fix.

pkg/detectors/zapierwebhook/zapierwebhook.go

@@ -1,10 +1,10 @@
 package zapierwebhook
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,44 +13,38 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(`(https:\/\/hooks\.zapier\.com\/hooks\/catch\/[A-Za-z0-9\/]{16})`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"hooks.zapier.com/hooks/catch/"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("hooks.zapier.com/hooks/catch/")}
 }
 
-// FromData will find and optionally verify ZapierWebhook secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ZapierWebhook,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "POST", "https://hooks.zapier.com/hooks/catch/"+resMatch, nil)
+			req, err := http.NewRequestWithContext(ctx, "POST", "https://hooks.zapier.com/hooks/catch/"+string(resMatch), nil)
 			if err != nil {
 				continue
 			}
+
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()

pkg/detectors/zendeskapi/zendeskapi.go

@@ -1,12 +1,12 @@
 package zendeskapi
 
 import (
+	"bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,7 +15,6 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
@@ -26,38 +25,33 @@ var (
 	domain = regexp.MustCompile(`\b([a-zA-Z-0-9]{3,16}\.zendesk\.com)\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zendesk"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zendesk")}
 }
 
-// FromData will find and optionally verify ZendeskApi secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	tokens := token.FindAllStringSubmatch(dataStr, -1)
-	domains := domain.FindAllStringSubmatch(dataStr, -1)
-	emails := email.FindAllStringSubmatch(dataStr, -1)
+	tokens := token.FindAllSubmatch(data, -1)
+	domains := domain.FindAllSubmatch(data, -1)
+	emails := email.FindAllSubmatch(data, -1)
 
-	for _, token := range tokens {
-		if len(token) != 2 {
+	for _, matchToken := range tokens {
+		if len(matchToken) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(token[1])
+		resMatch := bytes.TrimSpace(matchToken[1])
 
-		var resDomain string
-		for _, domain := range domains {
-			if len(domain) != 2 {
+		for _, matchDomain := range domains {
+			if len(matchDomain) != 2 {
 				continue
 			}
-			resDomain = strings.TrimSpace(domain[1])
+			resDomain := bytes.TrimSpace(matchDomain[1])
 
-			for _, email := range emails {
-				if len(email) != 2 {
+			for _, matchEmail := range emails {
+				if len(matchEmail) != 2 {
 					continue
 				}
-				resEmail := strings.TrimSpace(email[1])
+				resEmail := bytes.TrimSpace(matchEmail[1])
 
 				if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 					continue
@@ -65,13 +59,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 
 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_ZendeskApi,
-					Raw:          []byte(resMatch),
+					Raw:          resMatch,
 				}
 
 				if verify {
-					data := fmt.Sprintf("%s/token:%s", resEmail, resMatch)
+					data := fmt.Sprintf("%s/token:%s", string(resEmail), string(resMatch))
 					sEnc := b64.StdEncoding.EncodeToString([]byte(data))
-					req, err := http.NewRequestWithContext(ctx, "GET", "https://"+resDomain+"/api/v2/users.json", nil)
+					req, err := http.NewRequestWithContext(ctx, "GET", "https://"+string(resDomain)+"/api/v2/users.json", nil)
 					if err != nil {
 						continue
 					}

pkg/detectors/zenkitapi/zenkitapi.go

@@ -1,10 +1,10 @@
 package zenkitapi
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -25,25 +25,24 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zenkit"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zenkit")}
 }
 
 // FromData will find and optionally verify ZenkitAPI secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ZenkitAPI,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -51,7 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Zenkit-API-Key", resMatch)
+			req.Header.Add("Zenkit-API-Key", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()

pkg/detectors/zenrows/zenrows.go

@@ -1,11 +1,11 @@
 package zenrows
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,41 +14,34 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zenrows"}) + `\b([0-9a-f]{40})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zenrows"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zenrows")}
 }
 
-// FromData will find and optionally verify ZenRows secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ZenRows,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.zenrows.com/v1/?apikey=%s&url=https://httpbin.org/anything", resMatch), nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://api.zenrows.com/v1/?apikey=%s&url=https://httpbin.org/anything", string(resMatch)), nil)
 			if err != nil {
 				continue
 			}
@@ -58,7 +51,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/zenscrape/zenscrape.go

@@ -1,11 +1,11 @@
 package zenscrape
 
 import (
+	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,37 +14,30 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zenscrape"}) + `\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zenscrape"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zenscrape")}
 }
 
-// FromData will find and optionally verify Zenscrape secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Zenscrape,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,7 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("apikey", resMatch)
+			req.Header.Add("apikey", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
@@ -60,9 +53,8 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				if err != nil {
 					continue
 				}
-				body := string(bodyBytes)
 
