scan_result.proto

/*
 * Copyright 2026 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

syntax = "proto3";

package scalibr;

import "google/protobuf/any.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "proto/vulnerability.proto";

option go_package = "github.com/google/osv-scalibr/binary/proto/scan_result_go_proto";
option java_multiple_files = true;

// Proto file describing the SCALIBR scan results. Whenever this proto is
// modified make sure to regenerate the go_proto file by running
// `make protos`

// The results of a scan incl. scan status and artifacts found.
message ScanResult {
  reserved 6, 7;
  string version = 1;
  google.protobuf.Timestamp start_time = 2;
  google.protobuf.Timestamp end_time = 3;
  // Status of the overall scan.
  ScanStatus status = 4;
  // Status and versions of the plugins that ran.
  repeated PluginStatus plugin_status = 5;
  Inventory inventory = 8;
}

// The artifacts (e.g. software inventory, security findings) that a scan found.
message Inventory {
  repeated Package packages = 1;
  repeated PackageVuln package_vulns = 6;
  repeated GenericFinding generic_findings = 2;
  repeated Secret secrets = 3;
  repeated ContainerImageMetadata container_image_metadata = 5;
  repeated SensitiveInformation sensitive_information = 7;
}

message ScanStatus {
  ScanStatusEnum status = 1;
  string failure_reason = 2;
  repeated FileError file_errors = 4;

  enum ScanStatusEnum {
    UNSPECIFIED = 0;
    SUCCEEDED = 1;
    PARTIALLY_SUCCEEDED = 2;
    FAILED = 3;
  }
}

message PluginStatus {
  string name = 1;
  int32 version = 2;
  ScanStatus status = 3;
}

message FileError {
  string file_path = 1;
  string error_message = 2;
}

// A software package or library found by an extractor.
// PURL or CPE needs to be set, maybe both.
message Package {
  reserved 3, 4, 10, 28, 35;
  reserved 17 to 20, 29, 32, 43, 59, 71, 72;
  // Unique identifier for the package.
  string id = 60;
  // Human-readable name of the software, to be used for things like logging.
  // For vuln matching, use the name from metadata.
  string name = 11;
  // Version of the package.
  string version = 12;
  // Source code level package identifiers.
  SourceCodeIdentifier source_code = 26;
  // Package URL of the software.
  Purl purl = 1;
  // Ecosystem - For software packages this corresponds to an OSV ecosystem
  // value, e.g. PyPI.
  string ecosystem = 27;
  // TODO(b/400910349): Remove once integrators no longer use this.
  repeated string locations = 2 [deprecated = true];
  // Paths or source of files related to the package.
  PackageLocation location = 68;
  // The names of the plugins that found this software. Set by the
  // core library.
  repeated string plugins = 49;
  // The additional data found in the package.
  optional google.protobuf.Any metadata_any = 69;
  // Deprecated: use metadata_any instead.
  // TODO(#1847): Remove once the migration is complete.
  oneof metadata {
    PythonPackageMetadata python_metadata = 5;
    PyprojectMetadata pyproject_metadata = 73;
    JavascriptPackageJSONMetadata javascript_metadata = 6;
    APKPackageMetadata apk_metadata = 7;
    DPKGPackageMetadata dpkg_metadata = 8;
    RPMPackageMetadata rpm_metadata = 9;
    COSPackageMetadata cos_metadata = 13;
    DEPSJSONMetadata depsjson_metadata = 40;
    SPDXPackageMetadata spdx_metadata = 14;
    JavaArchiveMetadata java_archive_metadata = 15;
    JavaLockfileMetadata java_lockfile_metadata = 31;
    PACMANPackageMetadata pacman_metadata = 36;
    NixPackageMetadata nix_metadata = 37;
    KernelModuleMetadata kernel_module_metadata = 38;
    VmlinuzMetadata vmlinuz_metadata = 39;
    PortagePackageMetadata portage_metadata = 41;
    OSVPackageMetadata osv_metadata = 16;
    NetportsMetadata netports_metadata = 45;
    PythonRequirementsMetadata python_requirements_metadata = 21;
    PythonSetupMetadata python_setup_metadata = 44;
    ContainerdContainerMetadata containerd_container_metadata = 22;
    SNAPPackageMetadata snap_metadata = 23;
    FlatpakPackageMetadata flatpak_metadata = 24;
    MacAppsMetadata mac_apps_metadata = 34;
    ContainerdRuntimeContainerMetadata containerd_runtime_container_metadata =
        25;
    CDXPackageMetadata cdx_metadata = 30;
    WindowsOSVersion windows_os_version_metadata = 33;
    HomebrewPackageMetadata homebrew_metadata = 42;
    ChromeExtensionsMetadata chrome_extensions_metadata = 47;
    VSCodeExtensionsMetadata vscode_extensions_metadata = 46;
    PodmanMetadata podman_metadata = 50;
    DockerContainersMetadata docker_containers_metadata = 48;
    MacportsPackageMetadata macports_metadata = 53;
    WingetPackageMetadata winget_metadata = 54;
    AsdfMetadata asdf_metadata = 55;
    NvmMetadata nvm_metadata = 56;
    NodeVersionMetadata nodeversion_metadata = 58;
    DepGroupMetadata dep_group_metadata = 61;
    ChocolateyPackageMetadata chocolatey_metadata = 62;
    MiseMetadata mise_metadata = 63;
    UnknownBinaryMetadata unknown_binary_metadata = 64;
    BazelMavenMetadata bazel_maven_metadata = 65;
    JavascriptDenoMetadata deno_metadata = 66;
    SpackPackageMetadata spack_metadata = 67;
  }

