Add 1Password service account token detector

[tanishq-sf]

Summary

• Adds a new detector for 1Password service account tokens (ops_eyJ... prefix)
• These tokens authenticate automated workflows and CI/CD pipelines with 1Password vaults
• Pattern-match only detection — tokens use SRP-based authentication and cannot be verified with a simple HTTP request

Changes

• pkg/detectors/onepasswordserviceaccount/ — detector + tests
• proto/detector_type.proto — OnepasswordServiceAccount = 1045
• pkg/pb/detector_typepb/detector_type.pb.go — generated enum constant
• pkg/engine/defaults/defaults.go — import + scanner registration

Regex

ops_eyJ[A-Za-z0-9+/=._-]{50,}

Test plan

• Regex validated against a real 1Password service account token
• CI passes make protos and test suite
• go test ./pkg/detectors/onepasswordserviceaccount/ -v

---

Note

Low Risk
Primarily additive changes (new detector + enum value + registration) with no verification/network behavior; main risk is minor integration/regeneration issues around the updated detector type proto/enum.

Overview
Adds a new onepasswordserviceaccount detector to identify 1Password service account tokens by regex (ops_eyJ...) and return matches without attempting verification.

Registers the detector in the default detector list and extends the detector type enum/proto with OnepasswordServiceAccount = 1045, including a basic pattern-matching unit test.

^{Reviewed by Cursor Bugbot for commit 1ef9b41. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Reviewed by Cursor Bugbot for commit 1ef9b41. Configure here.}

[cursor]

Test token doesn't match detector's keyword or regex

High Severity

The "valid pattern" test uses the token ops_abcdefghijklmnopqrstuvwxyzABCDEF, but the detector's keyword is ops_eyJ and the regex requires an ops_eyJ prefix followed by 50+ characters. This token has neither the correct prefix nor sufficient length. The AhoCorasick keyword pre-filter won't find ops_eyJ in the test input, so the test fails immediately at the keyword check — meaning the regex matching is never actually exercised. The "invalid pattern" test also lacks ops_eyJ in its input, so it too fails at the keyword check rather than validating that the regex correctly rejects invalid tokens.

Additional Locations (1)

• pkg/detectors/onepasswordserviceaccount/onepasswordserviceaccount.go#L21-L22

 

^{Reviewed by Cursor Bugbot for commit 1ef9b41. Configure here.}

[cursor]

Double-percent format verbs produce literal percent signs

Medium Severity

All t.Errorf calls use %%q, %%v, %%d, %%s instead of %q, %v, %d, %s. In Go, %% is an escape that produces a literal % character, so the format arguments (test.name, d.Keywords(), etc.) won't be interpolated into the error messages. Every other detector test in the codebase uses single % for format verbs.

Additional Locations (2)

• pkg/detectors/onepasswordserviceaccount/onepasswordserviceaccount_test.go#L53-L54
• pkg/detectors/onepasswordserviceaccount/onepasswordserviceaccount_test.go#L72-L73

 

^{Reviewed by Cursor Bugbot for commit 1ef9b41. Configure here.}