-				if !strings.Contains(body, "Not enough requests.") {
+				if !bytes.Contains(bodyBytes, []byte("Not enough requests.")) {
 					s1.Verified = true
 				} else {
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {

pkg/detectors/zenserp/zenserp.go

@@ -1,11 +1,11 @@
 package zenserp
 
 import (
+	"bytes"
 	"context"
 	"io"
 	"net/http"
 	"regexp"
-	"strings"
 	"time"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
@@ -27,47 +27,46 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zenserp"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zenserp")}
 }
 
 // FromData will find and optionally verify Zenserp secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Zenserp,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", `https://app.zenserp.com/api/v2/search?q="test"&apikey=`+resMatch, nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", `https://app.zenserp.com/api/v2/search?q="test"&apikey=`+string(resMatch), nil)
 			if err != nil {
 				continue
 			}
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
+
 				bodyBytes, err := io.ReadAll(res.Body)
 				if err != nil {
 					continue
 				}
-				body := string(bodyBytes)
-				if strings.Contains(body, "query") {
+
+				if bytes.Contains(bodyBytes, []byte("query")) {
 					s1.Verified = true
-				} else {
-					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
-						continue
-					}
 				}
 
+				if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
+					continue
+				}
 			}
 		}
 

pkg/detectors/zeplin/zeplin.go

@@ -1,11 +1,11 @@
 package zeplin
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,37 +14,29 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zeplin"}) + `\b([a-zA-Z0-9-.]{350,400})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zeplin"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zeplin")}
 }
 
-// FromData will find and optionally verify Zeplin secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Zeplin,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,14 +44,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", resMatch))
+			req.Header.Add("Authorization", fmt.Sprintf("Bearer %s", string(resMatch)))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/zerobounce/zerobounce.go

@@ -1,6 +1,7 @@
 package zerobounce
 
 import (
+	"bytes"
 	"context"
 	"io"
 	"net/http"
@@ -26,29 +27,26 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zerobounce"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zerobounce")}
 }
 
-// FromData will find and optionally verify Zerobounce secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Zerobounce,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
-			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.zerobounce.net/v1/activity?email=testemail@email.com&api_key="+resMatch, nil)
+			req, err := http.NewRequestWithContext(ctx, "GET", "https://api.zerobounce.net/v1/activity?email=testemail@email.com&api_key="+string(resMatch), nil)
 			if err != nil {
 				continue
 			}

pkg/detectors/zipapi/zipapi.go

@@ -1,12 +1,12 @@
 package zipapi
 
 import (
+	"bytes"
 	"context"
 	b64 "encoding/base64"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -15,57 +15,49 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat   = regexp.MustCompile(detectors.PrefixRegex([]string{"zipapi"}) + `\b([0-9a-z]{32})\b`)
 	emailPat = regexp.MustCompile(`\b([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-z]+)\b`)
 	pwordPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zipapi"}) + `\b([a-zA-Z0-9!=@#$%^]{7,})`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zipapi"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zipapi")}
 }
 
-// FromData will find and optionally verify Zipapi secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	emailMatches := emailPat.FindAllStringSubmatch(dataStr, -1)
-	pwordMatches := pwordPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	emailMatches := emailPat.FindAllSubmatch(data, -1)
+	pwordMatches := pwordPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 		for _, emailMatch := range emailMatches {
 			if len(emailMatch) != 2 {
 				continue
 			}
-			resEmail := strings.TrimSpace(emailMatch[1])
+			resEmail := bytes.TrimSpace(emailMatch[1])
 			for _, pwordMatch := range pwordMatches {
 				if len(pwordMatch) != 2 {
 					continue
 				}
-				resPword := strings.TrimSpace(pwordMatch[1])
-
+				resPword := bytes.TrimSpace(pwordMatch[1])
 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_ZipAPI,
-					Raw:          []byte(resMatch),
+					Raw:          resMatch,
 				}
-
 				if verify {
-					data := fmt.Sprintf("%s:%s", resEmail, resPword)
-					sEnc := b64.StdEncoding.EncodeToString([]byte(data))
-					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://service.zipapi.us/zipcode/90210/?X-API-KEY=%s", resMatch), nil)
+					data := append(resEmail, []byte(":")...)
+					data = append(data, resPword...)
+					sEnc := b64.StdEncoding.EncodeToString(data)
+					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://service.zipapi.us/zipcode/90210/?X-API-KEY=%s", string(resMatch)), nil)
 					if err != nil {
 						continue
 					}
@@ -77,19 +69,16 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						if res.StatusCode >= 200 && res.StatusCode < 300 {
 							s1.Verified = true
 						} else {
-							// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 							if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 								continue
 							}
 						}
 					}
 				}
-
 				results = append(results, s1)
 			}
 		}
 	}
-
 	return results, nil
 }
 

pkg/detectors/zipbooks/zipbooks.go

@@ -1,11 +1,11 @@
 package zipbooks
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,48 +14,41 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	emailPat = regexp.MustCompile(`\b([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-z]+)\b`)
-	pwordPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zipbooks", "password"}) + `\b([a-zA-Z0-9!=@#$%^]{8,})`)
+	pwordPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zipbooks", "password"}) + `\b([a-zA-Z0-9!=@#$%^]{8,})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zipbooks"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zipbooks")}
 }
 