  // Signals to indicate that specific vulnerabilities are not applicable to
  // this package.
  repeated PackageExploitabilitySignal exploitability_signals = 51;

  // Software licenses information
  repeated string licenses = 52;

  message ContainerImageMetadataIndexes {
    // The index of ContainerImageMetadata in Inventory.ContainerImageMetadata
    // list.
    int32 container_image_index = 1;
    // The index of LayerMetadata in ContainerImageMetadata.LayerMetadata list.
    int32 layer_index = 2;
  }

  optional ContainerImageMetadataIndexes container_image_metadata_indexes = 57;

  // The ID of the parent package, if this package is a transitive dependency.
  repeated string parent_ids = 70;
}

// Paths or source of files related to an extracted package.
message PackageLocation {
  // Main descriptor this package was extracted from (if applicable).
  Location desc = 1;
  // Other locations related to this package, e.g. files installed by the OS
  // package.
  repeated Location related = 2;
}

// Additional identifiers for source code software packages (e.g. NPM).
message SourceCodeIdentifier {
  string repo = 1;
  string commit = 2;
}

// Details about the layer a package was found in.
message LayerDetails {
  // The index of the layer in the container image.
  int32 index = 1;
  // The diff ID (typically a sha256 hash) of the layer in the container image.
  string diff_id = 2;
  // The layer chain ID (sha256 hash) of the layer in the container image.
  // https://github.com/opencontainers/image-spec/blob/main/config.md#layer-chainid
  string chain_id = 5;
  // The layer build command that was used to build the layer. This may not be
  // found in all layers depending on how the container image is built.
  string command = 3;
  // Denotes whether the layer is in the base image.
  bool in_base_image = 4;
}

// PackageExploitabilitySignal is used to indicate that specific vulnerabilities
// are not applicable to a given package.
message PackageExploitabilitySignal {
  // The name of the plugin (e.g. Annotator) that added this signal.
  string plugin = 1;
  // Reason for exclusion.
  VexJustification justification = 2;
  oneof vuln_filter {
    // Advisory Identifier (CVE, GHSA, ...) and aliases of the vulns that are
    // not applicable to this package.
    VulnIdentifiers vuln_identifiers = 3;
    // Indicates that all vulnerabilities associated with the package are
    // irrelevant.
    bool matches_all_vulns = 4;
  }
}

message VulnIdentifiers {
  repeated string identifiers = 1;
}

// FindingExploitabilitySignal is used to indicate that a finding is not
// exploitable.
message FindingExploitabilitySignal {
  // The name of the plugin (e.g. Annotator) that added this signal.
  string plugin = 1;
  // Reason for exclusion.
  VexJustification justification = 2;
}

// Vuln exclusion reasons - Mirrors the format from the official VEX
// documentation
// (https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf)
enum VexJustification {
  VEX_JUSTIFICATION_UNSPECIFIED = 0;
  // The vulnerable component is not used in the affected artifact.
  COMPONENT_NOT_PRESENT = 1;
  // The component is used but vulnerable code was removed or not included.
  VULNERABLE_CODE_NOT_PRESENT = 2;
  // Vulnerable code is included but is not executed.
  VULNERABLE_CODE_NOT_IN_EXECUTE_PATH = 3;
  // Vulnerable code is executed but can't be exploited due to program logic.
  VULNERABLE_CODE_CANNOT_BE_CONTROLLED_BY_ADVERSARY = 4;
  // Code can be executed but additional mitigations prevent exploitation.
  INLINE_MITIGATION_ALREADY_EXISTS = 5;
}

// Package URL, see https://github.com/package-url/purl-spec
message Purl {
  // String representation.
  string purl = 1;
  // Package type, e.g. "maven, npm, pypi".
  string type = 2;
  // Package name.
  string name = 3;
  // Package version.
  string version = 4;
  // Name prefix such as a Maven groupid, or Docker image owner.
  string namespace = 5;
  // Extra qualifying data for a package such as an OS, architecture, etc.
  repeated Qualifier qualifiers = 6;
  // Extra subpath within a package, relative to the package root.
  string subpath = 7;
}

message Qualifier {
  string key = 1;
  string value = 2;
}

// Describes a vulnerability (e.g. a CVE) related to a package.
message PackageVuln {
  osv.Vulnerability vuln = 1;
  // The ID of the associated package in Inventory.Packages.
  // Used for mapping between proto and struct.
  string package_id = 2;
  // The plugins (e.g. Detectors, Enrichers) that found this vuln.
  repeated string plugins = 3;
  // Signals that indicate this finding is not exploitable.
  repeated FindingExploitabilitySignal exploitability_signals = 4;
}

// Describes generic security findings not associated with any
// specific package, e.g. weak credentials.
message GenericFinding {
  reserved 3;
  // Info specific to the finding. Should always be the same for the same type
  // of finding.
  GenericFindingAdvisory adv = 1;
  // Instance-specific info such as location of the vulnerable files.
  GenericFindingTargetDetails target = 2;
  // The plugins (e.g. Detectors, Enrichers) that found this vuln.
  repeated string plugins = 4;
  // Signals that indicate this finding is not exploitable.
  repeated FindingExploitabilitySignal exploitability_signals = 5;
}

