Populate SecretParts on all detectors (#4919)

* Populate SecretParts on single-part detectors

Adds SecretParts: map[string]string{"key": <secret>} to every detector
package that constructs detectors.Result with a single captured secret
value. This is the single-part half of the SecretParts migration (the
linter's common case, ~695 packages).

* Populate SecretParts on multi-part detectors

pkg/detectors/abstract/abstract.go

@@ -53,6 +53,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Abstract,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/abuseipdb/abuseipdb.go

@@ -56,6 +56,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AbuseIPDB,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/abyssale/abyssale.go

@@ -54,6 +54,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Abyssale,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/accuweather/v1/accuweather.go

@@ -56,6 +56,7 @@ func (s Scanner) ProcessMatches(ctx context.Context, matches [][]string, verify
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Accuweather,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/adafruitio/adafruitio.go

@@ -54,6 +54,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AdafruitIO,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/adobeio/adobeio.go

@@ -55,6 +55,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				DetectorType: detector_typepb.DetectorType_AdobeIO,
 				Raw:          []byte(key),
 				RawV2:        []byte(key + id),
+				SecretParts: map[string]string{
+					"key": key,
+					"id":  id,
+				},
 			}
 
 			if verify {

pkg/detectors/adzuna/adzuna.go

@@ -59,7 +59,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Adzuna,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 
 			if verify {

pkg/detectors/aeroworkflow/aeroworkflow.go

@@ -60,7 +60,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Aeroworkflow,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 
 			if verify {

pkg/detectors/agora/agora.go

@@ -67,7 +67,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Agora,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resSecret),
+				SecretParts: map[string]string{
+					"key":    resMatch,
+					"secret": resSecret,
+				},
+				RawV2: []byte(resMatch + resSecret),
 			}
 
 			if verify {

pkg/detectors/aha/aha.go

@@ -73,7 +73,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Aha,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + url),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"url": url,
+				},
+				RawV2: []byte(resMatch + url),
 			}
 
 			if verify {

pkg/detectors/airship/airship.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Airship,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/airvisual/airvisual.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AirVisual,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/aiven/aiven.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Aiven,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/alchemy/alchemy.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Alchemy,
 			Raw:          []byte(match),
+			SecretParts:  map[string]string{"key": match},
 		}
 
 		if verify {

pkg/detectors/alconost/alconost.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Alconost,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/alegra/alegra.go

@@ -58,7 +58,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Alegra,
 				Raw:          []byte(token),
-				RawV2:        []byte(token + ":" + id),
+				SecretParts: map[string]string{
+					"token": token,
+					"id":    id,
+				},
+				RawV2: []byte(token + ":" + id),
 			}
 
 			if verify {

pkg/detectors/aletheiaapi/aletheiaapi.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AletheiaApi,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/algoliaadminkey/algoliaadminkey.go

@@ -77,7 +77,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			r := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AlgoliaAdminKey,
 				Raw:          []byte(key),
-				RawV2:        []byte(id + ":" + key),
+				SecretParts: map[string]string{
+					"id":  id,
+					"key": key,
+				},
+				RawV2: []byte(id + ":" + key),
 			}
 
 			if verify {

pkg/detectors/alibaba/alibaba.go

@@ -105,7 +105,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Alibaba,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 
 			if verify {

pkg/detectors/alienvault/alienvault.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AlienVault,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/allsports/allsports.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Allsports,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/amadeus/amadeus.go

@@ -55,7 +55,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Amadeus,
 				Raw:          []byte(key),
-				RawV2:        []byte(key + secret),
+				SecretParts: map[string]string{
+					"key":    key,
+					"secret": secret,
+				},
+				RawV2: []byte(key + secret),
 			}
 
 			if verify {

pkg/detectors/ambee/ambee.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Ambee,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/amplitudeapikey/amplitudeapikey.go

