Secret Scanning
SlopDrop scans every uploaded file for secrets before storing it. This prevents accidental leaks of API keys, tokens, and credentials.
How It Works
Before a file is written to R2, its content is checked against a set of regex patterns. If a match is found, the upload is rejected with a SECRET_DETECTED error.
What's Detected
| Pattern | Example |
|---|---|
| AWS Access Key | AKIA... (20 chars) |
| AWS Secret Key | 40-char base64 after aws_secret |
| GitHub Token | ghp_, gho_, ghs_, ghu_ prefixes |
| GitLab Token | glpat- prefix |
| Slack Token | xoxb-, xoxp-, xoxs- |
| Generic API Key | sk-, pk_live_, sk_live_ patterns |
| Private Keys | BEGIN RSA PRIVATE KEY, BEGIN OPENSSH PRIVATE KEY |
| Connection Strings | postgres://, mysql://, mongodb:// with credentials |
| High-entropy strings | After keywords like password=, secret=, token= |
Bypassing
API tokens with allow_secret_bypass permission can upload files with detected secrets. Use sparingly — this is for legitimate cases like documentation about security patterns.
slop token create --name "docs" --secret-bypass
False Positives
The scanner intentionally errs on the side of caution. Common false positives:
- Example API keys in documentation (use
sk-example...to avoid) - Base64-encoded content that looks like keys
- Test fixtures with dummy credentials
If you hit a false positive, use a token with secret bypass, or restructure the content to avoid the pattern.