// Describes a security finding and how to remediate it. It should not
// contain any information specific to the target (e.g. which files were
// found vulnerable).
message GenericFindingAdvisory {
  reserved 2, 6;
  // A unique ID for the finding.
  AdvisoryId id = 1;
  string title = 3;
  string description = 4;
  // Remediation instructions, e.g. "update to latest version".
  string recommendation = 5;
  SeverityEnum sev = 7;
}

// A unique identifier per advisory.
message AdvisoryId {
  string publisher = 1;  // e.g. "CVE".
  string reference = 2;  // e.g. "CVE-2023-1234".
}

enum SeverityEnum {
  SEVERITY_UNSPECIFIED = 0;
  MINIMAL = 1;
  LOW = 2;
  MEDIUM = 3;
  HIGH = 4;
  CRITICAL = 5;
}

// Instance-specific details about the generic security finding.
message GenericFindingTargetDetails {
  reserved 1, 2, 3;
  // Free-text info.
  string extra = 4;
}

// The additional data found in python packages.
message PythonPackageMetadata {
  string author = 1;
  string author_email = 2;
  repeated string requires_dist = 3;
}

message PyprojectMetadata {
  // Whether the manifest is declaring the "dependencies" property as dynamic.
  // When this is the case, the actual dependency list is found elsewhere,
  // and the metadata should be considered incomplete.
  bool has_dynamic_dependencies = 1;

  message DependencyGroup {
    string name = 1;
    repeated string dependencies = 2;
  }

  DependencyGroup dependencies = 2;
  repeated DependencyGroup optional_dependencies = 3;
}

// The additional data found in npm packages.
message JavascriptPackageJSONMetadata {
  message Dependency {
    string name = 1;
    string version_required = 2;
  }

  reserved 4;

  string author = 1;
  repeated string maintainers = 2;
  repeated string contributors = 3;
  PackageSource source = 5;
  repeated Dependency dependencies = 6;
}

// The source of the package.
enum PackageSource {
  UNKNOWN = 0;
  // PUBLIC_REGISTRY is the public NPM registry.
  PUBLIC_REGISTRY = 1;
  // OTHER is any other remote or private source (e.g. Github).
  // This is used for packages that are not found in the public NPM registry.
  OTHER = 2;
  // LOCAL is the local filesystem that stores the package versions.
  // This is used for when the package is locally-developed or -installed.
  LOCAL = 3;
}

// The additional data of a deno package.
message JavascriptDenoMetadata {
  oneof cdn {
    bool from_denoland_cdn = 1;
    bool from_unpkg_cdn = 2;
    bool from_esm_cdn = 3;
  }

  string url = 4;
}

// The additional data found in APK packages.
message APKPackageMetadata {
  reserved 7;

  string package_name = 1;
  string origin_name = 2;
  string os_id = 3;
  string os_version_id = 4;
  string maintainer = 5;
  string architecture = 6;

  reserved "license";
}

// The additional data found in DPKG packages.
// Next ID: 12
message DPKGPackageMetadata {
  string package_name = 1;
  string source_name = 2;
  string source_version = 3;
  string package_version = 4;
  string os_id = 5;
  string os_version_codename = 6;
  string os_version_id = 7;
  string maintainer = 8;
  string architecture = 9;
  string status = 10;
  string package_source = 11;
}

// The additional data found in RPM packages.
message RPMPackageMetadata {
  reserved 10;

  string package_name = 1;
  string source_rpm = 2;
  int32 epoch = 3;
  string os_id = 4;
  string os_version_id = 5;
  string os_build_id = 6;
  string os_name = 7;
  string vendor = 8;
  string architecture = 9;
  string os_pretty_name = 11;
  string os_cpe_name = 12;

  reserved "license";
}

// The additional data found in COS packages.
message COSPackageMetadata {
  string name = 1;
  string version = 2;
  string category = 3;
  string os_version = 4;
  string os_version_id = 5;
  string ebuild_version = 6;
}

// The additional data found in PACMAN packages.
message PACMANPackageMetadata {
  string package_name = 1;
  string package_version = 2;
  string os_id = 3;
  string os_version_id = 4;
  string package_description = 5;
  string package_dependencies = 6;
}

// The additional data found in Nix packages.
message NixPackageMetadata {
  string package_name = 1;
  string package_version = 2;
  string package_hash = 3;
  string package_output = 4;
  string os_id = 5;
  string os_version_codename = 6;
  string os_version_id = 7;
}

// The additional data found in .NET deps json packages.
message DEPSJSONMetadata {
  string package_name = 1;
  string package_version = 2;
  string type = 3;
}

// The additional data found in SNAP packages.
message SNAPPackageMetadata {
  string name = 1;
  string version = 2;
  string grade = 3;
  string type = 4;
  repeated string architectures = 5;
  string os_id = 6;
  string os_version_codename = 7;
  string os_version_id = 8;
}

// The additional data found in portage packages.
message PortagePackageMetadata {
  string package_name = 1;
  string package_version = 2;
  string os_id = 3;
  string os_version_id = 4;
}

// The additional data found in Flatpak packages.
message FlatpakPackageMetadata {
  string package_name = 1;
  string package_id = 2;
  string package_version = 3;
  string release_date = 4;
  string os_name = 5;
  string os_id = 6;
  string os_version_id = 7;
  string os_build_id = 8;
  string developer = 9;
}

// The additional data found in Spack packages.
message SpackPackageMetadata {
  string platform = 1;
  string platform_os = 2;
  string platform_architecture = 3;
  string hash = 4;
}