@@ -59,7 +59,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AmplitudeApiKey,
 				Raw:          []byte(key),
-				RawV2:        []byte(key + secret),
+				SecretParts: map[string]string{
+					"key":    key,
+					"secret": secret,
+				},
+				RawV2: []byte(key + secret),
 			}
 
 			if verify {

pkg/detectors/anypoint/anypoint.go

@@ -59,7 +59,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Anypoint,
 				Raw:          []byte(key),
-				RawV2:        []byte(key + org),
+				SecretParts: map[string]string{
+					"key":          key,
+					"organization": org,
+				},
+				RawV2: []byte(key + org),
 			}
 
 			if verify {

pkg/detectors/apacta/apacta.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Apacta,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/api2cart/api2cart.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Api2Cart,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apideck/apideck.go

@@ -54,7 +54,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_ApiDeck,
 				Raw:          []byte(key),
-				RawV2:        []byte(key + id),
+				SecretParts: map[string]string{
+					"key": key,
+					"id":  id,
+				},
+				RawV2: []byte(key + id),
 			}
 
 			if verify {

pkg/detectors/apiflash/apiflash.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Apiflash,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apifonica/apifonica.go

@@ -53,6 +53,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_ApiFonica,
 				Raw:          []byte(key),
+				SecretParts:  map[string]string{"key": key},
 			}
 
 			if verify {

pkg/detectors/apify/apify.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Apify,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apilayer/apilayer.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Apilayer,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apimatic/apimatic.go

@@ -48,6 +48,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_APIMatic,
 			Raw:          []byte(apiKey),
+			SecretParts:  map[string]string{"key": apiKey},
 		}
 
 		if verify {

pkg/detectors/apimetrics/apimetrics.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_ApiMetrics,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apitemplate/apitemplate.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_APITemplate,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/apollo/apollo.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Apollo,
 			Raw:          []byte(key),
+			SecretParts:  map[string]string{"key": key},
 		}
 
 		if verify {

pkg/detectors/appcues/appcues.go

@@ -58,7 +58,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				s1 := detectors.Result{
 					DetectorType: detector_typepb.DetectorType_Appcues,
 					Raw:          []byte(resMatch),
-					RawV2:        []byte(resMatch + resUserMatch),
+					SecretParts: map[string]string{
+						"key":      resMatch,
+						"username": resUserMatch,
+					},
+					RawV2: []byte(resMatch + resUserMatch),
 				}
 				if verify {
 					isVerified, err := verifyMatch(ctx, client, resUserMatch, resMatch, resIdMatch)

pkg/detectors/appfollow/appfollow.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Appfollow,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/appointedd/appointedd.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Appointedd,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 		if verify {
 			isVerified, err := verifyMatch(ctx, client, resMatch)

pkg/detectors/appoptics/appoptics.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AppOptics,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/appsynergy/appsynergy.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AppSynergy,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/apptivo/apptivo.go

@@ -50,7 +50,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Apptivo,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 
 			if verify {

pkg/detectors/artsy/artsy.go

@@ -52,7 +52,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Artsy,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 
 			if verify {

pkg/detectors/assemblyai/assemblyai.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AssemblyAI,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/atera/atera.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Atera,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/audd/audd.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Audd,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/auth0managementapitoken/auth0managementapitoken.go

@@ -58,7 +58,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				DetectorType: detector_typepb.DetectorType_Auth0ManagementApiToken,
 				Redacted:     domainRes,
 				Raw:          []byte(managementAPITokenRes),
-				RawV2:        []byte(managementAPITokenRes + domainRes),
+				SecretParts: map[string]string{
+					"token":  managementAPITokenRes,
+					"domain": domainRes,
+				},
+				RawV2: []byte(managementAPITokenRes + domainRes),
 			}
 
