Skip to content

[INS-344] Add New Relic Mobile App Token Detector#4810

Open
mustansir14 wants to merge 3 commits intotrufflesecurity:mainfrom
mustansir14:INS-344-Detector-Visible-New-Relic-APM-License-Key
Open

[INS-344] Add New Relic Mobile App Token Detector#4810
mustansir14 wants to merge 3 commits intotrufflesecurity:mainfrom
mustansir14:INS-344-Detector-Visible-New-Relic-APM-License-Key

Conversation

@mustansir14
Copy link
Copy Markdown
Contributor

@mustansir14 mustansir14 commented Mar 11, 2026

Description:

This PR adds the New Relic Mobile App Token Detector.

Regex: \b((AA[0-9a-f]{40}|eu01xx[0-9a-f]{36})-NRMA)\b

  • US region keys start with AA, followed by a 40 characters hexadecimal string, end with "-NRMA"
  • EU region keys start with eu01xx, followed by a 36 characters hexadecimal string, end with "-NRMA"

Verification:
For verification, we use the New Relic Android Agent Internal API: https://mobile-collector.newrelic.com. A POST request is made to the /mobile/v5/connect endpoint. If the response status code is 400, it indicates that the key is valid but the request is malformed (since we're not sending a proper payload), while a 401 status code indicates that the key is invalid. Any other status code is treated as an error.
This API is not documented, and was discovered by digging into New Relic's Android agent SDK code.
Note: For EU region keys, the host should be https://mobile-collector.eu01.nr-data.net

Corpora Test:
The detector does not appear in the list.
image
image

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Adds a new secret detector that performs live HTTP verification against an undocumented New Relic endpoint and extends the shared detector type enum, which could affect runtime behavior and build-time protobuf compatibility if mis-specified.

Overview
Adds a new newrelicmobileapptoken detector that matches US/EU New Relic Mobile App tokens and optionally verifies them via a POST to New Relic’s mobile collector endpoint, returning region metadata on verification.

Registers the detector in the default detector set and introduces a new DetectorType_NewRelicMobileAppToken enum value (proto + generated Go), along with unit and integration tests plus a benchmark for detection/verification behavior.

Reviewed by Cursor Bugbot for commit f22833d. Bugbot is set up for automated code reviews on this repo. Configure here.

@mustansir14 mustansir14 requested a review from a team March 11, 2026 13:04
@mustansir14 mustansir14 requested review from a team as code owners March 11, 2026 13:04
@mustansir14 mustansir14 added review/product-eng Team integrations reviewed, awaiting product-eng review labels Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review/product-eng Team integrations reviewed, awaiting product-eng review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants