[INS-406] Braintrust detector

[MuneebUllahKhan222]

Description

This PR adds the Braintrust API Key Detector for TruffleHog.
It scans for Braintrust API keys (prefix sk-) and optionally verifies them via the official API.

Regex: \b(sk-[A-Za-z0-9]{48})\b

Verification

For verification, we use the Braintrust Projects API: https://api.braintrust.dev/v1/project?limit=1. We send a GET request with the token in the Authorization: Bearer header. A response code of 200 OK means the token is valid. 401 Unauthorized means it is an invalid or revoked token, while 403 Forbidden indicates a valid token with insufficient permissions.

This API endpoint is part of the official Braintrust API and can be used safely for verification. It is read-only and does not perform any destructive actions.

Corpora Test

The detector does not appear in the list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Adds a new secret detector with optional online verification against an external API and extends the protobuf DetectorType enum, which can affect downstream consumers expecting stable IDs.

Overview
Adds a new braintrust detector that finds sk--prefixed 48-char Braintrust API keys, deduplicates matches, and emits redacted detectors.Result entries.

When verification is enabled, it validates tokens by calling Braintrust’s Projects API and treating 200/403 as valid and 401 as invalid, surfacing unexpected statuses as verification errors; includes unit, integration, and benchmark coverage.

Registers the detector in the default detector set and introduces a new protobuf enum value DetectorType_BrainTrustApiKey (id 1044).

^{Reviewed by Cursor Bugbot for commit 7763971. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 7763971. Configure here.}

[cursor]

Test for invalid characters passes for wrong reason

Low Severity

The "invalid pattern - invalid characters" test case only has 39 A characters after sk-, so the test passes because the input is too short (needs 48 alphanumeric chars), not because of the ! character. This gives a false sense that the regex properly rejects non-alphanumeric characters, but that assertion is never actually tested. To properly validate rejection of invalid characters, the input needs 47 alphanumeric characters plus the ! to reach the 48-character length requirement.

 

^{Reviewed by Cursor Bugbot for commit 7763971. Configure here.}