// The additional data found in MODULE packages.
message KernelModuleMetadata {
  string package_name = 1;
  string package_version = 2;
  string package_vermagic = 3;
  string package_source_version_identifier = 4;
  string os_id = 5;
  string os_version_codename = 6;
  string os_version_id = 7;
  string package_author = 8;
}

// The additional data found in Vmlinuz packages.
message VmlinuzMetadata {
  string name = 1;
  string version = 2;
  string architecture = 3;
  string extended_version = 4;
  string format = 5;
  int32 swap_device = 6;
  int32 root_device = 7;
  string video_mode = 8;
  string os_id = 9;
  string os_version_codename = 10;
  string os_version_id = 11;
  bool rw_root_fs = 12;
}

// The additional data found in Mac Applications.
message MacAppsMetadata {
  string bundle_display_name = 1;
  string bundle_identifier = 2;
  string bundle_short_version_string = 3;
  string bundle_executable = 4;
  string bundle_name = 5;
  string bundle_package_type = 6;
  string bundle_signature = 7;
  string bundle_version = 8;
  string product_id = 9;
  string update_url = 10;
}

// The additional data found in Macports packages.
message MacportsPackageMetadata {
  string package_name = 1;
  string package_version = 2;
  string package_revision = 3;
}

// An external reference to additional information about an SPDX package.
message SPDXExternalReference {
  string category = 1;
  string ref_type = 2;
  string locator = 3;
  string comment = 4;
}

// The additional data for packages extracted from SPDX files.
message SPDXPackageMetadata {
  Purl purl = 1;
  repeated string cpes = 2;
  repeated SPDXExternalReference external_references = 3;
  string spdx_id = 4;
}

// The additional data for packages extracted from CDX files.
message CDXPackageMetadata {
  Purl purl = 1;
  repeated string cpes = 2;
}

// The additional data found in Java JAR packages.
message JavaArchiveMetadata {
  string artifact_id = 2;
  string group_id = 3;
  string sha1 = 4;

  // dependencies and parent are populated only if extract_from_pom_xml is on.
  repeated JavaLockfileDependency dependencies = 5;
  JavaLockfileParent parent = 6;
}

// The additional data found in Java lockfiles.
message JavaLockfileMetadata {
  string artifact_id = 1;
  string group_id = 2;
  repeated string dep_group_vals = 3;
  bool is_transitive = 4;
}

message JavaLockfileDependency {
  string group_id = 1;
  string artifact_id = 2;
  // Empty, if it came from a version requirement that could not be resolved.
  string version_requirement = 3;
  string scope = 4;
  bool is_optional = 5;
}

message JavaLockfileParent {
  string group_id = 1;
  string artifact_id = 2;
  string version = 3;
}

// The additional data for packages extracted by an OSV extractor wrapper.
message OSVPackageMetadata {
  string purl_type = 1;
  string commit = 2;
  string ecosystem = 3;
  string compare_as = 4;
}

// The additional data for dependency groups.
message DepGroupMetadata {
  repeated string dep_group_vals = 1;
}

message PythonRequirementsMetadata {
  repeated string hash_checking_mode_values = 1;
  string version_comparator = 2;
  string requirement = 3;
}

message PythonSetupMetadata {
  string version_comparator = 2;
}

// Used to report open ports on a system.
message NetportsMetadata {
  uint32 port = 1;
  string protocol = 2;
  string command_line = 3;
}

message ContainerdContainerMetadata {
  string namespace_name = 1;
  string image_name = 2;
  string image_digest = 3;
  string runtime = 4;
  int32 pid = 5;
  string snapshotter = 6;
  string snapshot_key = 7;
  string lower_dir = 8;
  string upper_dir = 9;
  string work_dir = 10;
  string id = 11;
  string pod_name = 12;
  string pod_namespace = 13;
}

message ContainerdRuntimeContainerMetadata {
  string namespace_name = 1;
  string image_name = 2;
  string image_digest = 3;
  string runtime = 4;
  string id = 5;
  int32 pid = 6;
  string rootfs_path = 7;
}

message WindowsOSVersion {
  string product = 1;
  string full_version = 2;
}

// The additional data found in Homebrew packages.
message HomebrewPackageMetadata {
  string url = 1;
  string head = 2;
  repeated string mirrors = 3;
}

// The additional data found in Chrome extensions.
message ChromeExtensionsMetadata {
  string name = 1;
  string description = 2;
  string author_email = 3;
  repeated string host_permissions = 4;
  int32 manifest_version = 5;
  string minimum_chrome_version = 6;
  repeated string permissions = 7;
  string update_url = 8;
}

// The additional data found in VSCode extensions.
message VSCodeExtensionsMetadata {
  string id = 1;
  string publisher_id = 2;
  string publisher_display_name = 3;
  string target_platform = 4;
  bool updated = 5;
  bool is_pre_release_version = 6;
  int64 installed_timestamp = 7;
}

// The additional data found in Podman containers.
message PodmanMetadata {
  map<uint32, Protocol> exposed_ports = 1;
  int32 pid = 2;
  string namespace_name = 3;
  google.protobuf.Timestamp started_time = 4;
  google.protobuf.Timestamp finished_time = 5;
  string status = 6;
  int32 exit_code = 7;
  bool exited = 8;
}

