Skip to content

[INS-344] Add New Relic Mobile App Token Detector#4810

Open
mustansir14 wants to merge 1 commit intotrufflesecurity:mainfrom
mustansir14:INS-344-Detector-Visible-New-Relic-APM-License-Key
Open

[INS-344] Add New Relic Mobile App Token Detector#4810
mustansir14 wants to merge 1 commit intotrufflesecurity:mainfrom
mustansir14:INS-344-Detector-Visible-New-Relic-APM-License-Key

Conversation

@mustansir14
Copy link
Contributor

@mustansir14 mustansir14 commented Mar 11, 2026

Description:

This PR adds the New Relic Mobile App Token Detector.

Regex: \b((AA[0-9a-f]{40}|eu01xx[0-9a-f]{36})-NRMA)\b

  • US region keys start with AA, followed by a 40 characters hexadecimal string, end with "-NRMA"
  • EU region keys start with eu01xx, followed by a 36 characters hexadecimal string, end with "-NRMA"

Verification:
For verification, we use the New Relic Android Agent Internal API: https://mobile-collector.newrelic.com. A POST request is made to the /mobile/v5/connect endpoint. If the response status code is 400, it indicates that the key is valid but the request is malformed (since we're not sending a proper payload), while a 401 status code indicates that the key is invalid. Any other status code is treated as an error.
This API is not documented, and was discovered by digging into New Relic's Android agent SDK code.
Note: For EU region keys, the host should be https://mobile-collector.eu01.nr-data.net

Corpora Test:
The detector does not appear in the list.
image
image

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

Note

Medium Risk
Medium risk due to adding a new network-backed verification path (new HTTP call and status-code semantics) plus a protobuf enum change that affects detector type numbering/serialization.

Overview
Adds a new newrelicmobileapptoken detector that matches US/EU Mobile App Token formats and optionally verifies tokens by POSTing to New Relic’s mobile collector endpoint (treating 400 as valid and 401 as invalid, with region recorded in ExtraData).

Wires the detector into defaults.go so it runs by default, and extends detectors.proto / generated detectors.pb.go with a new DetectorType_NewRelicMobileAppToken enum value. Includes unit tests for the regex/keyword matching and integration tests covering verified/unverified/region behavior, plus a benchmark.

Written by Cursor Bugbot for commit a5210cd. This will update automatically on new commits. Configure here.

@mustansir14 mustansir14 requested a review from a team March 11, 2026 13:04
@mustansir14 mustansir14 requested review from a team as code owners March 11, 2026 13:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants