fix(security): reduce false positives and deduplicate detections

- Add deduplication to AddDetection() to prevent duplicate type+location
- AWS secret key pattern now requires keyword context (aws_secret_access_key=,
  AWS_SECRET_KEY:, secretAccessKey:) to avoid matching random base64 in RSA keys
- Azure client secret pattern now requires keyword context (AZURE_CLIENT_SECRET=,
  client_secret:, clientSecret:) to avoid false positives
- Update tests to reflect context-required behavior
- Add TestResult_AddDetection_Deduplication test

Before: id_rsa showed 9 detections (including aws_secret_key false positives)
After: id_rsa shows 3 detections (rsa_private_key, private_key, high_entropy)

Before: .env showed 29 detections (many duplicates)
After: .env shows 9 unique detections

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Dumbris

internal/security/detector_test.go

@@ -1,6 +1,7 @@
 package security
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
@@ -140,9 +141,10 @@ func TestResult_AddDetection(t *testing.T) {
 func TestResult_AddDetection_Multiple(t *testing.T) {
 	result := NewResult()
 
+	// Add different types - all should be added
 	for i := 0; i < 5; i++ {
 		result.AddDetection(Detection{
-			Type:     "test_type",
+			Type:     fmt.Sprintf("test_type_%d", i),
 			Category: "test_category",
 			Severity: "medium",
 			Location: "arguments",
@@ -153,6 +155,32 @@ func TestResult_AddDetection_Multiple(t *testing.T) {
 	assert.Len(t, result.Detections, 5)
 }
 
+func TestResult_AddDetection_Deduplication(t *testing.T) {
+	result := NewResult()
+
+	// Add same type+location multiple times - should only store once
+	for i := 0; i < 5; i++ {
+		result.AddDetection(Detection{
+			Type:     "test_type",
+			Category: "test_category",
+			Severity: "medium",
+			Location: "arguments",
+		})
+	}
+
+	assert.True(t, result.Detected)
+	assert.Len(t, result.Detections, 1, "duplicate detections should be deduplicated")
+
+	// Add same type but different location - should add both
+	result.AddDetection(Detection{
+		Type:     "test_type",
+		Category: "test_category",
+		Severity: "medium",
+		Location: "response",
+	})
+	assert.Len(t, result.Detections, 2, "same type with different location should be added")
+}
+
 // Integration tests for pattern detection
 func TestDetector_PatternDetection(t *testing.T) {
 	tests := []struct {

internal/security/patterns/cloud.go

@@ -38,33 +38,18 @@ func awsAccessKeyPattern() *Pattern {
 }
 
 // AWS Secret Key pattern
-// Base64-encoded 40-character string
+// Requires keyword context to avoid false positives on random base64 strings
 func awsSecretKeyPattern() *Pattern {
+	// Pattern requires keyword context like: aws_secret_access_key=, AWS_SECRET_KEY:, "secretAccessKey":
+	// Handles formats: key=value, key: value, "key": "value"
 	return NewPattern("aws_secret_key").
-		WithRegex(`[A-Za-z0-9/+=]{40}`).
+		WithRegex(`(?i)(?:aws[_-]?secret[_-]?(?:access[_-]?)?key|secret[_-]?access[_-]?key|secretAccessKey)["']?\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})["']?`).
 		WithCategory(CategoryCloudCredentials).
 		WithSeverity(SeverityCritical).
 		WithDescription("AWS secret access key").
 		WithKnownExamples(
 			"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", // AWS documentation example
 		).
-		WithValidator(func(match string) bool {
-			// Must contain at least one lowercase, one uppercase, and one digit/special
-			hasLower := false
-			hasUpper := false
-			hasOther := false
-			for _, c := range match {
-				switch {
-				case c >= 'a' && c <= 'z':
-					hasLower = true
-				case c >= 'A' && c <= 'Z':
-					hasUpper = true
-				case (c >= '0' && c <= '9') || c == '/' || c == '+' || c == '=':
-					hasOther = true
-				}
-			}
-			return hasLower && hasUpper && hasOther
-		}).
 		Build()
 }
 
@@ -91,22 +76,15 @@ func gcpServiceAccountPattern() *Pattern {
 }
 
 // Azure Client Secret pattern
-// Typically 34+ characters with special characters
+// Requires keyword context to avoid false positives
 func azureClientSecretPattern() *Pattern {
+	// Pattern requires keyword context like: AZURE_CLIENT_SECRET=, client_secret:, "clientSecret":
+	// Handles formats: key=value, key: value, "key": "value"
 	return NewPattern("azure_client_secret").
-		WithRegex(`[a-zA-Z0-9~._-]{34,}`).
+		WithRegex(`(?i)(?:azure[_-]?client[_-]?secret|client[_-]?secret|clientSecret|AZURE_SECRET)["']?\s*[:=]\s*["']?([a-zA-Z0-9~._-]{34,})["']?`).
 		WithCategory(CategoryCloudCredentials).
 		WithSeverity(SeverityHigh).
 		WithDescription("Azure client secret / app password").
-		WithValidator(func(match string) bool {
-			// Must contain at least one special character (~ . _ -)
-			for _, c := range match {
-				if c == '~' || c == '.' || c == '_' || c == '-' {
-					return true
-				}
-			}
-			return false
-		}).
 		Build()
 }
 

internal/security/patterns/cloud_test.go

@@ -178,21 +178,39 @@ func TestAWSSecretKeyPattern(t *testing.T) {
 		wantExample bool
 	}{
 		{
-			name:        "example secret key",
+			name:        "standalone secret key - no context, should not match",
 			input:       "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+			wantMatch:   false, // Now requires context
+			wantExample: false,
+		},
+		{
+			name:        "secret key with aws_secret_access_key context",
+			input:       `aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`,
 			wantMatch:   true,
 			wantExample: true,
 		},
 		{
-			name:        "secret key in context",
-			input:       `aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`,
+			name:        "secret key with AWS_SECRET_KEY context",
+			input:       `AWS_SECRET_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"`,
 			wantMatch:   true,
 			wantExample: true,
 		},
 		{
-			name:        "random 40 char base64-like",
-			input:       "abcdefghij1234567890ABCDEFGHIJ1234567890",
+			name:        "secret key with secretAccessKey JSON context",
+			input:       `"secretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"`,
 			wantMatch:   true,
+			wantExample: true,
+		},
+		{
+			name:        "random 40 char base64-like without context - no match",
+			input:       "abcdefghij1234567890ABCDEFGHIJ1234567890",
+			wantMatch:   false, // Now requires context
+			wantExample: false,
+		},
+		{
+			name:        "RSA private key content - should not match",
+			input:       "MIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8Pb",
+			wantMatch:   false, // No AWS context
 			wantExample: false,
 		},
 		{
@@ -325,23 +343,33 @@ func TestAzureClientSecretPattern(t *testing.T) {
 		wantMatch bool
 	}{
 		{
-			name:      "Azure client secret format 1",
+			name:      "standalone secret - no context, should not match",
 			input:     "7c9~abcdefghijklmnopqrstuvwxyz1234",
-			wantMatch: true,
+			wantMatch: false, // Now requires context
 		},
 		{
-			name:      "Azure client secret format 2",
+			name:      "standalone secret format 2 - no context, should not match",
 			input:     "abc.defghijklmnopqrstuvwxyz123456~",
-			wantMatch: true,
+			wantMatch: false, // Now requires context
 		},
 		{
-			name:      "Azure client secret in config",
+			name:      "Azure client secret with AZURE_CLIENT_SECRET context",
 			input:     `AZURE_CLIENT_SECRET=7c9~abcdefghijklmnopqrstuvwxyz1234`,
 			wantMatch: true,
 		},
 		{
-			name:      "too short",
-			input:     "7c9~abc",
+			name:      "Azure client secret with client_secret context",
+			input:     `client_secret: "7c9~abcdefghijklmnopqrstuvwxyz1234"`,
+			wantMatch: true,
+		},
+		{
+			name:      "Azure client secret with clientSecret JSON context",
+			input:     `"clientSecret": "abc.defghijklmnopqrstuvwxyz123456~"`,
+			wantMatch: true,
+		},
+		{
+			name:      "too short even with context",
+			input:     `AZURE_CLIENT_SECRET=7c9~abc`,
 			wantMatch: false,
 		},
 	}

internal/security/types.go

@@ -69,8 +69,14 @@ func NewResult() *Result {
 	}
 }
 
-// AddDetection adds a detection to the result
+// AddDetection adds a detection to the result, avoiding duplicates
 func (r *Result) AddDetection(d Detection) {
+	// Check for duplicate (same type + location)
+	for _, existing := range r.Detections {
+		if existing.Type == d.Type && existing.Location == d.Location {
+			return // Already have this detection
+		}
+	}
 	r.Detections = append(r.Detections, d)
 	r.Detected = true
 }