// The additional data found in Chocolatey packages.
message ChocolateyPackageMetadata {
  string name = 1;
  string version = 2;
  string authors = 3;
  string licenseurl = 4;
  string projecturl = 5;
  string tags = 6;
}

message Protocol {
  repeated string names = 1;
}

message DockerContainersMetadata {
  string image_name = 1;
  string image_digest = 2;
  string id = 3;
  repeated DockerPort ports = 4;
}

message AsdfMetadata {
  string tool_name = 1;
  string tool_version = 2;
}

message MiseMetadata {
  string tool_name = 1;
  string tool_version = 2;
}

message NvmMetadata {
  string nodejs_version = 2;
}

message NodeVersionMetadata {
  string nodejs_version = 2;
}

message BazelMavenMetadata {
  string name = 1;
  string group_id = 2;
  string artifact_id = 3;
  string version = 4;
  string rule_name = 5;
}

message DockerPort {
  string ip = 1;
  uint32 private_port = 2;
  uint32 public_port = 3;
  string type = 4;
}

// The additional data found in Windows Package Manager (Winget) packages.
message WingetPackageMetadata {
  string name = 1;
  string id = 2;
  string version = 3;
  string moniker = 4;
  string channel = 5;
  repeated string tags = 6;
  repeated string commands = 7;
}

// Additional data attributed to unknown binaries.
message UnknownBinaryMetadata {
  string file_hash = 1;
  UnknownBinaryAttribution attribution = 2;
}

// Data about attributing a binary to a known base image.
message UnknownBinaryAttribution {
  bool local_filesystem = 1;
  bool base_image = 2;
}

// A secret (i.e. credential) found by Veles secret scanning.
message Secret {
  SecretData secret = 1;
  SecretStatus status = 2;
  // TODO(b/400910349): Remove once integrators no longer use this.
  repeated LocationLegacy locations = 3 [deprecated = true];
  Location location = 4;
}

message SecretData {
  oneof secret {
    GCPSAK gcpsak = 1;
    AnthropicWorkspaceAPIKey anthropic_workspace_api_key = 2;
    AnthropicModelAPIKey anthropic_model_api_key = 3;
    PerplexityAPIKey perplexity = 4;
    PrivateKey private_key = 5;
    GrokXAIAPIKey grok_xai_api_key = 6;
    GrokXAIManagementAPIKey grok_xai_management_api_key = 7;
    DockerHubPat docker_hub_pat = 8;
    DigitalOceanAPIToken digitalocean = 9;
    OpenAIAPIKey openai_api_key = 10;
    PostmanAPIKey postman_api_key = 11;
    PostmanCollectionAccessToken postman_collection_access_token = 12;
    AzureAccessToken azure_access_token = 13;
    AzureIdentityToken azure_identity_token = 14;
    TinkKeyset tink_keyset = 15;
    GitlabPat gitlab_pat = 16;
    HashiCorpVaultToken hashicorp_vault_token = 17;
    HashiCorpVaultAppRoleCredentials hashicorp_vault_app_role_credentials = 18;
    GCPAPIKey gcp_api_key = 19;
    HuggingfaceAPIKey hugginface = 20;
    GithubAppRefreshToken github_app_refresh_token = 21;
    StripeSecretKey stripe_secret_key = 22;
    StripeRestrictedKey stripe_restricted_key = 23;
    StripeWebhookSecret stripe_webhook_secret = 24;
    GCPOAuth2ClientCredentials gcp_oauth2_client_credentials = 25;
    GCPOAuth2AccessToken gcp_oauth2_access_token = 26;
    GithubAppServerToServerToken github_app_server_to_server_token = 27;
    GithubClassicPersonalAccessToken github_classic_personal_access_token = 28;
    GithubFineGrainedPersonalAccessToken
        github_fine_grained_personal_access_token = 29;
    GithubAppUserToServerToken github_app_user_to_server_token = 30;
    GithubOAuthToken github_oauth_token = 31;
    OpenRouterAPIKey openrouter_api_key = 32;
    SlackAppConfigRefreshToken slack_app_config_refresh_token = 33;
    SlackAppLevelToken slack_app_level_token = 34;
    SlackAppConfigAccessToken slack_app_config_access_token = 35;
    AzureStorageAccountAccessKey azure_storage_account_access_key = 36;
    HashiCorpCloudPlatformCredentials hashicorp_cloud_platform_credentials = 37;
    HashiCorpCloudPlatformToken hashicorp_cloud_platform_token = 38;
    OnePasswordSecretKey onepassword_secret_key = 39;
    OnePasswordServiceToken onepassword_service_token = 40;
    OnePasswordRecoveryCode onepassword_recovery_code = 41;
    OnePasswordConnectToken onepassword_connect_token = 42;
    Pgpass pgpass = 43;
    PyPIAPIToken pypi = 44;
    CratesIOAPIToken crates_io_api_token = 45;
    MariaDBCredentials maria_db_credentials = 46;
    GCSHmacKey gcs_hmac_key = 47;
    MysqlMyloginSection mysql_mylogin_section = 48;
    VapidKey vapid_key = 49;
    AwsAccessKeyCredentials aws_access_key_credentials = 50;
    ReCaptchaKey re_captcha_key = 51;
    PyxKeyV1 pyx_key_v1 = 52;
    PyxKeyV2 pyx_key_v2 = 53;
    CodeCatalystCredentials code_catalyst_credentials = 54;
    JWTToken jwt_token = 55;
    CodeCommitCredentials code_commit_credentials = 56;
    BitBucketCredentials bitbucket_credentials = 57;
    PaystackSecretKey paystack_secret_key = 58;
    TelegramBotToken telegram_bot_api_token = 59;
    CursorAPIKey cursor_api_key = 60;
    ElasticCloudAPIKey elastic_cloud_api_key = 61;
    URLCredentials url_credentials = 62;
    SalesforceOAuth2ClientCredentials salesforce_oauth2_client_credentials = 63;
    SalesforceOAuth2AccessToken salesforce_oauth2_access_token = 64;
    SalesforceOAuth2RefreshCredentials salesforce_oauth2_refresh_credentials =
        65;
    MistralAPIKey mistral_api_key = 66;
    CircleCIPersonalAccessToken circleci_personal_access_token = 67;
    CircleCIProjectToken circleci_project_token = 68;
    SquarePersonalAccessToken square_personal_access_token = 69;
    SquareOAuthApplicationSecret square_oauth_application_secret = 70;
    SalesforceOAuth2JWTCredentials salesforce_oauth2_jwt_credentials = 71;
    SendGridAPIKey sendgrid_api_key = 72;
    DenoPat deno_pat = 73;
    HerokuSecretKey heroku_secret_key = 74;
    NpmJsAccessToken npmjs_access_token = 75;
    CloudflareAPIToken cloudflare_api_token = 76;
    SupabasePAT supabase_pat = 77;
    SupabaseProjectSecretKey supabase_project_secret_key = 78;
    SupabaseServiceRoleJWT supabase_service_role_jwt = 79;
    PackagistAPIKey packagist_api_key = 80;
    PackagistAPISecret packagist_api_secret = 81;
    PackagistOrgReadToken packagist_org_read_token = 82;
    PackagistOrgUpdateToken packagist_org_update_token = 83;
    PackagistUserUpdateToken packagist_user_update_token = 84;
    PackagistConductorUpdateToken packagist_conductor_update_token = 85;
    ComposerPackagistCredentials composer_http_basic_credentials = 86;
    DiscordBotToken discord_bot_token = 87;
    BitwardenOAuth2AccessToken bitwarden_oauth2_access_token = 88;
    HTTPBasicAuth http_basic_auth = 89;
    HTTPBearer http_bearer = 90;
    HTTPCSRFToken http_csrf_token = 91;
    HTTPCookie http_cookie = 92;
  }

