rule openai_api_keys
{
    meta:
        description = "Detect OpenAI API keys"
        author = "gbs"
        modified_by = "vk"
        last_update = "2025-06-25"
        provider = "OpenAI"

    strings:
        // OpenAI API keys (sk-proj-, sk-svcacct-, sk-admin-) with 'OpenAI' base64 marker, no forced trailing A
        $openai_key = /(sk-(proj|svcacct|admin)-)[A-Za-z0-9_-]*T3BlbkFJ[A-Za-z0-9_-]*/

    condition:
        any of them
}