 			if verify {

pkg/detectors/auth0oauth/auth0oauth.go

@@ -59,7 +59,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 					DetectorType: detector_typepb.DetectorType_Auth0oauth,
 					Redacted:     clientIdRes,
 					Raw:          []byte(clientSecretRes),
-					RawV2:        []byte(clientIdRes + clientSecretRes),
+					SecretParts: map[string]string{
+						"client_id":     clientIdRes,
+						"client_secret": clientSecretRes,
+					},
+					RawV2: []byte(clientIdRes + clientSecretRes),
 				}
 
 				if verify {

pkg/detectors/autodesk/autodesk.go

@@ -49,7 +49,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Autodesk,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resSecret),
+				SecretParts: map[string]string{
+					"key":    resMatch,
+					"secret": resSecret,
+				},
+				RawV2: []byte(resMatch + resSecret),
 			}
 
 			if verify {

pkg/detectors/autoklose/autoklose.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Autoklose,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/autopilot/autopilot.go

@@ -41,6 +41,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AutoPilot,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/avazapersonalaccesstoken/avazapersonalaccesstoken.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AvazaPersonalAccessToken,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/aviationstack/aviationstack.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_AviationStack,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/aws/session_keys/sessionkey.go

@@ -128,9 +128,14 @@ func (s scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				s1 := detectors.Result{
 					DetectorType: detector_typepb.DetectorType_AWSSessionKey,
 					Raw:          []byte(idMatch),
-					RawV2:        []byte(fmt.Sprintf("%s:%s:%s", idMatch, secretMatch, sessionMatch)),
+					SecretParts: map[string]string{
-					Redacted:     idMatch,
+						"access_key_id":     idMatch,
-					ExtraData:    make(map[string]string),
+						"secret_access_key": secretMatch,
+						"session_token":     sessionMatch,
+					},
+					RawV2:     []byte(fmt.Sprintf("%s:%s:%s", idMatch, secretMatch, sessionMatch)),
+					Redacted:  idMatch,
+					ExtraData: make(map[string]string),
 				}
 
 				if verify {

pkg/detectors/axonaut/axonaut.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Axonaut,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/aylien/aylien.go

@@ -51,7 +51,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Aylien,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resIdMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"id":  resIdMatch,
+				},
+				RawV2: []byte(resMatch + resIdMatch),
 			}
 			if verify {
 				isVerified, err := verifyMatch(ctx, client, resIdMatch, resMatch)

pkg/detectors/ayrshare/ayrshare.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Ayrshare,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/azure_batch/azurebatch.go

@@ -56,8 +56,12 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureBatch,
 				Raw:          []byte(endpoint),
-				RawV2:        []byte(endpoint + accountKey),
+				SecretParts: map[string]string{
-				Redacted:     endpoint,
+					"url":         endpoint,
+					"account_key": accountKey,
+				},
+				RawV2:    []byte(endpoint + accountKey),
+				Redacted: endpoint,
 			}
 
 			if verify {

pkg/detectors/azure_cosmosdb/azure_cosmosdb.go

@@ -82,8 +82,12 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureCosmosDBKeyIdentifiable,
 				Raw:          []byte(key),
-				RawV2:        []byte("key: " + key + " account_url: " + accountUrl), // key: <key> account_url: <account_url>
+				SecretParts: map[string]string{
-				ExtraData:    map[string]string{},
+					"key":         key,
+					"account_url": accountUrl,
+				},
+				RawV2:     []byte("key: " + key + " account_url: " + accountUrl), // key: <key> account_url: <account_url>
+				ExtraData: map[string]string{},
 			}
 
 			if verify {

pkg/detectors/azure_entra/refreshtoken/refreshtoken.go

@@ -310,6 +310,7 @@ func createResult(refreshToken, clientId, tenantId string, verified bool, extraD
 	r := &detectors.Result{
 		DetectorType: detector_typepb.DetectorType_AzureRefreshToken,
 		Raw:          []byte(refreshToken),
+		SecretParts:  map[string]string{"key": refreshToken},
 		ExtraData:    extraData,
 		Verified:     verified,
 	}

pkg/detectors/azure_entra/serviceprincipal/v2/spv2.go

@@ -157,6 +157,7 @@ func createResult(tenantId string, clientId string, clientSecret string, verifie
 	r := &detectors.Result{
 		DetectorType: detector_typepb.DetectorType_Azure,
 		Raw:          []byte(clientSecret),
+		SecretParts:  map[string]string{"key": clientSecret},
 		ExtraData:    extraData,
 		Verified:     verified,
 		Redacted:     clientSecret[:5] + "...",

pkg/detectors/azure_openai/azure_openai.go

@@ -78,6 +78,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			DetectorType: s.Type(),
 			Redacted:     token[:3] + "..." + token[25:],
 			Raw:          []byte(token),
+			SecretParts:  map[string]string{"key": token},
 		}
 
 		for url := range urls {

pkg/detectors/azure_storage/storage.go

@@ -99,6 +99,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				DetectorType: s.Type(),
 				Raw:          []byte(key),
 				RawV2:        []byte(fmt.Sprintf(`{"accountName":"%s","accountKey":"%s"}`, name, key)),
+				SecretParts: map[string]string{
+					"account_name": name,
+					"account_key":  key,
+				},
 				ExtraData: map[string]string{
 					"Account_name": name,
 				},

pkg/detectors/azureapimanagement/repositorykey/repositorykey.go

@@ -66,7 +66,11 @@ EndpointLoop:
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureApiManagementRepositoryKey,
 				Raw:          []byte(passwordMatch),
-				RawV2:        []byte(urlMatch + passwordMatch),
+				SecretParts: map[string]string{
+					"url":      urlMatch,
+					"password": passwordMatch,
+				},
+				RawV2: []byte(urlMatch + passwordMatch),
 			}
 
 			if verify {

pkg/detectors/azureapimanagementsubscriptionkey/azureapimanagementsubscriptionkey.go

@@ -60,7 +60,11 @@ EndpointLoop:
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureAPIManagementSubscriptionKey,
 				Raw:          []byte(baseUrl),
-				RawV2:        []byte(baseUrl + ":" + key),
+				SecretParts: map[string]string{
+					"url": baseUrl,
+					"key": key,
+				},
+				RawV2: []byte(baseUrl + ":" + key),
 			}
 
 			if verify {

pkg/detectors/azureappconfigconnectionstring/azureappconfigconnectionstring.go

@@ -53,6 +53,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			DetectorType: detector_typepb.DetectorType_AzureAppConfigConnectionString,
 			Raw:          []byte(id),
 			RawV2:        []byte(connectionString),
+			SecretParts: map[string]string{
+				"endpoint": endpoint,
+				"id":       id,
+				"secret":   secret,
+			},
 		}
 
 		if verify {

pkg/detectors/azurecontainerregistry/azurecontainerregistry.go

@@ -79,8 +79,12 @@ EndpointLoop:
 			r := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureContainerRegistry,
 				Raw:          []byte(password),
-				RawV2:        []byte(`{"username":"` + username + `","password":"` + password + `"}`),
+				SecretParts: map[string]string{
-				Redacted:     username,
+					"username": username,
+					"password": password,
+				},
+				RawV2:    []byte(`{"username":"` + username + `","password":"` + password + `"}`),
+				Redacted: username,
 			}
 
 			if verify {

pkg/detectors/azuredevopspersonalaccesstoken/azuredevopspersonalaccesstoken.go

@@ -49,7 +49,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureDevopsPersonalAccessToken,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resOrgMatch),
+				SecretParts: map[string]string{
+					"key":          resMatch,
+					"organization": resOrgMatch,
+				},
+				RawV2: []byte(resMatch + resOrgMatch),
 			}
 
