Added detector for JFrog Artifactory Reference Tokens

[shahzadhaider1]

Summary

Adds a new detector for JFrog Artifactory Reference Tokens. Unlike JWT tokens (which start with eyJ), reference tokens are base64-encoded strings with a predictable structure:

reftkn:01:<expiry>:<random_data>

When base64-encoded, this always produces a token starting with cmVmdGtu.

Detection

Regex pattern:

\b(cmVmdGtu[A-Za-z0-9]{56})\b

• Fixed prefix: cmVmdGtu (8 chars): base64 encoding of "reftkn"
• Variable suffix: 56 alphanumeric characters
• Total length: exactly 64 characters

Keyword: cmVmdGtu

Verification

Tokens are verified against the JFrog Access API:

GET https://<host>/access/api/v1/tokens/me
Authorization: Bearer <token>

This endpoint returns token metadata if valid. Available since Artifactory 7.53.1.

Response handling:

Status	Meaning	Result
200 + JSON	Valid token	Verified
200 + HTML	Invalid subdomain (redirects to login page)	Skip host
403	Valid token, insufficient permissions	Verified
401	Invalid or expired token	Not verified
404	Endpoint not found (old Artifactory version)	Verification error

References

• JFrog: What is a Reference Token?
• JFrog REST API: Get Token by ID

Checklist:

• Tests passing (make test-community)?
• Lint passing (make lint this requires golangci-lint)?

[mustansir14]

LGTM.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}