-// FromData will find and optionally verify Zipbooks secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
+	emailMatches := emailPat.FindAllSubmatch(data, -1)
+	pwordMatches := pwordPat.FindAllSubmatch(data, -1)
 
-	matches := emailPat.FindAllStringSubmatch(dataStr, -1)
-	pwordMatches := pwordPat.FindAllStringSubmatch(dataStr, -1)
-
-	for _, match := range matches {
+	for _, match := range emailMatches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 		for _, pwordMatch := range pwordMatches {
 			if len(pwordMatch) != 2 {
 				continue
 			}
-			resPword := strings.TrimSpace(pwordMatch[1])
+			resPword := bytes.TrimSpace(pwordMatch[1])
 
 			s1 := detectors.Result{
 				DetectorType: detectorspb.DetectorType_ZipBooks,
-				Raw:          []byte(resMatch),
+				Raw:          resMatch,
 			}
 
 			if verify {
-				payload := strings.NewReader(fmt.Sprintf(`{"email": "%s", "password": "%s"}`, resMatch, resPword))
+				payload := bytes.NewReader([]byte(fmt.Sprintf(`{"email": "%s", "password": "%s"}`, string(resMatch), string(resPword))))
 				req, err := http.NewRequestWithContext(ctx, "POST", "https://api.zipbooks.com/v2/auth/login", payload)
 				if err != nil {
 					continue
@@ -67,7 +60,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					if res.StatusCode >= 200 && res.StatusCode < 300 {
 						s1.Verified = true
 					} else {
-						// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 						if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 							continue
 						}

pkg/detectors/zipcodeapi/zipcodeapi.go

@@ -1,11 +1,11 @@
 package zipcodeapi
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -26,25 +26,24 @@ var (
 
 // Keywords are used for efficiently pre-filtering chunks.
 // Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zipcodeapi"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zipcodeapi")}
 }
 
 // FromData will find and optionally verify ZipCodeAPI secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ZipCodeAPI,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {

pkg/detectors/zipcodebase/zipcodebase.go

@@ -1,10 +1,10 @@
 package zipcodebase
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,37 +13,29 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
-
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zipcodebase"}) + `\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zipcodebase"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zipcodebase")}
 }
 
-// FromData will find and optionally verify Zipcodebase secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_Zipcodebase,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -52,14 +44,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				continue
 			}
 			req.Header.Add("Accept", "application/vnd.zipcodebase+json; version=3")
-			req.Header.Add("apikey", resMatch)
+			req.Header.Add("apikey", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/zonkafeedback/zonkafeedback.go

@@ -1,10 +1,10 @@
 package zonkafeedback
 
 import (
+	"bytes"
 	"context"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -13,37 +13,30 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zonka"}) + `\b([A-Za-z0-9]{36})\b`)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zonka"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zonka")}
 }
 
-// FromData will find and optionally verify ZonkaFeedback secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
-
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		s1 := detectors.Result{
 			DetectorType: detectorspb.DetectorType_ZonkaFeedback,
-			Raw:          []byte(resMatch),
+			Raw:          resMatch,
 		}
 
 		if verify {
@@ -51,14 +44,13 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			if err != nil {
 				continue
 			}
-			req.Header.Add("Z-API-TOKEN", resMatch)
+			req.Header.Add("Z-API-TOKEN", string(resMatch))
 			res, err := client.Do(req)
 			if err == nil {
 				defer res.Body.Close()
 				if res.StatusCode >= 200 && res.StatusCode < 300 {
 					s1.Verified = true
 				} else {
-					// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 					if detectors.IsKnownFalsePositive(resMatch, detectors.DefaultFalsePositives, true) {
 						continue
 					}

pkg/detectors/zulipchat/zulipchat.go

@@ -1,11 +1,11 @@
 package zulipchat
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"net/http"
 	"regexp"
-	"strings"
 
 	"github.com/trufflesecurity/trufflehog/v3/pkg/common"
 	"github.com/trufflesecurity/trufflehog/v3/pkg/detectors"
@@ -14,61 +14,55 @@ import (
 
 type Scanner struct{}
 
-// Ensure the Scanner satisfies the interface at compile time.
 var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	client = common.SaneHttpClient()
 
