Skip to content

Conversation

@domwhewell-sage
Copy link
Contributor

BCheck Contributions

  • BCheck compiles and executes as expected
  • BCheck contains appropriate metadata (name, version, author, description and appropriate tags)
  • Only .bcheck files have been added or modified
  • BCheck is in the appropriate folder
  • PR contains single or limited number of BChecks (Multiple PRs are preferred)
  • BCheck attempts to minimize false positives

Description

Modified the "Information Disclosure Secret Finder - tentative" bcheck file as key matchers (Those that match the key rather than the value) only matched the lowercase versions of the naming conventions if the javascript contained an uppercase name or camel case version of the key it would not match

Example

Old

  • api[_-]?key[_-]?sid(=| =|:| :) only matched api_key= etc.

New

  • (?i)api[_-]?key[_-]?sid(=| =|:| :) matches api_key= and API_KEY= etc.

@domwhewell-sage domwhewell-sage changed the title For keyword matchers I have added case insensitivity Add case insensitivity to tentative secret finder Jan 8, 2026
@domwhewell-sage domwhewell-sage marked this pull request as ready for review January 8, 2026 11:21
Copy link
Collaborator

@PortSwiggerWiener PortSwiggerWiener left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many thanks for your submission.

LGTM 👍

@Hannah-PortSwigger Hannah-PortSwigger merged commit f58d507 into PortSwigger:main Jan 12, 2026
2 checks passed
@domwhewell-sage domwhewell-sage deleted the case-insensitivity branch January 12, 2026 11:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants