Optimize the regex pattern in the artifactory access token detector

[shahzadhaider1]

This PR updates the Artifactory detector to properly detect Artifactory API keys with the AKCp prefix format.

Problem

The existing Artifactory detector was using a very generic regex pattern that detected any 73 or 64 character alphanumeric strings, leading to potential false positives. The detector was not specifically targeting the old Artifactory API key format (AKCp prefix).

Changes

1. Updated Regex Pattern

• Changed from generic pattern: \b([a-zA-Z0-9]{64,73})\b
• To specific pattern: \b(AKCp[A-Za-z0-9]{69})\b
• This matches the standard Artifactory API key format

2. Updated Keywords

• Added AKCp to the keywords list for better pre-filtering

3. Updated Tests

• Unit tests: Updated to match the new AKCp prefix pattern
• Integration tests: Using mock secrets due to API key deprecation (see note below)

Important Note on Testing

JFrog deprecated Artifactory API keys (format AKCp*) and disabled the ability to create new API keys at the end of Q3 2024.

Sources:

• Pulumi Artifactory Provider Documentation
• Terraform Artifactory Provider Documentation

Since real AKCp API keys can no longer be generated:

• Integration tests use mock secrets with proper format
• Tests validate detection (regex matching) rather than verification
• This is acceptable as the primary goal is to detect leaked secrets in codebases, where old API keys may still exist

Checklist:

• Updated regex pattern to match AKCp prefix format
• Updated keywords for efficient pre-filtering
• Updated unit tests
• Updated integration tests with mock secrets
• Added documentation comments explaining testing limitations
• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[nabeelalam]

Do we need an artifactory keyword? It doesn't seem to be a required prefix

[shahzadhaider1]

The artifactory keyword was already present, so I kept it as-is. It’s not meant to indicate a required prefix for the secret itself, but rather to help with contextual matching. In practice, I think Artifactory credentials are often defined or referenced near the term “artifactory” (config files, env vars, comments, etc.), so having it as a keyword can help reduce noise and improve signal.

That said, I’m open to removing it if we think it’s not providing enough value.

[nabeelalam]

Just one suggestion otherwise good to go!