Add Google API keys in AG001

CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 ### Added
 
 - Initial public project and community launch materials.
+- AG001 now detects hardcoded Google API keys (`AIza...`).
 
 ## [0.1.0] - 2026-07-16
 

src/agentguard/rules/secrets.py

@@ -23,6 +23,7 @@ class HardcodedSecretRule(Rule):
         ("OpenAI API key", re.compile(r"\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b")),
         ("AWS access key", re.compile(r"\b(?:AKIA|ASIA)[A-Z0-9]{16}\b")),
         ("GitHub token", re.compile(r"\bgh[pousr]_[A-Za-z0-9]{30,}\b")),
+        ("Google API key", re.compile(r"\bAIza[0-9A-Za-z_-]{35}\b")),
         ("private key", re.compile(r"-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----")),
         (
             "assigned credential",

tests/test_rules.py

@@ -13,6 +13,7 @@
     ("filename", "content", "rule_id"),
     [
         ("agent.py", 'OPENAI_API_KEY = "sk-proj-abcdefghijklmnopqrstuvwxyz123456"', "AG001"),
+        ("agent.py", 'GOOGLE_API_KEY = "AIzaSyB3X_97fX7Z-2kLmNpQrStUvWxYz123456"', "AG001"),
         ("agent.py", "import os\nos.system(user_input)", "AG002"),
         ("agent.py", "Agent(tools=[shell, browser])", "AG003"),
         ("agent.py", 'prompt = f"Summarize: {user_input}"', "AG004"),
@@ -50,6 +51,13 @@ def test_placeholder_secret_is_ignored(project: Path) -> None:
     assert Scanner().scan(project).findings == []
 
 
+def test_google_api_key_placeholder_is_ignored(project: Path) -> None:
+    (project / "settings.py").write_text(
+        'GOOGLE_API_KEY = "AIzaSyYOUR_API_KEY_HERE1234567890123456"', encoding="utf-8"
+    )
+    assert Scanner().scan(project).findings == []
+
+
 def test_rule_suppression(project: Path) -> None:
     (project / "agent.py").write_text(
         "# agentguard: ignore[AG002]\nos.system(trusted_constant)", encoding="utf-8"