46, 0x31, 0x36, 0x10, 0x03, 0x2a, 0xd9, 0x73, 0x0a, 0x0c, 0x44,
 	0x65, 0x74, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x41,
 	0x6c, 0x69, 0x62, 0x61, 0x62, 0x61, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x4d, 0x51, 0x50,
 	0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x57, 0x53, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x41,
@@ -4153,12 +4149,11 @@ var file_detectors_proto_rawDesc = []byte{
 	0x65, 0x68, 0x6f, 0x67, 0x45, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x10, 0x9a,
 	0x07, 0x12, 0x10, 0x0a, 0x0b, 0x45, 0x6e, 0x76, 0x6f, 0x79, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79,
 	0x10, 0x9b, 0x07, 0x12, 0x11, 0x0a, 0x0c, 0x47, 0x69, 0x74, 0x48, 0x75, 0x62, 0x4f, 0x61, 0x75,
-	0x74, 0x68, 0x32, 0x10, 0x9c, 0x07, 0x12, 0x10, 0x0a, 0x0b, 0x48, 0x75, 0x67, 0x67, 0x69, 0x6e,
-	0x67, 0x46, 0x61, 0x63, 0x65, 0x10, 0x9e, 0x07, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65,
-	0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f,
-	0x67, 0x2f, 0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65,
-	0x63, 0x74, 0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x74, 0x68, 0x32, 0x10, 0x9c, 0x07, 0x42, 0x3d, 0x5a, 0x3b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x73, 0x65, 0x63, 0x75,
+	0x72, 0x69, 0x74, 0x79, 0x2f, 0x74, 0x72, 0x75, 0x66, 0x66, 0x6c, 0x65, 0x68, 0x6f, 0x67, 0x2f,
+	0x76, 0x33, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x70, 0x62, 0x2f, 0x64, 0x65, 0x74, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x73, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

pkg/tui/sources/github/github.go

@@ -21,7 +21,7 @@ func GetFields() githubCmdModel {
 		Key:         "org",
 		Required:    false,
 		Help:        "GitHub organization to scan.",
-		Placeholder: "trufflesecurity",
+		Placeholder: "https://github.com/trufflesecurity",
 	}
 
 	repo := textinputs.InputConfig{

proto/detectors.proto

@@ -933,8 +933,6 @@ enum DetectorType {
   TrufflehogEnterprise = 922;
   EnvoyApiKey = 923;
   GitHubOauth2 = 924;
-  // 925 reserved for Salesforce
-  HuggingFace = 926;
 }
 
 message Result {