[INS-497] Add Pganalyze Read Key Detector

[MuneebUllahKhan222]

Description

This PR adds the pganalyze Read API Key Detector for TruffleHog.

It scans for pganalyze Read API keys and optionally verifies them via the official pganalyze GraphQL API.

Regex:

\b(pgar_[A-Za-z0-9]{27})\b

The detector uses the contextual keyword pgar_ to reduce false positives.

Verification

For verification, we use the pganalyze GraphQL API endpoint:

https://app.pganalyze.com/graphql

We send a POST request with the token in the Authorization header using the format:

Authorization: Token <token>

A response code of:

• 200 OK means the API key is valid
• 401 Unauthorized means the API key is invalid.

This API endpoint is part of the official pganalyze API surface and can be used safely for verification. The verification request performs a read-only GraphQL query and does not perform any destructive actions.

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

---

Note

Low Risk
Standard additive secret detector with feature-flag rollout; verification only calls pganalyze’s GraphQL endpoint with read keys and does not change auth or core scan paths.

Overview
Adds a pganalyze Read API key detector that finds tokens matching pgar_ plus 27 alphanumeric characters (keyword prefilter pgar_), tags results as read-only access, and optionally verifies them with a POST to https://app.pganalyze.com/graphql using Authorization: Token <key> (200 → verified, 401 → invalid).

Wires the scanner into the default engine list, introduces protobuf type PgAnalyzeReadKey (1053), and rolls it out behind PgAnalyzeReadKeyDetectorEnabled (enabled by default in OSS main.go, same gating pattern as Pinecone/Cloudinary). Includes unit, pattern, integration, and benchmark tests.

^{Reviewed by Cursor Bugbot for commit 15b8997. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Corpora Test Results

Scans a corpus of real-world public code against only the detectors changed in this PR, then compares unique match counts between the PR build and the main baseline to catch regex regressions. Verification is disabled — each detector's regex is measured independently.

1 new · 0 clean  |  Scoped to: pganalyzereadkey

Status	Detector	Unique matches (main)	Unique matches (PR)	New	Removed
🆕	pganalyzereadkey	—	0	—	—

• 🔴 regression: >5 new, >20% increase over main, or any removed
• ⚠️ warning: 1–5 new and ≤20% increase over main
• ✅ clean
• 🆕 new detector (no baseline)