-	// Make sure that your group is surrounded in boundary characters such as below to reduce false positives.
 	keyPat    = regexp.MustCompile(detectors.PrefixRegex([]string{"zulipchat"}) + common.BuildRegex(common.AlphaNumPattern, "", 32))
 	idPat     = regexp.MustCompile(detectors.PrefixRegex([]string{"zulipchat"}) + common.EmailPattern)
 	domainPat = regexp.MustCompile(detectors.PrefixRegex([]string{"zulipchat", "domain"}) + common.SubDomainPattern)
 )
 
-// Keywords are used for efficiently pre-filtering chunks.
-// Use identifiers in the secret preferably, or the provider name.
-func (s Scanner) Keywords() []string {
-	return []string{"zulipchat"}
+func (s Scanner) Keywords() [][]byte {
+	return [][]byte{[]byte("zulipchat")}
 }
 
-// FromData will find and optionally verify ZulipChat secrets in a given set of bytes.
 func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (results []detectors.Result, err error) {
-	dataStr := string(data)
 
-	matches := keyPat.FindAllStringSubmatch(dataStr, -1)
-	idMatches := idPat.FindAllStringSubmatch(dataStr, -1)
-	domainMatches := domainPat.FindAllStringSubmatch(dataStr, -1)
+	matches := keyPat.FindAllSubmatch(data, -1)
+	idMatches := idPat.FindAllSubmatch(data, -1)
+	domainMatches := domainPat.FindAllSubmatch(data, -1)
 
 	for _, match := range matches {
 		if len(match) != 2 {
 			continue
 		}
-		resMatch := strings.TrimSpace(match[1])
+		resMatch := bytes.TrimSpace(match[1])
 
 		for _, idMatch := range idMatches {
-			// getting the last word of the string
-			resIdMatch := strings.TrimSpace(idMatch[0][strings.LastIndex(idMatch[0], " ")+1:])
+
+			resIdMatch := bytes.TrimSpace(idMatch[0][bytes.LastIndex(idMatch[0], []byte(" "))+1:])
 
 			for _, domainMatch := range domainMatches {
 				if len(domainMatch) != 2 {
 					continue
 				}
 
-				resDomainMatch := strings.TrimSpace(domainMatch[1])
+				resDomainMatch := bytes.TrimSpace(domainMatch[1])
 
 				s1 := detectors.Result{
 					DetectorType: detectorspb.DetectorType_ZulipChat,
-					Raw:          []byte(resMatch),
+					Raw:          resMatch,
 				}
 
 				if verify {
-					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://%s.zulipchat.com/api/v1/users", resDomainMatch), nil)
+					req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("https://%s.zulipchat.com/api/v1/users", string(resDomainMatch)), nil)
 					if err != nil {
 						continue
 					}
 					req.Header.Add("Content-Type", "application/json")
-					req.SetBasicAuth(resIdMatch, resMatch)
+					req.SetBasicAuth(string(resIdMatch), string(resMatch))
 					res, err := client.Do(req)
 
 					if err == nil {
@@ -76,7 +70,6 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 						if res.StatusCode >= 200 && res.StatusCode < 300 {
 							s1.Verified = true
 						} else {
-							// This function will check false positives for common test words, but also it will make sure the key appears 'random' enough to be a real key.
 							if detectors.IsKnownFalsePositive(resIdMatch, detectors.DefaultFalsePositives, true) {
 								continue
 							}

pkg/engine/engine.go

@@ -308,18 +308,18 @@ func Start(ctx context.Context, options ...EngineOption) (*Engine, error) {
 
 	// build ahocorasick prefilter for efficient string matching
 	// on keywords
-	keywords := []string{}
+	var keywords [][]byte
 	for _, d := range e.detectors[false] {
 		for _, kw := range d.Keywords() {
-			keywords = append(keywords, strings.ToLower(kw))
+			keywords = append(keywords, bytes.ToLower(kw))
 		}
 	}
 	for _, d := range e.detectors[true] {
 		for _, kw := range d.Keywords() {
-			keywords = append(keywords, strings.ToLower(kw))
+			keywords = append(keywords, bytes.ToLower(kw))
 		}
 	}
-	e.prefilter = *ahocorasick.NewTrieBuilder().AddStrings(keywords).Build()
+	e.prefilter = *ahocorasick.NewTrieBuilder().AddPatterns(keywords).Build()
 
 	ctx.Logger().V(3).Info("loaded decoders", "count", len(e.decoders))
 	ctx.Logger().V(3).Info("loaded detectors",
@@ -466,7 +466,7 @@ func (e *Engine) detectorWorker(ctx context.Context) {
 					for _, detector := range detectorsSet {
 						chunkContainsKeyword := false
 						for _, kw := range detector.Keywords() {
-							if _, ok := matchedKeywords[strings.ToLower(kw)]; ok {
+							if _, ok := matchedKeywords[strings.ToLower(string(kw))]; ok {
 								chunkContainsKeyword = true
 								break
 							}