Skip to content

[INS-465] Add datadogapikey detector to defaults.go#4969

Merged
mustansir14 merged 16 commits into
mainfrom
ins-465-add-datadogapikey-detector-to-defaults
Jun 9, 2026
Merged

[INS-465] Add datadogapikey detector to defaults.go#4969
mustansir14 merged 16 commits into
mainfrom
ins-465-add-datadogapikey-detector-to-defaults

Conversation

@mustansir14

@mustansir14 mustansir14 commented May 18, 2026

Copy link
Copy Markdown
Contributor

Description:

This PR adds the DatadogApiKey detector to the default list of detectors. It gates the new addition behind a feature flag, which is why this PR is based off of #4961 which introduces the plumbing for gating detectors behind feature flags.

Since the flags are disabled by default, the gated detectors need be added to the excludedFromDefaultList of the TestAllDetectorTypesAreInDefaultList test. While doing that, I also separated the gated detectors into their own section (separated by a comment) so that they can easily be identified and removed later.

Testing

Both the unit tests and integration tests pass, no changes required.

Corpora Testing

The Corpora Test in CI was skipped on this PR because no keywords or regex changes were done. Ran the test manually. The detector appears in the list, but a bit below.
image

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Enabling the flag adds another live-verification detector to default scans, which can change findings volume and Datadog API traffic; rollout is mitigated by the feature flag and OSS-only default-on in main.

Overview
Registers the Datadog API key detector in the default engine detector list and wires it into the same feature-flag gating pattern as Pinecone, Cloudinary, GitLab OAuth, and Enigma.

pkg/feature: adds DatadogApiKeyDetectorEnabled. main.go turns it on for OSS builds alongside the other “new detector” flags. defaults.go imports and includes &datadogapikey.Scanner{} in buildDetectorList(), and strips it when the flag is off.

defaults_test.go: keeps DetectorType_DatadogApikey in excludedFromDefaultList while gating applies (so TestAllDetectorTypesAreInDefaultList still passes when the flag is false in tests), and reorganizes exclusions into “mistakenly missed” vs “feature flag gated” sections.

Integration test: unverified Datadog API key expectations now include SecretParts["api_key"].

Reviewed by Cursor Bugbot for commit 3e27af2. Bugbot is set up for automated code reviews on this repo. Configure here.

@mustansir14 mustansir14 requested review from a team May 18, 2026 07:11
@github-actions

Copy link
Copy Markdown

Corpora Test Results

No detector regex or keyword changes in this PR. Bench skipped.

@mustansir14 mustansir14 force-pushed the ins-465-add-datadogapikey-detector-to-defaults branch from fcfbb5f to 674b7e2 Compare May 21, 2026 09:17
@mustansir14 mustansir14 changed the base branch from main to feature-flag-new-detectors May 21, 2026 09:19
@mustansir14 mustansir14 added the review/product-eng Team integrations reviewed, awaiting product-eng review label May 22, 2026
Base automatically changed from feature-flag-new-detectors to main May 26, 2026 14:25
@mustansir14 mustansir14 requested a review from a team May 29, 2026 06:48
@mustansir14 mustansir14 requested a review from a team as a code owner June 8, 2026 14:37
@mustansir14 mustansir14 requested a review from a team as a code owner June 8, 2026 14:37
@mustansir14 mustansir14 merged commit ba02c92 into main Jun 9, 2026
17 of 18 checks passed
@mustansir14 mustansir14 deleted the ins-465-add-datadogapikey-detector-to-defaults branch June 9, 2026 05:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

review/product-eng Team integrations reviewed, awaiting product-eng review

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants