openai

Purpose

Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and sk-proj-<48+ chars> for project-scoped keys. Exposing these credentials allows unauthorized access to OpenAI's models, incurring cost and potential data leakage.

Features

Handles both standard (sk-) and project-scoped (sk-proj-) key formats.
Project keys are matched first; the shorter sk- pattern skips positions already claimed by a project key to avoid double-reporting.
Project keys receive a slightly higher confidence (0.95) than standard keys (0.92) due to the more distinctive prefix.
Word-boundary anchors on both ends.

Usage: Basic Example

import { detect } from '@suaveplan/security-codes/patterns/openai';

const matches = detect('OPENAI_API_KEY=sk-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv');
// matches[0].type === 'openai-key'
// matches[0].confidence === 0.92

Usage: Advanced Example

import { detect } from '@suaveplan/security-codes/patterns/openai';

const text = 'key=sk-proj-ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
const matches = detect(text);
// matches[0].type === 'openai-key'
// matches[0].confidence === 0.95

API Reference

`detect(input: string): SecurityCodeMatch[]`

Scans input for OpenAI API keys.

Parameter	Type	Description
`input`	`string`	The string to scan

Returns an array of SecurityCodeMatch with type: 'openai-key'. Standard keys have confidence: 0.92; project keys have confidence: 0.95.

Implementation Notes

The project-key regex (sk-proj-) is tested first and winning positions are recorded in a Set so the standard-key regex does not produce duplicate matches for the same token. Both regexes reset lastIndex before scanning.

OpenAI introduced project-scoped keys to allow tighter permission boundaries per API project. Detecting them separately lets security tooling distinguish between a leaked organisation-wide key (higher blast radius) and a project-scoped key (limited blast radius). The 48-character suffix length for standard keys and the extended suffix for project keys match OpenAI's published key format; the exact length boundary is enforced via {48,} to tolerate any future increases without requiring a regex update.

2.3 KiB Raw Blame History