  message GCPSAK {
    // Always filled.
    string private_key_id = 1;
    string client_email = 2;
    bytes signature = 3;  // derived from the private_key for validation

    // Filled only when explicitly requested.
    string type = 4;
    string project_id = 5;
    string client_id = 6;
    string auth_uri = 7;
    string token_uri = 8;
    string auth_provider_x509_cert_url = 9;
    string client_x509_cert_url = 10;
    string universe_domain = 11;

    // Should not be filled out unless very explicitly requested accepting the
    // risk that this might accidentally leak the key.
    string private_key = 12;
  }

  message JWTToken {
    // a generic JWT token
    string token = 1;
  }

  message AnthropicWorkspaceAPIKey {
    // The Anthropic Workspace API key (contains "admin01").
    string key = 1;
  }

  message AnthropicModelAPIKey {
    // The Anthropic Model API key (regular API key for model access).
    string key = 1;
  }

  message PerplexityAPIKey {
    string key = 1;
  }

  message MistralAPIKey {
    string key = 1;
  }

  message GrokXAIAPIKey {
    string key = 1;
  }

  message GrokXAIManagementAPIKey {
    string key = 1;
  }

  message AzureStorageAccountAccessKey {
    string key = 1;
  }

  message PrivateKey {
    string block = 1;  // PEM/OpenSSH private key block
    bytes der = 2;     // DER-encoded key material
  }

  message AzureAccessToken {
    string token = 1;
  }

  message Pgpass {
    string hostname = 1;
    string port = 2;
    string database = 3;
    string username = 4;
    string password = 5;
  }

  message MariaDBCredentials {
    string host = 1;
    string port = 2;
    string user = 4;
    string password = 5;
    string section = 6;
  }

  message AzureIdentityToken {
    string token = 1;
  }

  message OpenAIAPIKey {
    string key = 1;
  }

  message DockerHubPat {
    string pat = 1;
    string username = 2;
  }

  message CloudflareAPIToken {
    string token = 1;
  }

  message DenoPat {
    string pat = 1;
  }

  message GitlabPat {
    string pat = 1;
  }

  message SlackAppLevelToken {
    string token = 1;
  }

  message SlackAppConfigAccessToken {
    string token = 1;
  }

  message SlackAppConfigRefreshToken {
    string token = 1;
  }

  message PostmanAPIKey {
    string key = 1;
  }

  message PostmanCollectionAccessToken {
    string key = 1;
  }

  message OpenRouterAPIKey {
    string key = 1;
  }

  message DigitalOceanAPIToken {
    string key = 1;
  }

  message CratesIOAPIToken {
    string token = 1;
  }

  message NpmJsAccessToken {
    string token = 1;
  }

  message GithubAppRefreshToken {
    string token = 1;
  }

  message GithubAppServerToServerToken {
    string token = 1;
  }

  message GithubClassicPersonalAccessToken {
    string token = 1;
  }

  message GithubFineGrainedPersonalAccessToken {
    string token = 1;
  }

  message GithubOAuthToken {
    string token = 1;
  }

  message GithubAppUserToServerToken {
    string token = 1;
  }

  message PyPIAPIToken {
    string token = 1;
  }

  message TinkKeyset {
    string content = 1;  // JSON encoded Tink keyset
  }

  message HashiCorpVaultToken {
    string token = 1;
  }

  message HashiCorpVaultAppRoleCredentials {
    reserved 3;
    string role_id = 1;
    string secret_id = 2;
  }

