From 8348fb5387303060c1c2cfec37daf27e20a11df6 Mon Sep 17 00:00:00 2001
From: KH <92142764+Oleksandr-Kh4@users.noreply.github.com>
Date: Wed, 22 Jul 2026 18:17:28 +0200
Subject: [PATCH] fix: detect Anthropic API keys (sk-ant-...) in pre-commit
 secret scan (#2529)

The existing OpenAI pattern sk-[a-zA-Z0-9]{20,} never matches real
Anthropic keys: their sk-ant-api03-... format contains hyphens, which
break the character class before reaching the 20-char threshold. Keys
from the fastest-growing Claude Code user base slipped through the scan.

Adds a dedicated sk-ant-[a-zA-Z0-9_-]{20,} pattern (checked before the
OpenAI one) and extends the staged-secrets test with a realistic
Anthropic key fixture.
---
 scripts/hooks/pre-bash-commit-quality.js    | 1 +
 tests/hooks/pre-bash-commit-quality.test.js | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/scripts/hooks/pre-bash-commit-quality.js b/scripts/hooks/pre-bash-commit-quality.js
index d1839ac9f..c67b0f5a0 100644
--- a/scripts/hooks/pre-bash-commit-quality.js
+++ b/scripts/hooks/pre-bash-commit-quality.js
@@ -108,6 +108,7 @@ function findFileIssues(filePath) {
       
       // Check for hardcoded secrets (basic patterns)
       const secretPatterns = [
+        { pattern: /sk-ant-[a-zA-Z0-9_-]{20,}/, name: 'Anthropic API key' },
         { pattern: /sk-[a-zA-Z0-9]{20,}/, name: 'OpenAI API key' },
         { pattern: /ghp_[a-zA-Z0-9]{36}/, name: 'GitHub PAT' },
         { pattern: /AKIA[A-Z0-9]{16}/, name: 'AWS Access Key' },
diff --git a/tests/hooks/pre-bash-commit-quality.test.js b/tests/hooks/pre-bash-commit-quality.test.js
index 7a9cfeb70..b845f9496 100644
--- a/tests/hooks/pre-bash-commit-quality.test.js
+++ b/tests/hooks/pre-bash-commit-quality.test.js
@@ -212,6 +212,7 @@ if (test('blocks commits with staged secret patterns across checkable files', ()
   inTempRepo(repoDir => {
     writeAndStage(repoDir, 'index.js', [
       "const openai = 'sk-abcdefghijklmnopqrstuvwxyz';",
+      "const anthropic = 'sk-ant-api03-AbCdEf-GhIjKlMnOpQrStUvWx_Yz012345';",
       "const token = 'ghp_abcdefghijklmnopqrstuvwxyzABCDEFGHIJ';",
       ''
     ].join('\n'));
@@ -227,6 +228,7 @@ if (test('blocks commits with staged secret patterns across checkable files', ()
     assert.strictEqual(result.output, input);
     assert.strictEqual(result.exitCode, 2);
     assert.ok(stderr.includes('Potential OpenAI API key'), `expected OpenAI secret warning, got: ${stderr}`);
+    assert.ok(stderr.includes('Potential Anthropic API key'), `expected Anthropic key warning, got: ${stderr}`);
     assert.ok(stderr.includes('Potential GitHub PAT'), `expected GitHub PAT warning, got: ${stderr}`);
     assert.ok(stderr.includes('Potential AWS Access Key'), `expected AWS key warning, got: ${stderr}`);
     assert.ok(stderr.includes('Potential API key'), `expected generic API key warning, got: ${stderr}`);