feat(detectors): add Cerebras API key detector

[PhinehasNarh]

Description:

Adds a new secret detector for Cerebras Inference API keys.

Cerebras runs a paid, hosted AI-inference API, so its keys fit the sourcing guidelines (paid service). Keys have the form csk- followed by 48 lowercase-alphanumeric characters and are sent as Authorization: Bearer <key>.

Verification uses the OpenAI-compatible, non-destructive GET https://api.cerebras.ai/v1/models endpoint:

Response	Result
200 OK	verified
401 Unauthorized	determinately unverified
anything else	indeterminate (returns a verification error)

This mirrors the existing groq detector, which uses the same OpenAI-compatible verification shape.

Changes

• proto/detector_type.proto: add Cerebras = 1063; regenerated pkg/pb/detector_typepb/detector_type.pb.go.
• pkg/detectors/cerebras/: detector + pattern test + integration test.
• pkg/engine/defaults/defaults.go: register the detector in the default set.

The integration test reads CEREBRAS / CEREBRAS_INACTIVE from the detectors5 GSM bucket (matching the convention used by other detectors).

Checklist:

• Tests passing? go test ./pkg/detectors/cerebras/... passes; go build ./pkg/engine/defaults/..., gofmt, and go vet are clean. (Couldn't run the full make test-community / make lint locally, but the detector is structurally identical to the merged groq detector.)
• Lint passing (make lint)?

---

Note

Low Risk
Additive detector-only change following established patterns; verification is a read-only models list call with no changes to core scan or auth paths.

Overview
Adds Cerebras Inference API key detection and optional live verification to TruffleHog.

New pkg/detectors/cerebras matches csk- plus 48 lowercase alphanumeric characters (keyword csk-), deduplicates hits, and when verification is on calls GET https://api.cerebras.ai/v1/models with Authorization: Bearer—200 marks verified, 401 unverified, other statuses surface a verification error (same OpenAI-style shape as groq).

DetectorType_Cerebras (1063) is added in proto/detector_type.proto with regenerated protobufs, and &cerebras.Scanner{} is wired into the default detector list. Pattern, integration (GCP detectors5 secrets), and benchmark tests ship with the detector.

^{Reviewed by Cursor Bugbot for commit 51cfce4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

All committers have signed the CLA.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 89c8ca9. Configure here.}

[PhinehasNarh]

Good catch by Bugbot - fixed in 51cfce4. The detector sets SecretParts on every result, so the integration test's cmpopts.IgnoreFields now ignores it too ("Raw", "verificationError", "SecretParts"), matching the anthropic detector. Verified with go vet -tags=detectors ./pkg/detectors/cerebras/... and gofmt clean.