Skip to content

[INS-407] Fixed AWS detector producing non deterministic output#4836

Open
MuneebUllahKhan222 wants to merge 3 commits intotrufflesecurity:mainfrom
MuneebUllahKhan222:INS-407
Open

[INS-407] Fixed AWS detector producing non deterministic output#4836
MuneebUllahKhan222 wants to merge 3 commits intotrufflesecurity:mainfrom
MuneebUllahKhan222:INS-407

Conversation

@MuneebUllahKhan222
Copy link
Copy Markdown
Contributor

@MuneebUllahKhan222 MuneebUllahKhan222 commented Mar 25, 2026

Description:

When multiple AWS credentials are detected in a single file and verification is disabled, the output of the AWS detector becomes non-deterministic due to unordered processing.

Can be reproduced by creating a file with multiple AWS credentials and running this command
trufflehog --no-update --no-verification filesystem example-creds-file --json | jq -r .RawV2

To address this, this PR introduces logic to generate and return all possible combinations of Access Key IDs and Secret Access Keys. This ensures that no potentially valid credential pair is missed during reporting.

When verification is enabled, the existing behaviour remains unchanged.

  • verification OFF → all combinations
  • verification ON → unchanged behaviour

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Changes result-cleaning behavior and the CustomResultsCleaner interface to depend on the engine’s verification setting, which affects how many findings are emitted (especially when verification is disabled). Risk is moderate because it touches core engine filtering and could change output volume for detectors that implement custom cleaning.

Overview
When verification is disabled, AWS access key and session key detectors now keep all detected credential permutations instead of cleaning/de-duping them, eliminating non-deterministic output caused by map iteration order.

To support this, the CustomResultsCleaner API and related engine plumbing were updated so CleanResults receives verificationEnabled (wired from Engine.verify), and AWS’s aws.CleanResults now becomes a no-op when verification is off. Tests were expanded to cover multiple-credential inputs and the new cleaner/engine behavior.

Written by Cursor Bugbot for commit 329dc5a. This will update automatically on new commits. Configure here.

@MuneebUllahKhan222 MuneebUllahKhan222 requested a review from a team March 25, 2026 13:19
@MuneebUllahKhan222 MuneebUllahKhan222 requested review from a team as code owners March 25, 2026 13:19
Copy link
Copy Markdown

@cursor cursor bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants