Cover all public Shopify credential prefixes plus shpua_

Assisted-By: devx/044e1f3f-fe03-4f4c-8aa7-520114eab4a0

Author: lopez-mar

.changeset/app-doctor-secret-false-positives.md

@@ -2,4 +2,4 @@
 '@shopify/app': patch
 ---
 
-App Doctor's committed-secret check now only flags recognizable secret values (e.g. `shpss_`/`shpat_` tokens), not secret-sounding variable names or placeholders.
+The committed-secret check in `shopify app security` now only flags recognizable secret values (e.g. `shpss_`/`shpat_` tokens), not secret-sounding variable names or placeholders.

packages/app/src/cli/services/app-security-engine/rules/secret-rules.ts

@@ -26,13 +26,16 @@ interface SecretPattern {
 
 export const SECRET_PATTERNS: SecretPattern[] = [
   // Shopify credentials are recognized by value prefix, never by variable or
-  // key name: shpss_ (API secret), shpat_ (Admin API token), shpca_ and
-  // shppa_ (custom app tokens). A secret-sounding name proves nothing —
-  // `.env.example` files legitimately assign placeholders to
-  // `SHOPIFY_API_SECRET`, and scoring those is how this check missed its own
-  // static-tier bar (provable facts, near-zero FPs).
+  // key name. A secret-sounding name proves nothing — `.env.example` files
+  // legitimately assign placeholders to `SHOPIFY_API_SECRET`, and scoring
+  // those is how this check missed its own static-tier bar (provable facts,
+  // near-zero FPs). shpat_/shpca_/shppa_/shpss_ bodies are 32-char hex;
+  // shprt_/shpsb_/shptka_/shpua_ are alphanumeric. The first seven prefixes
+  // are already public via shopify.dev docs and published secret-scanning
+  // rules (gitleaks, GitHub partner patterns); shpua_ marks tokens issued
+  // while an app is still in development — the most likely to be committed.
   {
-    regex: /shp(?:at|ca|pa|ss)_[a-fA-F0-9]{16,}/,
+    regex: /shp(?:(?:at|ca|pa|ss)_[a-fA-F0-9]{16,}|(?:rt|sb|tka|ua)_[a-zA-Z0-9]{16,})/,
     name: 'Shopify token',
     wholeMatch: true,
   },

packages/app/src/cli/services/app-security-engine/tests/secret-safety.test.ts

@@ -298,6 +298,17 @@ describe('git status drives severity, not .gitignore text', () => {
 })
 
 describe('committed secret classification', () => {
+  test('detects every supported Shopify credential prefix as a bare value', () => {
+    const prefixes = ['shpat_', 'shpca_', 'shppa_', 'shpss_', 'shprt_', 'shpsb_', 'shptka_', 'shpua_']
+    for (const prefix of prefixes) {
+      const token = compose(prefix, HEX32)
+      expect(
+        SECRET_PATTERNS.some((pattern) => pattern.regex.test(token)),
+        `${prefix} not detected`,
+      ).toBe(true)
+    }
+  })
+
   test('does not score template env files with placeholder values', async () => {
     const dir = makeApp({
       '.env.example': 'SHOPIFY_API_SECRET=your-secret-here\nSHOPIFY_API_KEY=your-key-here\n',