feat(masker): add support for Anthropic, OpenAI, and Supabase API keys

Add new patterns to --mask-secrets for masking:
- Anthropic API Keys (sk-ant-...)
- OpenAI API Keys (sk-... and sk-proj-...)
- Supabase Secret Keys (sb_secret_...)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: koki-develop

README.md

@@ -112,6 +112,9 @@ Supported patterns:
 - GitHub Tokens (`ghp_`, `gho_`, `ghs_`, `ghr_`)
 - GitLab Personal Access Tokens
 - Slack Tokens
+- Anthropic API Keys
+- OpenAI API Keys
+- Supabase Secret Keys
 - JWT Tokens
 - Private Key Headers
 

internal/masker/masker.go

@@ -14,6 +14,12 @@ var patterns = []*regexp.Regexp{
 	regexp.MustCompile(`glpat-[a-zA-Z0-9\-_]{20,}`),
 	// Slack Tokens
 	regexp.MustCompile(`xox[baprs]-[0-9a-zA-Z\-]+`),
+	// Anthropic API Key (must be before OpenAI to avoid false matches)
+	regexp.MustCompile(`sk-ant-[a-zA-Z0-9\-_]+`),
+	// OpenAI API Key (both legacy sk- and new sk-proj- formats)
+	regexp.MustCompile(`sk-(?:proj-)?[a-zA-Z0-9_\-]{20,}`),
+	// Supabase Secret Key
+	regexp.MustCompile(`sb_secret_[a-zA-Z0-9\-_]+`),
 	// JWT Tokens
 	regexp.MustCompile(`eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*\.[a-zA-Z0-9_-]*`),
 	// Private Key Headers

internal/masker/masker_test.go

@@ -38,6 +38,26 @@ func TestMask(t *testing.T) {
 			input: "SLACK_TOKEN=xoxb-123456789-abcdefgh",
 			want:  "SLACK_TOKEN=" + strings.Repeat("*", 23),
 		},
+		{
+			name:  "Anthropic API Key",
+			input: "ANTHROPIC_API_KEY=sk-ant-api03-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+			want:  "ANTHROPIC_API_KEY=" + strings.Repeat("*", 57),
+		},
+		{
+			name:  "OpenAI API Key (legacy)",
+			input: "OPENAI_API_KEY=sk-1234567890_abcdef-1234567890_abcdef-1234567890",
+			want:  "OPENAI_API_KEY=" + strings.Repeat("*", 49),
+		},
+		{
+			name:  "OpenAI API Key (project)",
+			input: "OPENAI_API_KEY=sk-proj-abcd_1234-efgh_5678-ijkl_9012-mnop",
+			want:  "OPENAI_API_KEY=" + strings.Repeat("*", 42),
+		},
+		{
+			name:  "Supabase Secret Key",
+			input: "SUPABASE_KEY=sb_secret_1234567890abcdef1234567890abcdef",
+			want:  "SUPABASE_KEY=" + strings.Repeat("*", 42),
+		},
 		{
 			name:  "JWT Token",
 			input: "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U",