pkg/passive/sources.go (1)

106-107: Registered &jsmon.Source{} — consider adding a user-facing warning for API key format

Since jsmon expects JSMON_API_KEY in "token:workspaceID" form, surface a friendly warning like other sources to reduce misconfiguration churn.

You can set a warning once during package init:

 var sourceWarnings = mapsutil.NewSyncLockMap[string, string](
   mapsutil.WithMap(mapsutil.Map[string, string]{}))
 
+func init() {
+  // jsmon requires "token:workspaceID" format
+  sourceWarnings.Set("jsmon", "Set JSMON_API_KEY as <TOKEN>:<WORKSPACE_ID> (e.g., abc123:ws_456).")
+}

Note: multiple init() functions are allowed in the same package.

pkg/subscraping/sources/jsmon/jsmon.go (7)

35-39: Reset skipped flag per run to avoid stale statistics

s.skipped is only ever set to true; if a previous run skipped, subsequent successful runs will still report Skipped=true.

 func (s *Source) Run(ctx context.Context, domain string, session *subscraping.Session) <-chan subscraping.Result {
   results := make(chan subscraping.Result)
   s.errors = 0
   s.results = 0
+  s.skipped = false

---

52-60: API key parsing: use SplitN and trim; adopt Go ID casing

Tokens can unexpectedly contain a colon, and whitespace can sneak in. Also prefer wkspID for Go style.

-    randomApiInfo := strings.Split(randomApiKey, ":")
-    if len(randomApiInfo) != 2 {
+    parts := strings.SplitN(strings.TrimSpace(randomApiKey), ":", 2)
+    if len(parts) != 2 {
       s.skipped = true
       return
     }
-
-    authToken := randomApiInfo[0]
-    wkspId := randomApiInfo[1]
+    authToken := strings.TrimSpace(parts[0])
+    wkspID := strings.TrimSpace(parts[1])

---

61-67: Build JSON payload via marshaling, and prefer baseURL/wkspID naming

String interpolation risks malformed JSON if domain ever contains characters needing escaping; marshaling is safer. Also normalize URL/ID names.

-    subfinderScanURL := fmt.Sprintf("%s/api/v2/subfinderScan2?wkspId=%s", baseUrl, wkspId)
-    requestBody := fmt.Sprintf(`{"domain":"%s"}`, domain)
+    subfinderScanURL := fmt.Sprintf("%s/api/v2/subfinderScan2?wkspId=%s", baseURL, wkspID)
+    payload, _ := jsoniter.Marshal(struct {
+      Domain string `json:"domain"`
+    }{Domain: domain})
     headers := map[string]string{
       "X-Jsmon-Key":  authToken,
       "Content-Type": "application/json",
     }
 
-    resp, err := session.Post(ctx, subfinderScanURL, "", headers, bytes.NewReader([]byte(requestBody)))
+    resp, err := session.Post(ctx, subfinderScanURL, "", headers, bytes.NewReader(payload))

And rename the constant:

-const (
-  baseUrl = "https://api.jsmon.sh"
-)
+const (
+  baseURL = "https://api.jsmon.sh"
+)

---

84-97: Optional: handle API-declared error states before emitting subdomains

Response has Status/Message; consider surfacing server-declared errors explicitly instead of silently proceeding.

   var response subdomainsResponse
   if err := jsoniter.NewDecoder(resp.Body).Decode(&response); err != nil {
     results <- subscraping.Result{Source: s.Name(), Type: subscraping.Error, Error: err}
     s.errors++
     session.DiscardHTTPResponse(resp)
     return
   }
 
   session.DiscardHTTPResponse(resp)
 
+  if response.Status != "" && !strings.EqualFold(response.Status, "ok") && !strings.EqualFold(response.Status, "success") {
+    results <- subscraping.Result{
+      Source: s.Name(), Type: subscraping.Error,
+      Error: fmt.Errorf("subfinderScan API status=%s message=%s", response.Status, response.Message),
+    }
+    s.errors++
+    return
+  }

---

1-3: Package comment style nit

Consider an idiomatic package comment.

-// Package jsmon logic
+// Package jsmon implements the Subfinder source backed by the jsmon API.

---

17-19: Identifier casing nit

Use baseURL per Go style for initialisms.

(See diff proposed in a prior comment.)

---

108-110: Confirm default inclusion is intended

IsDefault() returns true, so jsmon participates without explicit opt-in. If jsmon commonly requires credentials, default-enabled may surprise users without JSMON_API_KEY configured (it will be marked skipped). If that’s intentional for visibility, ignore this; otherwise consider making it non-default.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.