  message GCPAPIKey {
    string key = 1;
  }

  message HuggingfaceAPIKey {
    string key = 1;
    string role = 2;
    repeated string fine_grained_scope = 3;
  }

  message HashiCorpCloudPlatformCredentials {
    string client_id = 1;
    string client_secret = 2;
  }

  message HashiCorpCloudPlatformToken {
    string token = 1;
    // Optional identity enrichment fields populated when available
    string organization_id = 2;
    string project_id = 3;
    string principal_id = 4;
    string principal_type = 5;
    string service_name = 6;
    string user_id = 7;
    string user_email = 8;
    repeated string group_ids = 9;
  }

  message StripeSecretKey {
    string key = 1;
  }

  message StripeRestrictedKey {
    string key = 1;
  }

  message StripeWebhookSecret {
    string key = 1;
  }

  message SupabasePAT {
    string token = 1;
  }

  message SupabaseProjectSecretKey {
    string key = 1;
    string project_ref = 2;
  }

  message SupabaseServiceRoleJWT {
    string token = 1;
  }

  message GCPOAuth2ClientCredentials {
    // GCP OAuth2 client ID in format:
    // `12345678901-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com`
    string id = 1;
    // GCP OAuth2 client secret, typically 24+ character alphanumeric string
    // prefixed with `GOCSPX-`
    string secret = 2;
  }

  message GCPOAuth2AccessToken {
    // GCP OAuth2 access token, typically in format:
    // "ya29.[alphanumeric_string]"
    string token = 1;
  }

  message GCSHmacKey {
    string access_id = 1;
    string secret = 2;
  }

  message MysqlMyloginSection {
    string section_name = 1;
    string user = 2;
    string password = 3;
    string host = 4;
    string port = 5;
    string socket = 6;
  }

  message VapidKey {
    string private_b64 = 1;
    string public_b64 = 2;
  }

  message OnePasswordConnectToken {
    // Device UUID from the token JSON.
    string device_uuid = 1;
    // Version field from the token JSON.
    string version = 2;
    // Encrypted payload data (from encCredentials.data).
    string encrypted_data = 3;
    // Key ID used to encrypt the credentials (encCredentials.kid).
    string encryption_key_id = 4;
    // Initialization vector (encCredentials.iv).
    string iv = 5;
    // Unique key kid (uniqueKey.kid).
    string unique_key_id = 6;
    // Verifier salt (verifier.salt).
    string verifier_salt = 7;
    // Verifier local hash (verifier.localHash).
    string verifier_local_hash = 8;
  }

  message ComposerPackagistCredentials {
    string host = 1;
    string username = 2;
    string password = 3;
  }

  message PackagistAPIKey {
    string key = 1;
  }

  message PackagistAPISecret {
    string secret = 1;
    string key =
        2;  // Optional: populated when both key and secret are found together
  }

  message PackagistOrgReadToken {
    string token = 1;
    string repo_url = 2;  // Optional: populated when repo URL is found nearby
  }

  message PackagistOrgUpdateToken {
    string token = 1;
    string repo_url = 2;  // Optional: populated when repo URL is found nearby
  }

  message PackagistUserUpdateToken {
    string token = 1;
    string username = 2;  // Required for validation
    string repo_url = 3;  // Optional: populated when repo URL is found nearby
  }

  message PackagistConductorUpdateToken {
    string token = 1;
  }

  message OnePasswordSecretKey {
    string key = 1;
  }
  message OnePasswordServiceToken {
    string key = 1;
  }

  message OnePasswordRecoveryCode {
    string key = 1;
  }

  message AwsAccessKeyCredentials {
    string access_id = 1;
    string secret = 2;
  }

  message ReCaptchaKey {
    string secret = 1;
  }
  message PyxKeyV1 {
    string key = 1;
  }

  message PyxKeyV2 {
    string key = 1;
  }

  message CodeCatalystCredentials {
    string url = 1;
  }

  message CodeCommitCredentials {
    string url = 1;
  }

  message BitBucketCredentials {
    string url = 1;
  }

  message ElasticCloudAPIKey {
    string key = 1;
  }

  message PaystackSecretKey {
    string key = 1;
  }

  message DiscordBotToken {
    string token = 1;
  }

  message HerokuSecretKey {
    string key = 1;
    // Optional enrichment fields populated when available
    optional HerokuSecretKeyMetadata heroku_secret_key_metadata = 2;
  }

  message HerokuSecretKeyMetadata {
    // expire_time is nil if the token doesn't expire, and never_expires becomes
    // true
    google.protobuf.Duration expire_time = 1;
    bool never_expires = 2;
  }

  message TelegramBotToken {
    string token = 1;
  }

  message SalesforceOAuth2AccessToken {
    // Salesforce OAuth2 Access Token
    string token = 1;
  }

  message SendGridAPIKey {
    string key = 1;
  }

  message SalesforceOAuth2ClientCredentials {
    // Salesforce OAuth2 client ID
    string id = 1;
    // Salesforce OAuth2 client secret
    string secret = 2;
    // Salesforce instance URL
    string url = 3;
  }

