chore(deps): update dependency betterleaks/betterleaks to v1.7.0

[renovate-orgmentem]

This PR contains the following updates:

Package	Update	Change
betterleaks/betterleaks	minor	1.6.1 → 1.7.0

Manual step: update BL_SHA256 in .github/workflows/ci.yml to the new release's checksum. The secrets job fails until then (Renovate cannot recompute a release-asset hash).

---

Release Notes

betterleaks/betterleaks (betterleaks/betterleaks)

v1.7.0

Compare Source

What's New

More better rules, faster!

More Rules

Version	Rules	With validation
v1.6.1	325	106
v1.7.0	412	187

Full list of rules added:

aiven-auth-token
apify-api-token
asaas-api-token
azure-app-configuration-connection-string
azure-client-id
azure-servicebus-connection-string
azure-storage-account-key
azure-storage-account-name
azure-tenant-id
bitrise-access-token
buildkite-service-token
buildkite-user-access-token
canadian-digital-service-notify-api-key
checkout-secret-key
circleci-personal-token
circleci-project-token
cloudsmith-api-key
crates-io-api-key
databento-api-key
datastax-astra-application-token
devcycle-client-sdk-key
devcycle-mobile-sdk-key
devcycle-server-sdk-key
docker-swarm-join-token
docker-swarm-unlock-key
ebay-client-id
ebay-client-secret
fullstory-api-key
gcp-gemini-api
highnote-secret-live-key
ionic-personal-access-token
langchain-langsmith-personal-access-token
langchain-langsmith-service-key
lark-app-id
lark-app-secret
lichess-personal-access-token
mailersend-api-token
mercury-production-api-token
mergify-application-key
midtrans-production-server-client-key
neon-api-key
onesignal-rich-authentication-token
onfido-live-api-token-ca
onfido-live-api-token-eu
onfido-live-api-token-us
openweather-api-key
paddle-live-api-key
persona-production-api-key
pinecone-api-key.1
pinecone-api-key.2
pinterest-access-token
plivo-auth-id
plivo-auth-token
polar-oauth-access-token
polar-organization-access-token
polar-personal-access-token
proof-full-access-api-key
rainforest-pay-production-api-key
ramp-client-id
ramp-client-secret
redirect-pizza-api-token.1
render-api-key
rootly-api-key.1
runpod-api-key.1
salesforce-access-token.1
salesforce-instance-url.1
samsara-api-token.1
scalr-api-access-token.1
segment-public-api-token.1
snowflake-account-host.1
snowflake-programmatic-access-token.1
sslmate-api-key.1
tableau-personal-access-token-name.1
tableau-personal-access-token.1
tableau-server-host.1
tailscale-api-key.1
telnyx-api-v2-key.1
temporal-cloud-api-key.1
thunderstore-api-token.1
unkey-root-key.1
val-town-api-token.1
wakatime-api-key.1
wakatime-api-key.2
weatherstack-api-key.1
workato-developer-api-token.1
workos-production-api-key.1
zuplo-consumer-api-key.1

We added 87 new rules, and increased rules with validation from 106 to 187 while dropping scan times.

Better Rules

Thanks to the excellent work by @​joeleonjr, the default generic rule now filters out common public-by-design credentials. These credentials are explicitly intended for client-side use and generally lack access to sensitive data or privileged operations. Reporting them as generic secrets creates unnecessary triage work.

Some publishable credentials have distinctive formats and can be filtered directly. Supabase publishable keys, for example, match the recognizable sb_publishable_[A-Za-z0-9_-]{31} format.

Other credentials do not have a unique shape. An hCaptcha site key looks like an ordinary UUID, so filtering every matching UUID would hide unrelated secrets. Betterleaks therefore requires both the expected format and nearby provider context:

  matchesAny(
    finding["secret"],
    [`^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$`]
  )
  && filter.containsAny(
    providerMatchContext,
    ["hcaptcha", "site_key", "sitekey"]
  )

This removes a known hCaptcha site key from generic results without suppressing every UUID in the codebase.

Faster Scans

Scans are faster now thanks to a couple optimizations:

• a faster filesystem walk: #​238 (thanks @​charlievieth)
• a custom internal case-folding Aho-Corasick matcher that visits keyword matches
  without first allocating lowercase copies (based on github.com/RRethy/ahocorasick MIT) #​240
• direct keyword-to-rule indexes and pooled candidate bitsets instead of
  rebuilding maps of candidate rule IDs for each fragment #​240
• removal of slow left-of-identifier preamble [\w.-]{0,50}?: #​233

Despite the default ruleset growing from 325 to 412 rules, scan time decreased across all six repository and scan-mode combinations tested.

Target	Mode	v1.6.1	v1.7.0	Scan-time reduction
Rails	Directory	0.346s	0.218s	37.1%
Rails	Git history, 16 workers	5.72s	5.22s	8.6%
GitLab	Directory	3.39s	2.63s	22.4%
GitLab	Git history, 16 workers	131.6s	108.0s	18.0%
Betterleaks	Directory	0.276s	0.202s	26.8%
Betterleaks	Git history, 16 workers	1.76s	1.32s	25.3%

Changelog

• 5babeb2 Drop near matches (#​245)
• bc21eb2 Feat/rule timings (#​227)
• 66d51b6 Filter Publishable and Test Keys from Generic Results (#​207)
• 555b1ec Fix PostHog key length ranges and add personal key validator (#​259)
• 7a28a0d More rules and rule updates (p-r) (#​260)
• a47f6c9 Perf/detect optimizations (#​240)
• 118446e Remove left preamble for a quick perf win (#​233)
• 38c1686 Rules/jul 15 batch 1 (#​246)
• b49c535 Rules/jul 17 batch 1 (#​253)
• b76f266 Some Azure Rules (#​222)
• 8e6d239 add config check test to ci (#​263)
• 2168b56 another batch (#​255)
• 88f8ab7 another batch (#​257)
• f64b922 another batch needs more review (#​262)
• 872e374 bump min ver (#​226)
• 813bd3b bunch of comments (#​243)
• 5c859ad cloudsmith rule (#​235)
• d0f00a3 consistent quoting
• 7f9ed4a couple of 'm's (#​256)
• 2eac852 fast walk (#​238)
• 85b491c fix data race w/ runtime bindings (#​231)
• f629149 fix(detect): log filter-skipped findings (#​199)
• 63d589f fix(kubernetes): expand Secret detection range (#​244)
• 06e89aa limit sourcegraph regex and keywords (#​248)
• 1ebee5c more rules (#​249)
• 6381fa4 need to review (#​264)
• 9be6bc2 render rule (#​242)
• e382667 stripe validator (#​247)
• 501de59 support for quoted and escaped values in --log-opts (#​201)
• 0b4063d validation check for existing gcp-api-key rule, create new gemini rules (#​230)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.