rule: Render API key (rnd_ prefix) #117

You will add one detection rule so agentsweep flags Render.com API keys (the rnd_ prefix) in agent history.

How it fits together

flowchart TD
    A["scanner.py<br/>RULES list (line 20)"] --> B["scanner.scan_text() (line 678)<br/>runs each triggered pattern"]
    G["scanner.py<br/>ROTATION_GUIDANCE (line 721)"] --> C
    B --> C["pipeline._scan_file() (line 787)<br/>wraps each hit as a Finding"]
    C --> D["pipeline._scan_all() (line 832)<br/>collects findings per file"]
    D --> E["report / --json / --fix output"]
    F["tests/test_ported_rules.py<br/>FIXTURES dict (line 24)"] -.-> B

scan_text() iterates RULES, and test_ported_rules.py fails unless every rule ships with both a fixture and rotation guidance. All three files change together.

Steps

1. Add a render-api-key tuple to RULES in src/agentsweep/scanner.py (line 20). Start from a pattern shaped like \brnd_[A-Za-z0-9]{28}\b, then confirm the exact length and charset against Render's docs (link below) before you merge.
2. Add a render-api-key entry to ROTATION_GUIDANCE (line 721, same file): revoke or rotate at https://dashboard.render.com/u/settings#api-keys.
3. Add a synthetic, non-live fixture under the render-api-key key in FIXTURES (tests/test_ported_rules.py, line 24). Split the token across two adjacent string literals, 'rnd_a1b2c3...' 'd4e5...', so GitHub push protection does not flag the repo.
4. Run pytest -v. The same test file enforces that every rule has both a fixture and rotation guidance.

Files

• src/agentsweep/scanner.py — RULES (line 20), ROTATION_GUIDANCE (line 721)
• tests/test_ported_rules.py — FIXTURES (line 24)

Reference

https://api-docs.render.com/

How to claim

Comment "I'll take this", fork the repo, branch from main, and open a PR that links this issue.