[INS-312] Duo API Secret Key Detector

[MuneebUllahKhan222]

Description

This PR adds the Duo API Credential Detector for TruffleHog.
It detects Duo Integration Keys, Secret Keys, and API hostnames, and optionally verifies them against Duo’s official APIs.

The detector supports identifying credentials for both:

• Duo Admin API
• Duo Auth API

regex

• Integration Key: \b(DI[A-Z0-9]{18})\b
• Secret Key: \b([A-Za-z0-9]{40})\b
• API Host: \b([a-z0-9-]{6,}.duosecurity.com)\b

Verification

For verification, the detector uses Duo’s official REST APIs and signs requests using Duo’s HMAC-based authentication scheme.

The detector attempts verification in the following order:

1. Admin API verification
   Endpoint: GET /admin/v1/info/summary

• 200 OK → credentials are valid Admin API keys
• 401 Unauthorized → invalid credentials
• Any other status → treated as a verification error

2. Auth API verification (fallback)
   Endpoint: GET /auth/v2/check

• 200 OK → credentials are valid Auth API keys
• 401 Unauthorized → invalid credentials
• Any other status → treated as a verification error

Requests are signed using:

• RFC1123 UTC timestamp
• HMAC-SHA1 signature
• Authorization header in Basic <base64(ikey:signature)> format

Verification is read-only and does not perform any destructive actions.

---

Corpora Test

The detector does not appear in the corpora list.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Medium Risk
Introduces new network-based verification logic and a new DetectorType enum value, which can affect scanning behavior/output and may introduce false positives or verification-time failures if the API surface/availability changes.

Overview
Adds a new duo detector that identifies Duo API hosts plus Integration Key/Secret Key pairs and emits results as host:ikey:skey, with optional verification via Duo-signed GET requests (Admin API first, then Auth API fallback).

Registers the detector in the default detector list and adds DetectorType_Duo to proto/detectors.proto (and regenerated detectors.pb.go), alongside unit tests and detectors-tagged integration tests covering verified/unverified and error cases.

^{Written by Cursor Bugbot for commit 11eed25. This will update automatically on new commits. Configure here.}

[amanfcp]

The fallback is triggering if verified is false, that would also be true for an unexpected verification. Shouldn't the fallback trigger only when the verified is deterministically false?

[MuneebUllahKhan222]

Good point! I have update the condition to !verified && verificationErr so that the second endpoint is hit only when the first endpoint hit encounters 401.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[amanfcp]

Suggested change

	// returns verfied=true if credentials are valid and belong to auth api, false if creds are invalid, and error if creds belong to auth api or for anything else (e.g., network error)
	// returns verified=true if credentials are valid and belong to auth api, false if creds are invalid, and error if creds belong to auth api or for anything else (e.g., network error)