feat(detectors): add BasicAuth detector

[deerajcm]

Summary

Add detector for HTTP Basic Authentication credentials found in code, configuration files, and scripts.

Features

• ✅ Detects Base64-encoded Basic Auth credentials
• ✅ Supports multiple patterns:
  • Authorization: Basic <base64>
  • auth: Basic <base64>
  • Environment variables with BASIC_AUTH, HTTP_AUTH
  • Configuration keys like basic_auth, http_auth
• ✅ Decodes and validates Base64 format
• ✅ Extracts username and password from decoded credentials
• ✅ Comprehensive test coverage

Technical Implementation

Detection Pattern

Matches common Basic Auth patterns with prefix keywords:

• authorization, auth, basic_auth, http_auth
• Followed by Basic keyword
• Base64-encoded username:password format

Validation

• Decodes Base64 string
• Validates format contains : separator
• Ensures non-empty username and password
• Returns structured SecretParts:
  • username: Extracted username
  • password: Extracted password
  • encoded: Original Base64 string

Verification

Basic Auth credentials cannot be verified without a target URL/endpoint. Results are marked as unverified but provide full credential details for manual verification.

---

Note

Low Risk
Additive detector-only change with local parsing and no network verification; main risk is false positives on generic base64 near auth keywords.

Overview
Adds a new BasicAuth secret detector and wires it into the default engine and DetectorType enum (BasicAuth = 1057).

The scanner matches Authorization / auth headers (and = separators) with a Basic prefix plus a base64 payload, decodes it (std or URL base64), and only reports credentials when the decoded value is a non-empty username:password. Findings populate SecretParts (username, password, encoded) and are always unverified because there is no endpoint to validate against. Unit tests cover valid/invalid cases, curl snippets, and keyword pre-filtering.

Note: The PR description mentions env/config patterns like BASIC_AUTH; the implemented regex is limited to auth-header-style … basic <base64> text.

^{Reviewed by Cursor Bugbot for commit 8b26b24. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ deerajcm
❌ Deeraj CM

---

Deeraj CM seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8b26b24. Configure here.}

[cursor]

Regex minimum length rejects many valid credentials

High Severity

The {20,} minimum length in keyPat for the base64 alphabet portion is too high, causing the detector to miss many real-world credentials. Common pairs like admin:admin (15 base64 alphabet chars), user:password (18 chars), and admin:password (19 chars) all fall below the 20-char threshold and won't be detected. Only credentials with a combined username:password length of 15+ bytes produce enough base64 characters to match. The downstream validation (colon check, non-empty parts) already guards against false positives, making this high minimum unnecessary. The test cases for "no colon separator" and "empty password" also silently pass due to this same issue — their base64 strings are too short to match the regex, so the actual validation logic is never exercised.

Additional Locations (1)

• pkg/detectors/basicauth/basicauth_test.go#L84-L93

 

^{Reviewed by Cursor Bugbot for commit 8b26b24. Configure here.}