Dropbox Token

[jaikishantulswani]

Please review the Community Note before submitting

TruffleHog Version

running trufflehog 3.89.2

Trace Output

using command like
trufflehog --include-detectors="all" filesystem x --results=verified,unknown,unverified

--->

[shahzadhaider1]

Hi @jaikishantulswani!

Thanks for reporting this.

We tried running the same TruffleHog command you've provided, but were not able to reproduce any issue related to a Dropbox token. Could you please provide more context so we can help effectively?

• Was a specific secret flagged as a Dropbox token?
• Are you reporting a false positive, a missed detection, or an issue with verification?
• If possible, please share a sanitized sample of the suspected token, or the regex pattern it matched.
• Any additional logs or screenshots would be helpful.

Once we have more details, we’ll be happy to take a deeper look!

Thanks!

[jaikishantulswani]

@shahzadhaider1 when you have a file that have dropbox shortlived token is like
sl.u.AF171m5_ZQTJ25mFcfep1Zmxxxxxxxxxxxx , trufflehog not detect it the secret is not having dropbox value writen like

when a there is xopbox value before the token key

cat x.txt 
xopbox:sl.u.AF171m5_ZQTJ25mFcfep1ZmW5P8G1NZsExG-NeXCuNtxDG70xd98HCmi736l2xqxZNAOeQiCV_Z8lTB9XSJ1e02L27cbGifIq6jbEjv5N5YwsKU6XjDSqkF3IuZqomrTdVz7oosbC2cpqIiSRhivLbmKjZ9rc5kF06l1f57fZF33LOgZCOduzSlq75TASW77CVmAT1cnzZswsgq9N0aOOSEi6Q9DTTpLnMQRfwCsrCttYkdiYSLpV-XUfjmvdnHk9uGbggNHsRuTqpcR9IEnMDlAQdds4s3YMOOqruFHqbUjTlIxbSbsfHa4q-xxxiv6ZDYk-xxxx
                                                                                                                                                                                                                                              


 trufflehog --include-detectors="all" filesystem x.txt --results=verified,unknown,unverified
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷

2025-07-14T14:07:44+05:30	info-0	trufflehog	running source	{"source_manager_worker_id": "IOTkq", "with_units": true}
2025-07-14T14:07:44+05:30	info-0	trufflehog	finished scanning	{"chunks": 1, "bytes": 342, "verified_secrets": 0, "unverified_secrets": 0, "scan_duration": "1.04092ms", "trufflehog_version": "3.89.2", "verification_caching": {"Hits":0,"Misses":0,"HitsWasted":0,"AttemptsSaved":0,"VerificationTimeSpentMS":0}}

not detecting the token

now when there is dropbox value

 cat x.txt 
dropbox:sl.u.AF171m5_ZQTJ25mFcfep1ZmW5P8G1NZsExG-NeXCuNtxDG70xd98HCmi736l2xqxZNAOeQiCV_Z8lTB9XSJ1e02L27cbGifIq6jbEjv5N5YwsKU6XjDSqkF3IuZqomrTdVz7oosbC2cpqIiSRhivLbmKjZ9rc5kF06l1f57fZF33LOgZCOduzSlq75TASW77CVmAT1cnzZswsgq9N0aOOSEi6Q9DTTpLnMQRfwCsrCttYkdiYSLpV-XUfjmvdnHk9uGbggNHsRuTqpcR9IEnMDlAQdds4s3YMOOqruFHqbUjTlIxbSbsfHa4q-xxxiv6ZDYk-xxxx
                                                                                                                                                                                                                                              

 trufflehog --include-detectors="all" filesystem x.txt --results=verified,unknown,unverified
🐷🔑🐷  TruffleHog. Unearth your secrets. 🐷🔑🐷

2025-07-14T14:07:55+05:30	info-0	trufflehog	running source	{"source_manager_worker_id": "kO19S", "with_units": true}
Found unverified result 🐷🔑❓
Detector Type: Dropbox
Decoder Type: PLAIN
Raw result: sl.u.AF171m5_ZQTJ25mFcfep1ZmW5P8G1NZsExG-NeXCuNtxDG70xd98HCmi736l2xqxZNAOeQiCV_Z8lTB9XSJ1e02L27cbGifIq6jbEjv5N5YwsKU6XjDSqkF3IuZqomrTdVz7oosbC2cpqIiSRhivLbmKjZ9rc5kF06l1f57fZF33LOgZCOduzSlq75TASW77CVmAT1cnzZswsgq9N0aOOSEi6Q9DTTpLnMQRfwCsrCttYkdiYSLpV-XUfjmvdnHk9uGbggNHsRuTqpcR9IEnMDlAQdds4s3YMOOqruFHqbUjTlIxbSbsfHa4q-xxxiv6ZDYk-xxxx
File: x.txt
Line: 1

2025-07-14T14:07:56+05:30	info-0	trufflehog	finished scanning	{"chunks": 1, "bytes": 343, "verified_secrets": 0, "unverified_secrets": 1, "scan_duration": "780.37994ms", "trufflehog_version": "3.89.2", "verification_caching": {"Hits":0,"Misses":1,"HitsWasted":0,"AttemptsSaved":0,"VerificationTimeSpentMS":775}}

[shahzadhaider1]

You're right - this seems like a case where the Dropbox token is not being detected because the surrounding keyword dropbox is missing or altered xopbox. Some detectors in TruffleHog rely not just on the patterns of secrets but also on contextual keywords to reduce false positives.

We’ll explore whether this token format is strong and unique enough to be detected reliably without requiring the presence of specific keywords. If so, we can consider relaxing or even removing the context keyword requirement for Dropbox tokens, relying purely on the token structure itself.

Thanks again for the detailed report; it really helps improve detection quality for edge cases like these.

[shahzadhaider1]

As I have mentioned above, the current Dropbox detector uses a combination of a regex pattern and a contextual keyword dropbox to reduce false positives. The reason for including the dropbox prefix is that the token format itself, while recognizable, is fairly long and uses a common character set, which makes it prone to false positives when scanned across large codebases or binary blobs.

To balance accuracy and noise, we’ve scoped detection to only trigger when the token appears alongside relevant context (like a key name, variable, or surrounding text mentioning Dropbox). This helps ensure we're catching real secrets without overwhelming users with false alerts.

That said, TruffleHog is open source, and you're absolutely welcome to modify the detector to fit your use case. If you'd like to experiment with removing the dropbox keyword requirement, you can replace the keyPat regex here with the following line:

keyPat = regexp.MustCompile(`\b(sl\.(u\.)?[A-Za-z0-9\-\_]{130,})\b`)