 			if verify {

pkg/detectors/azuredirectmanagementkey/azuredirectmanagementkey.go

@@ -66,7 +66,11 @@ EndpointLoop:
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureDirectManagementKey,
 				Raw:          []byte(baseUrl),
-				RawV2:        []byte(baseUrl + ":" + key),
+				SecretParts: map[string]string{
+					"url": baseUrl,
+					"key": key,
+				},
+				RawV2: []byte(baseUrl + ":" + key),
 			}
 
 			if verify {

pkg/detectors/azurefunctionkey/azurefunctionkey.go

@@ -46,7 +46,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureFunctionKey,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resUrl),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"url": resUrl,
+				},
+				RawV2: []byte(resMatch + resUrl),
 			}
 
 			if verify {

pkg/detectors/azuresastoken/azuresastoken.go

@@ -79,7 +79,11 @@ UrlLoop:
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureSasToken,
 				Raw:          []byte(url),
-				RawV2:        []byte(url + key),
+				SecretParts: map[string]string{
+					"url": url,
+					"key": key,
+				},
+				RawV2: []byte(url + key),
 			}
 
 			if verify {

pkg/detectors/azuresearchadminkey/azuresearchadminkey.go

@@ -50,6 +50,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 				DetectorType: detector_typepb.DetectorType_AzureSearchAdminKey,
 				Raw:          []byte(resMatch),
 				RawV2:        []byte(resMatch + resServiceMatch),
+				SecretParts: map[string]string{
+					"key":     resMatch,
+					"service": resServiceMatch,
+				},
 			}
 
 			if verify {

pkg/detectors/azuresearchquerykey/azuresearchquerykey.go

@@ -50,7 +50,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_AzureSearchQueryKey,
 				Raw:          []byte(resMatch),
-				RawV2:        []byte(resMatch + resUrlMatch),
+				SecretParts: map[string]string{
+					"key": resMatch,
+					"url": resUrlMatch,
+				},
+				RawV2: []byte(resMatch + resUrlMatch),
 			}
 			if verify {
 				client := s.client

pkg/detectors/bannerbear/v1/bannerbear.go

@@ -47,6 +47,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Bannerbear,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 			ExtraData: map[string]string{
 				"version": fmt.Sprintf("%d", s.Version()),
 			},

pkg/detectors/bannerbear/v2/bannerbear.go

@@ -50,6 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Bannerbear,
 			Raw:          []byte(match),
+			SecretParts:  map[string]string{"key": match},
 			ExtraData: map[string]string{
 				"version": fmt.Sprintf("%d", s.Version()),
 			},

pkg/detectors/baremetrics/baremetrics.go

@@ -50,6 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Baremetrics,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/beamer/beamer.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Beamer,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/beebole/beebole.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Beebole,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/besnappy/besnappy.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Besnappy,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 		if verify {
 			isVerified, verificationErr := verifyBesnappy(ctx, client, resMatch)

pkg/detectors/besttime/besttime.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Besttime,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/betterstack/betterstack.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BetterStack,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/billomat/billomat.go

@@ -65,7 +65,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Billomat,
 				Raw:          []byte(apiKey),
-				RawV2:        []byte(apiKey + id),
+				SecretParts: map[string]string{
+					"key": apiKey,
+					"id":  id,
+				},
+				RawV2: []byte(apiKey + id),
 			}
 
 			if verify {

pkg/detectors/bingsubscriptionkey/bingsubscriptionkey.go

@@ -21,7 +21,7 @@ var _ detectors.Detector = (*Scanner)(nil)
 
 var (
 	defaultClient = common.SaneHttpClient()
-	keyPat = regexp.MustCompile(detectors.PrefixRegex([]string{"bing"}) + `\b([a-fA-F0-9]{32})\b`)
+	keyPat        = regexp.MustCompile(detectors.PrefixRegex([]string{"bing"}) + `\b([a-fA-F0-9]{32})\b`)
 )
 
 func (s Scanner) Keywords() []string {
@@ -40,6 +40,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BingSubscriptionKey,
 			Raw:          []byte(match),
+			SecretParts:  map[string]string{"key": match},
 		}
 
 		if verify {

pkg/detectors/bitbar/bitbar.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Bitbar,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/bitbucketapppassword/bitbucketapppassword.go

