Skip to content

[INS-461] Add test to ensure new detectors are registered in defaults.go#4915

Open
mustansir14 wants to merge 2 commits intomainfrom
INS-461-Add-a-test-to-verify-newly-added-detectors-are-registered-in-defaults.go
Open

[INS-461] Add test to ensure new detectors are registered in defaults.go#4915
mustansir14 wants to merge 2 commits intomainfrom
INS-461-Add-a-test-to-verify-newly-added-detectors-are-registered-in-defaults.go

Conversation

@mustansir14
Copy link
Copy Markdown
Contributor

@mustansir14 mustansir14 commented Apr 23, 2026

Motivation

TruffleHog has over 1,000 defined DetectorType proto enum entries, each corresponding to a secret detector. The buildDetectorList() function in pkg/engine/defaults/defaults.go is the single place where all active detectors are registered and made available to the engine. However, there was no CI check to verify that a newly written detector is actually registered there. A developer could write a complete, working detector — with its own package, Scanner struct, keywords, and Type() — and simply forget to add it to buildDetectorList(), causing it to silently never run.

What changed

TestAllDetectorTypesAreInDefaultList is added to pkg/engine/defaults/defaults_test.go. It iterates over every DetectorType defined in the protobuf enum and asserts that each one is either:

  • present in the list returned by DefaultDetectors(), or
  • explicitly listed in excludedFromDefaultList with a documented reason.

A reverse check is also included: if a type is in excludedFromDefaultList but is also present in the active list, the test fails. This catches stale exclude-list entries (e.g. a detector that was once disabled but has since been re-enabled).

The excludedFromDefaultList map groups excluded types into four categories:

  • Mistakenly missed — implementations exist but were never registered (see below)
  • Reserved / special — e.g. CustomRegex, which is added dynamically via engine config
  • Deprecated — proto fields marked deprecated=true; the underlying service no longer exists or has been superseded
  • Intentionally disabled — implementations exist but are commented out in buildDetectorList() due to API issues, false positives, or expired service domains
  • Not yet implemented — proto enum entries reserved for future detectors that have not been written yet

Detectors found to be unregistered

Running the test immediately surfaced detectors with full implementations that were never added to buildDetectorList():

BitbucketDataCenter (this is added in #4907 ), DatadogApikey, Guru, IPInfo, Lob, Rev, TLy, Tru, User, Wit

These detectors are not added to buildDetectorList() in this PR. Enabling a detector that has never been active is a customer-facing change: it can produce noise, and this is something we have been careful about while adding new detectors. Each detector should be enabled in a dedicated PR after:

  1. Verifying the detector still works correctly against its target service
  2. Running corpora tests to assess the volume and quality of new findings
  3. Confirming the customer impact is acceptable

In the meantime, these types are tracked in excludedFromDefaultList under a TODO comment so the gap remains visible and the test continues to pass.


Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Low Risk
Test-only change that adds CI coverage for detector registration; no runtime behavior changes, but the large exclusion list will need ongoing maintenance as enum values evolve.

Overview
Adds TestAllDetectorTypesAreInDefaultList to enforce that every protobuf DetectorType is either returned by DefaultDetectors() (i.e., registered in buildDetectorList()), or is explicitly listed in a new excludedFromDefaultList map.

The test also performs a reverse check to fail if an excluded type is actually active, and seeds excludedFromDefaultList with grouped reasons (reserved/special, deprecated, intentionally disabled, not-yet-implemented, plus a TODO set of implemented-but-not-registered detectors) to prevent silent omissions when new detector enums are added.

Reviewed by Cursor Bugbot for commit c4a392f. Bugbot is set up for automated code reviews on this repo. Configure here.

@mustansir14 mustansir14 requested a review from a team April 23, 2026 09:18
@mustansir14 mustansir14 requested a review from a team as a code owner April 23, 2026 09:18
Copy link
Copy Markdown
Contributor

@MuneebUllahKhan222 MuneebUllahKhan222 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This test should have been there all along but I guess better late than never. Great Work!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants