refactor: simplify apikeys — inline helpers, deduplicate env iteration, trim comments

Author: Pringled

internal/scan/apikeys.go

@@ -39,7 +39,7 @@ var providerNamePatterns = []*regexp.Regexp{
 	regexp.MustCompile(`(?i)DEEPSEEK`),
 	regexp.MustCompile(`(?i)PERPLEXITY`),
 	regexp.MustCompile(`(?i)CEREBRAS`),
-	regexp.MustCompile(`(?i)(^|_)XAI_`), // (^|_) avoids TAXI_KEY, PROXAI_TOKEN while matching XAI_API_KEY, MY_XAI_KEY
+	regexp.MustCompile(`(?i)(^|_)XAI_`), // (^|_) anchor avoids mid-word false positives
 	regexp.MustCompile(`(?i)ASSEMBLYAI`),
 	regexp.MustCompile(`(?i)AI21`),
 	regexp.MustCompile(`(?i)NVIDIA_NIM`),
@@ -48,7 +48,7 @@ var providerNamePatterns = []*regexp.Regexp{
 	// Google AI (Gemini, Vertex AI, PaLM)
 	regexp.MustCompile(`(?i)GEMINI`),
 	regexp.MustCompile(`(?i)VERTEX`),
-	regexp.MustCompile(`(?i)(^|_)PALM_`), // (^|_) avoids NAPALM_MODE while matching MY_PALM_KEY
+	regexp.MustCompile(`(?i)(^|_)PALM_`), // (^|_) anchor avoids mid-word false positives
 	// AWS AI
 	regexp.MustCompile(`(?i)BEDROCK`),
 	// Azure AI
@@ -80,18 +80,18 @@ var providerNamePatterns = []*regexp.Regexp{
 	regexp.MustCompile(`(?i)CLOUDFLARE`),
 	regexp.MustCompile(`(?i)HEROKU`),
 	regexp.MustCompile(`(?i)RAILWAY`),
-	regexp.MustCompile(`(?i)(^|_)FLY_`), // (^|_) avoids BUTTERFLY_KEY, FLYWEIGHT_INDEX while matching MY_FLY_TOKEN
+	regexp.MustCompile(`(?i)(^|_)FLY_`), // (^|_) anchor avoids mid-word false positives
 	// Source control
 	regexp.MustCompile(`(?i)GITHUB`),
 	regexp.MustCompile(`(?i)GITLAB`),
 	regexp.MustCompile(`(?i)BITBUCKET`),
 	// Productivity / project tools
-	regexp.MustCompile(`(?i)(^|_)LINEAR_`), // (^|_) avoids BILINEAR_FILTER while matching MY_LINEAR_TOKEN
+	regexp.MustCompile(`(?i)(^|_)LINEAR_`), // (^|_) anchor avoids mid-word false positives
 	regexp.MustCompile(`(?i)NOTION`),
 	regexp.MustCompile(`(?i)AIRTABLE`),
 	// Database-as-a-service
 	regexp.MustCompile(`(?i)SUPABASE`),
-	regexp.MustCompile(`(?i)(^|_)NEON_`), // (^|_) avoids ANEMONE_CONFIG, NEONLIGHTS_COLOR while matching MY_NEON_KEY
+	regexp.MustCompile(`(?i)(^|_)NEON_`), // (^|_) anchor avoids mid-word false positives
 	regexp.MustCompile(`(?i)PLANETSCALE`),
 }
 
@@ -195,11 +195,8 @@ func NewAPIKeyScannerWithConfig(cfg config.Config) *APIKeyScanner {
 	}
 }
 
-// Name returns the canonical scanner ID.
 func (s *APIKeyScanner) Name() string { return "api_keys" }
 
-// Scan detects high-risk API keys in env vars and credential file presence.
-// Implements Scanner. Never returns skipped=true.
 func (s *APIKeyScanner) Scan() models.ScanResult {
 	var findings []models.Finding
 	// seenEnvNames is shared across all three env-scanning passes so that any variable
@@ -234,7 +231,12 @@ func (s *APIKeyScanner) scanEnvKeys(seenEnvNames map[string]bool) []models.Findi
 	for _, key := range keys {
 		if os.Getenv(key) != "" {
 			seenEnvNames[key] = true
-			findings = append(findings, envKeyFinding(key))
+			findings = append(findings, models.Finding{
+				Scanner:     "api_keys",
+				Resource:    key,
+				Severity:    models.SeverityHigh,
+				Description: "Can be used to make authenticated API calls.",
+			})
 		}
 	}
 
@@ -249,14 +251,45 @@ func (s *APIKeyScanner) scanEnvKeys(seenEnvNames map[string]bool) []models.Findi
 			}
 			if os.Getenv(key) != "" {
 				seenEnvNames[key] = true
-				findings = append(findings, envKeyFinding(key))
+				findings = append(findings, models.Finding{
+					Scanner:     "api_keys",
+					Resource:    key,
+					Severity:    models.SeverityHigh,
+					Description: "Can be used to make authenticated API calls.",
+				})
 			}
 		}
 	}
 
 	return findings
 }
 
+// envEntry holds a parsed, non-empty environment variable that has not yet been claimed.
+type envEntry struct {
+	name  string
+	value string
+}
+
+// unclaimedEnvEntries returns non-empty env vars that are not in HighRiskEnvKeys and not
+// already present in seenEnvNames. It is used by scanNameRegex and scanValuePatterns to
+// avoid repeating the same iteration and filtering logic in both methods.
+func unclaimedEnvEntries(seenEnvNames map[string]bool) []envEntry {
+	var entries []envEntry
+	for _, raw := range os.Environ() {
+		idx := strings.IndexByte(raw, '=')
+		if idx < 0 {
+			continue
+		}
+		name := raw[:idx]
+		value := raw[idx+1:]
+		if HighRiskEnvKeys[name] || value == "" || seenEnvNames[name] {
+			continue
+		}
+		entries = append(entries, envEntry{name: name, value: value})
+	}
+	return entries
+}
+
 // scanNameRegex checks env var names against known provider keywords and generic
 // credential terms. It catches non-standard names like MY_OPENAI_KEY that are
 // missed by the exact-match HighRiskEnvKeys pass. Key names only are reported;
@@ -265,49 +298,29 @@ func (s *APIKeyScanner) scanEnvKeys(seenEnvNames map[string]bool) []models.Findi
 func (s *APIKeyScanner) scanNameRegex(seenEnvNames map[string]bool) []models.Finding {
 	var findings []models.Finding
 
