fix(security): detect fine-grained GitHub tokens

Signed-off-by: Aaron Erickson <aerickson@nvidia.com>

Author: ericksoa

nemoclaw/src/security/secret-scanner.test.ts

@@ -11,6 +11,7 @@ const FAKE = {
   openai: "sk-" + "abc123def456ghi789jkl012mno",
   openaiProject: "sk-proj-" + "abc123_def456-ghi789_jkl012-mno345",
   github: "ghp_" + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn",
+  githubFineGrained: "github_pat_" + "ABCDEFGHIJKLMNO_PQRSTUVWXYZabc",
   aws: "AKIA" + "IOSFODNN7EXAMPLE",
   slack: "xoxb-" + "123456789-abcdefghij",
   slackApp: "xapp-" + "1-A0000-12345-abcdef",
@@ -54,6 +55,12 @@ describe("scanForSecrets", () => {
       expect(matches[0].pattern).toBe("GitHub token");
     });
 
+    it("detects an underscore-bearing fine-grained GitHub personal access token", () => {
+      const matches = scanForSecrets(`token: ${FAKE.githubFineGrained}`);
+      expect(matches).toHaveLength(1);
+      expect(matches[0].pattern).toBe("GitHub token");
+    });
+
     it("detects an AWS access key", () => {
       const matches = scanForSecrets(`aws_access_key_id = ${FAKE.aws}`);
       expect(matches).toHaveLength(1);

nemoclaw/src/security/secret-scanner.ts

@@ -31,10 +31,16 @@ export const HIGH_CONFIDENCE_PREFIXED_TOKEN_SPECS = [
   },
   {
     name: "GitHub token",
-    prefixes: ["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"],
+    prefixes: ["ghp_", "gho_", "ghu_", "ghs_", "ghr_"],
     payloadCharacterClass: "A-Za-z0-9",
     minimumPayloadLength: 36,
   },
+  {
+    name: "GitHub token",
+    prefixes: ["github_pat_"],
+    payloadCharacterClass: "A-Za-z0-9_",
+    minimumPayloadLength: 30,
+  },
   {
     name: "npm token",
     prefixes: ["npm_"],

test/e2e/support/cloud-inference-credential-boundary.test.ts

@@ -60,6 +60,7 @@ describe("cloud inference sandbox credential scan", () => {
   it.each([
     ["NVIDIA", "nvapi-nemoclaw-credential-boundary-canary"],
     ["GitHub", `ghp_${"a".repeat(36)}`],
+    ["GitHub fine-grained", `github_pat_${"a".repeat(15)}_${"b".repeat(14)}`],
     ["npm", `npm_${"b".repeat(36)}`],
   ])("reports only the path of a file that contains a %s credential canary", (_label, canary) => {
     const root = createScanRoot();