secret shape audit derived

{
  "input": {
    "body": {
      "format": "json",
      "content": "{\n \"service\": \"api\",\n \"aws\": {\n  \"access_key_id\": \"AKIAAAAAAAAAAAAAAAAA\",\n  \"region\": \"us-east-1\"\n },\n \"github_token\": \"ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\n \"database_url\": \"postgres://app:tr0ub4dor@db.internal:5432/app\",\n \"session_key\": \"Zm9vYmFyMTIzNDU2Nzg5MFFXRVJUWXVpb3BBU0RGR0g0NTY3\",\n \"api_password\": \"CHANGEME\",\n \"build_path\": \"/var/lib/application/releases/20261002/bundle.tar.gz\",\n \"logo\": \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH\"\n}",
      "allow_paths": [
        "/logo"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "clean": false,
      "limits": {
        "maxFindings": 500,
        "maxJsonBytes": 1048576,
        "maxResources": 5000,
        "maxTextBytes": 262144,
        "maxEnvEntries": 2000,
        "maxPatchOperations": 1000
      },
      "passed": false,
      "matches": [
        {
          "shape": "AWS_ACCESS_KEY_ID",
          "length": 20,
          "context": "json value",
          "location": "/aws/access_key_id"
        },
        {
          "shape": "GITHUB_TOKEN",
          "length": 40,
          "context": "json value",
          "location": "/github_token"
        },
        {
          "shape": "CONNECTION_STRING_WITH_PASSWORD",
          "length": 45,
          "context": "json value",
          "location": "/database_url"
        }
      ],
      "read_as": "json",
      "complete": false,
      "findings": [
        {
          "code": "AWS_ACCESS_KEY_ID",
          "shape": "AWS_ACCESS_KEY_ID",
          "detail": "/aws/access_key_id holds an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics, 20 characters long. The value is not reported.",
          "location": "/aws/access_key_id"
        },
        {
          "code": "GITHUB_TOKEN",
          "shape": "GITHUB_TOKEN",
          "detail": "/github_token holds a GitHub token: a documented prefix followed by a fixed-length body, 40 characters long. The value is not reported.",
          "location": "/github_token"
        },
        {
          "code": "CONNECTION_STRING_WITH_PASSWORD",
          "shape": "CONNECTION_STRING_WITH_PASSWORD",
          "detail": "/database_url holds a URL carrying a password in its userinfo, 45 characters long. The value is not reported.",
          "location": "/database_url"
        }
      ],
      "request_id": "example-request",
      "service_id": "secret_shape_audit",
      "assumptions": [
        "No value is ever returned. A match is reported as its shape class, its position and its length, because a response that echoed what it found would be the leak rather than the detector.",
        "The shape classes are published in every response, so a caller can see exactly what was looked for rather than trusting an unstated list. A credential of a kind not listed is not found, and that is st...",
        "Entropy is judged by length and character-class mix rather than by a dictionary, which is why a file path, an identifier and an embedded image do not match."
      ],
      "limitations": [
        "The content supplied. clean means no recognised shape was found, which is not a statement that the content holds no secret: an unlisted format, an encoded value or a secret split across fields is not ...",
        "Not a security assessment. Whether a matched value is live, revoked or a test fixture is unknowable here."
      ],
      "match_count": 4,
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "LOCATION_ALLOWED: /logo is in the allow list, so a match there was not reported."
      ],
      "finding_count": 5,
      "shape_classes": [
        {
          "code": "PRIVATE_KEY_BLOCK",
          "description": "a PEM private key block"
        },
        {
          "code": "JSON_WEB_TOKEN",
          "description": "a JSON Web Token: three dot-separated base64url segments whose first decodes to a JSON header"
        },
        {
          "code": "AWS_ACCESS_KEY_ID",
          "description": "an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics"
        }
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "GITHUB_TOKEN": 1,
        "AWS_ACCESS_KEY_ID": 1,
        "HIGH_ENTROPY_BASE64": 1,
        "CONNECTION_STRING_WITH_PASSWORD": 1,
        "CREDENTIAL_NAMED_VALUE_UNRECOGNISED": 1
      },
      "matches_by_shape": {
        "GITHUB_TOKEN": 1,
        "AWS_ACCESS_KEY_ID": 1,
        "HIGH_ENTROPY_BASE64": 1,
        "CONNECTION_STRING_WITH_PASSWORD": 1
      }
    }
  }
}