-	for _, entry := range os.Environ() {
-		idx := strings.IndexByte(entry, '=')
-		if idx < 0 {
-			continue
-		}
-		name := entry[:idx]
-		value := entry[idx+1:]
-
-		// Skip if already covered by the exact-match HighRiskEnvKeys pass.
-		if HighRiskEnvKeys[name] {
-			continue
-		}
-		// Skip if value is empty — key exists but no credential is set.
-		if value == "" {
-			continue
-		}
-		// Skip if already claimed by a prior pass or earlier in this pass.
-		if seenEnvNames[name] {
-			continue
-		}
-
+	for _, e := range unclaimedEnvEntries(seenEnvNames) {
 		matched := false
 		// Provider patterns require the name to also contain a credential suffix.
 		for _, re := range providerNamePatterns {
-			if re.MatchString(name) && credentialSuffixRe.MatchString(name) {
+			if re.MatchString(e.name) && credentialSuffixRe.MatchString(e.name) {
 				matched = true
 				break
 			}
 		}
 		// Credential suffix patterns match standalone.
 		if !matched {
 			for _, re := range credentialSuffixPatterns {
-				if re.MatchString(name) {
+				if re.MatchString(e.name) {
 					matched = true
 					break
 				}
 			}
 		}
 		if matched {
-			seenEnvNames[name] = true
+			seenEnvNames[e.name] = true
 			findings = append(findings, models.Finding{
 				Scanner:     "api_keys",
-				Resource:    name,
+				Resource:    e.name,
 				Severity:    models.SeverityHigh,
 				Description: "Can be used to make authenticated API calls.",
 			})
@@ -322,33 +335,13 @@ func (s *APIKeyScanner) scanNameRegex(seenEnvNames map[string]bool) []models.Fin
 func (s *APIKeyScanner) scanValuePatterns(seenEnvNames map[string]bool) []models.Finding {
 	var findings []models.Finding
 
-	for _, entry := range os.Environ() {
-		idx := strings.IndexByte(entry, '=')
-		if idx < 0 {
-			continue
-		}
-		name := entry[:idx]
-		value := entry[idx+1:]
-
-		// Skip if already covered by the exact-match HighRiskEnvKeys pass.
-		if HighRiskEnvKeys[name] {
-			continue
-		}
-		// Skip empty values.
-		if value == "" {
-			continue
-		}
-		// Skip if already claimed by scanNameRegex or an earlier iteration of this pass.
-		if seenEnvNames[name] {
-			continue
-		}
-
+	for _, e := range unclaimedEnvEntries(seenEnvNames) {
 		for _, p := range valuePatterns {
-			if strings.HasPrefix(value, p.prefix) && len(value) == p.totalLen {
-				seenEnvNames[name] = true
+			if strings.HasPrefix(e.value, p.prefix) && len(e.value) == p.totalLen {
+				seenEnvNames[e.name] = true
 				findings = append(findings, models.Finding{
 					Scanner:     "api_keys",
-					Resource:    name, // env var NAME, never the value
+					Resource:    e.name, // env var NAME, never the value
 					Severity:    p.severity,
 					Description: fmt.Sprintf("Value matches %s API key format.", p.providerTag),
 				})
@@ -365,10 +358,14 @@ func (s *APIKeyScanner) scanValuePatterns(seenEnvNames map[string]bool) []models
 func (s *APIKeyScanner) scanCredentialFiles() []models.Finding {
 	var findings []models.Finding
 
-	// KEYS-02: Built-in credential files.
 	// If home directory cannot be resolved, skip all ~-based paths to avoid
 	// scanning incorrect root-relative paths (e.g. /.aws/credentials).
-	homeDir := s.resolveHomeDir()
+	homeDir := s.HomeDir
+	if homeDir == "" {
+		if h, err := os.UserHomeDir(); err == nil {
+			homeDir = h
+		}
+	}
 	// seenPath deduplicates built-in and extra paths.
 	allCredFiles := append(credentialFiles, s.ExtraCredentialFiles...)
 	seenPath := make(map[string]bool, len(allCredFiles))
@@ -394,27 +391,6 @@ func (s *APIKeyScanner) scanCredentialFiles() []models.Finding {
 	return findings
 }
 
-func envKeyFinding(key string) models.Finding {
-	return models.Finding{
-		Scanner:     "api_keys",
-		Resource:    key,
-		Severity:    models.SeverityHigh,
-		Description: "Can be used to make authenticated API calls.",
-	}
-}
-
-// resolveHomeDir returns the effective home directory for credential file expansion.
-func (s *APIKeyScanner) resolveHomeDir() string {
-	if s.HomeDir != "" {
-		return s.HomeDir
-	}
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return ""
-	}
-	return home
-}
-
 // expandHome replaces a leading ~ with the given homeDir.
 func expandHome(path, homeDir string) string {
 	if len(path) == 0 {