  message SalesforceOAuth2RefreshCredentials {
    // Salesforce OAuth2 client ID
    string id = 1;
    // Salesforce OAuth2 client secret
    string secret = 2;
    // Salesforce OAuth2 Refresh Token
    string refresh = 3;
  }

  message SalesforceOAuth2JWTCredentials {
    // Salesforce OAuth2 client ID
    string id = 1;
    // Salesforce username (email)
    string username = 2;
    // Salesforce OAuth2 private key
    string private_key = 3;
  }

  message BitwardenOAuth2AccessToken {
    // Bitwarden OAuth2 Access Token
    string client_id = 1;
    string client_secret = 2;
  }

  message HTTPBasicAuth {
    string username = 1;
    string password = 2;
  }

  message HTTPBearer {
    string value = 1;
  }

  message HTTPCSRFToken {
    string value = 1;
  }

  message HTTPCookie {
    map<string, string> values = 1;
  }

  message CursorAPIKey {
    string key = 1;
  }

  message CircleCIPersonalAccessToken {
    string token = 1;
  }

  message CircleCIProjectToken {
    string token = 1;
  }

  message URLCredentials {
    string url = 1;
  }

  message SquarePersonalAccessToken {
    string key = 1;
  }

  message SquareOAuthApplicationSecret {
    string id = 1;   // OAuth Application ID (prefix: sq0idp-)
    string key = 2;  // OAuth Application Secret (prefix: sq0csp-)
  }
}

message SecretStatus {
  SecretStatusEnum status = 1;
  google.protobuf.Timestamp last_updated = 2;

  enum SecretStatusEnum {
    // The default value for SecretStatusEnum. Set when no validation was
    // attempted.
    UNSPECIFIED = 0;
    // Deprecated. Use UNSPECIFIED instead.
    UNKNOWN = 1 [deprecated = true];
    // The secret is confirmed to be invalid.
    INVALID = 2;
    // The secret is confirmed to be valid.
    VALID = 3;
    // Validating the secret is not supported by the scanner.
    UNSUPPORTED = 4;
    // Validation is supported but the validation failed.
    FAILED = 5;
  }
}

// The old Location message type used for secrets and sensitive data.
// TODO(b/400910349): Deprecate this in favor of the Location message.
message LocationLegacy {
  oneof location {
    Filepath filepath = 1;
    FilepathWithLayerDetails filepath_with_layer_details = 2;
    EnvironmentVariable environment_variable = 3;
    ContainerCommand container_command = 4;
  }
}

message Filepath {
  string path = 1;
}

message FilepathWithLayerDetails {
  string path = 1;
  LayerDetails layer_details = 2;
}

message EnvironmentVariable {
  string name = 1;
}

message ContainerCommand {
  string command = 1;
}

message Location {
  File file = 1;
}

message File {
  string path = 1;
  // The specific position of the inventory item inside the file.
  int32 line_number = 2;
}

message ContainerImageMetadata {
  int32 index = 1;
  // Layers are ordered from the earliest to the latest.
  repeated LayerMetadata layer_metadata = 2;
  // The base images that make up the chain.
  // The first base image is always empty, acting as a placeholder for the
  // scanned image itself. If the scanned image is a base image, there will be
  // no layers pointing to the first base image.
  //
  // The base images are ordered from the biggest base image containing all base
  // images to the smallest. e.g. [empty, postgresql, alpine]
  repeated BaseImageChain base_image_chains = 3;

  // Key value map of OS info from /etc/os-release.
  map<string, string> os_info = 4;

  // Labels of the container image.
  map<string, string> labels = 5;
}

message BaseImageChain {
  // List of potential base images (repositories that have a matching ChainID).
  repeated BaseImageDetails base_images = 1;
  // Chain ID of the last layer in the image.
  string chain_id = 2;
}

message BaseImageDetails {
  // Name of the image. (e.g. `debian`, `circleci/node`)
  string repository = 1;
  // Name of the registry. (e.g. `docker.io`, `ghcr.io`)
  string registry = 2;
  // Name of the plugin used to extract the base image.
  string plugin = 3;
}

message LayerMetadata {
  // The index of the layer within the ContainerImageMetadata.layer_metadata
  // field.
  int32 index = 1;
  string diff_id = 2;
  string chain_id = 3;
  // The command that was used to build the layer.
  string command = 4;
  // Whether the layer is empty (currently always false).
  bool is_empty = 5;
  // The index of the base image match within the
  // ContainerImageMetadata.base_image_chains field.
  int32 base_image_index = 6;
}

message InfoType {
  string name = 1;
  SensitivityLevel sensitivity = 2;
}

enum SensitivityLevel {
  SENSITIVITY_LEVEL_UNSPECIFIED = 0;
  SENSITIVITY_LEVEL_LOW = 1;
  SENSITIVITY_LEVEL_UNKNOWN = 2;
  SENSITIVITY_LEVEL_MODERATE = 3;
  SENSITIVITY_LEVEL_HIGH = 4;
}

enum Likelihood {
  LIKELIHOOD_UNSPECIFIED = 0;
  LIKELIHOOD_VERY_UNLIKELY = 1;
  LIKELIHOOD_UNLIKELY = 2;
  LIKELIHOOD_POSSIBLE = 3;
  LIKELIHOOD_LIKELY = 4;
  LIKELIHOOD_VERY_LIKELY = 5;
}

// Sensitive Information found via the Veles sensitive information detectors.
message SensitiveInformation {
  InfoType info_type = 1;
  Likelihood likelihood = 2;
  bytes raw = 3;
  Location location = 4;
}