@@ -82,6 +82,10 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) ([]dete
 		result := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BitbucketAppPassword,
 			Raw:          fmt.Appendf(nil, "%s:%s", username, password),
+			SecretParts: map[string]string{
+				"username": username,
+				"password": password,
+			},
 		}
 		if verify {
 			client := s.client

pkg/detectors/bitbucketdatacenter/bitbucketdatacenter.go

@@ -73,7 +73,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_BitbucketDataCenter,
 				Raw:          []byte(secret),
-				RawV2:        []byte(fmt.Sprintf("%s:%s", secret, bitBucketURL)),
+				SecretParts: map[string]string{
+					"secret": secret,
+					"url":    bitBucketURL,
+				},
+				RawV2: []byte(fmt.Sprintf("%s:%s", secret, bitBucketURL)),
 				ExtraData: map[string]string{
 					"URL": bitBucketURL,
 				},

pkg/detectors/bitcoinaverage/bitcoinaverage.go

@@ -50,6 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BitcoinAverage,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/bitfinex/bitfinex.go

@@ -81,6 +81,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Bitfinex,
 				Raw:          []byte(apiKey),
+				SecretParts:  map[string]string{"key": apiKey},
 			}
 
 			if verify {

pkg/detectors/bitlyaccesstoken/bitlyaccesstoken.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BitLyAccessToken,
 			Raw:          []byte(token),
+			SecretParts:  map[string]string{"key": token},
 		}
 
 		if verify {

pkg/detectors/bitmex/bitmex.go

@@ -57,7 +57,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_Bitmex,
 				Raw:          []byte(resSecretMatch),
-				RawV2:        []byte(resMatch + resSecretMatch),
+				SecretParts: map[string]string{
+					"key":    resMatch,
+					"secret": resSecretMatch,
+				},
+				RawV2: []byte(resMatch + resSecretMatch),
 			}
 
 			if verify {

pkg/detectors/blazemeter/blazemeter.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Blazemeter,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/blitapp/blitapp.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BlitApp,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/blocknative/blocknative.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BlockNative,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/blogger/blogger.go

@@ -43,6 +43,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Blogger,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/bombbomb/bombbomb.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BombBomb,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/boostnote/boostnote.go

@@ -44,6 +44,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_BoostNote,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/borgbase/borgbase.go

@@ -45,6 +45,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Borgbase,
 			Raw:          []byte(resMatch),
+			SecretParts:  map[string]string{"key": resMatch},
 		}
 
 		if verify {

pkg/detectors/box/box.go

@@ -50,6 +50,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 		s1 := detectors.Result{
 			DetectorType: detector_typepb.DetectorType_Box,
 			Raw:          []byte(match),
+			SecretParts:  map[string]string{"key": match},
 		}
 
 		if verify {

pkg/detectors/boxoauth/boxoauth.go

@@ -63,7 +63,11 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_BoxOauth,
 				Raw:          []byte(resIdMatch),
-				RawV2:        []byte(resIdMatch + resSecretMatch),
+				SecretParts: map[string]string{
+					"id":     resIdMatch,
+					"secret": resSecretMatch,
+				},
+				RawV2: []byte(resIdMatch + resSecretMatch),
 			}
 
 			if verify {

pkg/detectors/braintreepayments/braintreepayments.go

@@ -57,6 +57,7 @@ func (s Scanner) FromData(ctx context.Context, verify bool, data []byte) (result
 			s1 := detectors.Result{
 				DetectorType: detector_typepb.DetectorType_BraintreePayments,
 				Raw:          []byte(resMatch),
+				SecretParts:  map[string]string{"key": resMatch},
 			}
 
 			if verify {