[FALSE-POSITIVE] api-dbt token spray is showing a positive hit regardless of the token

[fail-open]

Template IDs or paths

http/token-spray/api-dbt.yaml

Environment

- OS: osx
- Nuclei: 3.3.7

Steps To Reproduce

1. Run nuclei -esc -t token-spray/api-dbt.yaml -var token=thisdoesntmattter

Get a hit for api-dbt regardless of what is set for token.

Relevant dumped responses

[api-dbt] Dumped HTTP request for https://cloud.getdbt.com/api/v2/accounts/

GET /api/v2/accounts/ HTTP/1.1
Host: cloud.getdbt.com
User-Agent: Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Authorization: Token thisdoesntmattter
Content-Type: application/json
Accept-Encoding: gzip

[DBG] [api-dbt] Dumped HTTP response https://cloud.getdbt.com/api/v2/accounts/

HTTP/1.1 403 Forbidden
Connection: close
Content-Length: 182
Content-Type: application/json
Cross-Origin-Opener-Policy: same-origin
Date: Mon, 02 Dec 2024 17:43:09 GMT
Referrer-Policy: same-origin
Server: nginx/1.24.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Cookie
X-Content-Type-Options: nosniff
X-Frame-Options: DENY

{"status": {"code": 403, "is_success": false, "user_message": "Access denied: User API Keys are deprecated. Please use account scoped PAT.", "developer_message": null}, "data": null}
[api-dbt:word-1] [http] [info] https://cloud.getdbt.com/api/v2/accounts/

Anything else?

Template is looking for negative keyword check for words that are not the negative hit anymore.