Add TrueNAS API Key rule

[gemesa]

No description provided.

[bradlarsen]

Thanks again for this new rule!

Is there some way to make this rule more precise? The TrueNAS API Key format unfortunately doesn't have a distinctive prefix or suffix that can be easily matched, and so it ends up producing false positives.

I do see what look like real instances of TrueNAS API Keys using GitHub code search. But in my own local test across 2TiB of source code, I get 390 TrueNAS API Key findings with the rule as written, but they are all false positives.

If this can be made more precise, I'll take it in the default ruleset. Otherwise, we could consider creating a new ruleset, np.experimental perhaps, that includes it.

[bradlarsen]

Note, this TrueNAS API Key is not something that other secret scanners (Truffle Hog, GitLeaks, GitHub Advanced Security, GitGuardian) seem to have rules for. Thank you for your original research @gemesa!

[bradlarsen]

Try /truenas AND /\b(\d+-[a-zA-Z0-9]{64})\b// in GitHub search to see some examples. Without the additional search term, the regex is too expensive for GitHub to give results for (again, caused by lack of a distinctive prefix in the token format).

[gemesa]

TrueNAS has 2 APIs: WebSocket and REST API. I tested both and created 2 separate rules, what do you think?

[bradlarsen]

LGTM! Thank you.