1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 target:
30 - doc
31 use_ml: true
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 target:
66 - doc
67 use_ml: true
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 target:
90 - doc
91 use_ml: true
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 target:
121 - doc
122 use_ml: true
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 target:
138 - doc
139 use_ml: true
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 target:
163 - doc
164 use_ml: true
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 target:
187 - doc
188 use_ml: true
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 min_line_len: 36
197 required_substrings:
198 - "-"
199 filter_type:
200 - ValuePatternCheck(4)
201 use_ml: false
202 target:
203 - code
204 - doc
205
206- name: Akamai Credentials
207 severity: high
208 confidence: strong
209 type: pattern
210 values:
211 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
212 filter_type: GeneralPattern
213 required_substrings:
214 - akab-
215 min_line_len: 38
216 target:
217 - code
218 - doc
219
220- name: Amazon Bedrock API Key
221 severity: high
222 confidence: moderate
223 type: pattern
224 values:
225 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
226 filter_type: GeneralPattern
227 required_substrings:
228 - ABSK
229 - bedrock-api-key-
230 min_line_len: 44
231 target:
232 - code
233 - doc
234
235- name: AWS AppSync GraphQL API Key
236 severity: high
237 confidence: moderate
238 type: pattern
239 values:
240 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>da2-[a-z0-9]{26})(?![0-9A-Za-z/+])
241 filter_type: GeneralPattern
242 required_substrings:
243 - da2-
244 min_line_len: 40
245 target:
246 - code
247 - doc
248
249- name: AWS Client ID
250 severity: medium
251 confidence: moderate
252 type: pattern
253 values:
254 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
255 filter_type: GeneralPattern
256 required_substrings:
257 - A3T
258 - ABIA
259 - ACCA
260 - AGPA
261 - AIDA
262 - AIPA
263 - AKIA
264 - ANPA
265 - ANVA
266 - AROA
267 - APKA
268 - ASCA
269 - ASIA
270 min_line_len: 20
271 required_regex: "[0-9A-Za-z_/+-]{15}"
272 target:
273 - code
274 - doc
275
276- name: AWS Multi
277 severity: high
278 confidence: moderate
279 type: multi
280 values:
281 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
282 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
283 filter_type:
284 - LineSpecificKeyCheck
285 - ValuePatternCheck
286 - ValueBase64PartCheck
287 - ValueMorphemesCheck
288 required_substrings:
289 - AKIA
290 - ASIA
291 min_line_len: 20
292 required_regex: "[0-9A-Za-z_/+-]{15}"
293 target:
294 - code
295 - doc
296
297- name: Alibaba Access Key ID
298 severity: medium
299 confidence: moderate
300 type: pattern
301 values:
302 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
303 filter_type: GeneralPattern
304 required_substrings:
305 - LTAI
306 min_line_len: 16
307 required_regex: "[0-9A-Za-z_/+-]{15}"
308 target:
309 - code
310 - doc
311
312- name: Alibaba Multi
313 severity: high
314 confidence: moderate
315 type: multi
316 values:
317 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
318 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){30}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
319 filter_type:
320 - LineSpecificKeyCheck
321 - ValuePatternCheck
322 - ValueBase64PartCheck
323 - ValueMorphemesCheck
324 required_substrings:
325 - LTAI
326 min_line_len: 20
327 required_regex: "[0-9A-Za-z_/+-]{15}"
328 target:
329 - code
330 - doc
331
332- name: AWS MWS Key
333 severity: high
334 confidence: strong
335 type: pattern
336 values:
337 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
338 filter_type: GeneralPattern
339 required_substrings:
340 - amzn.mws.
341 min_line_len: 30
342 target:
343 - code
344 - doc
345
346- name: Defined Networking API Key
347 severity: high
348 confidence: strong
349 type: pattern
350 values:
351 - (?P<value>dnkey-[A-Z2-7]{26}-[A-Z2-7]{52})
352 filter_type: GeneralPattern
353 required_substrings:
354 - dnkey-
355 min_line_len: 85
356 target:
357 - code
358 - doc
359
360- name: Dynatrace API Token
361 severity: high
362 confidence: moderate
363 type: pattern
364 values:
365 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[a-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
366 filter_type: TokenPattern
367 required_substrings:
368 - dt0
369 min_line_len: 90
370 target:
371 - code
372 - doc
373
374- name: Doppler API Key
375 severity: high
376 confidence: strong
377 type: pattern
378 values:
379 - (?P<value>dp\.pt\.[0-9A-Za-z]{43})
380 filter_type: GeneralPattern
381 required_substrings:
382 - dp.pt.
383 min_line_len: 49
384 target:
385 - code
386 - doc
387
388- name: Facebook Access Token
389 severity: high
390 confidence: moderate
391 type: pattern
392 values:
393 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
394 filter_type:
395 - ValuePatternCheck
396 - ValueBase64PartCheck
397 - ValueNotPartEncodedCheck
398 required_substrings:
399 - EAA
400 min_line_len: 80
401 target:
402 - code
403 - doc
404
405- name: Facebook App Token
406 severity: high
407 confidence: moderate
408 type: pattern
409 values:
410 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
411 filter_type: TokenPattern
412 required_substrings:
413 - "|"
414 required_regex: "[0-9A-Za-z_/+-]{15}"
415 min_line_len: 33
416 target:
417 - code
418 - doc
419
420- name: Google API Key
421 severity: high
422 confidence: moderate
423 type: pattern
424 values:
425 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
426 filter_type: TokenPattern
427 required_substrings:
428 - AIza
429 min_line_len: 39
430 target:
431 - code
432 - doc
433
434- name: Google Multi
435 severity: high
436 confidence: moderate
437 type: multi
438 values:
439 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
440 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
441 filter_type: GeneralPattern
442 required_substrings:
443 - .apps.googleusercontent.com
444 min_line_len: 40
445 target:
446 - code
447 - doc
448
449- name: Google OAuth Secret
450 severity: high
451 confidence: strong
452 type: pattern
453 values:
454 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
455 filter_type: TokenPattern
456 required_substrings:
457 - GOCSPX-
458 min_line_len: 40
459 target:
460 - code
461 - doc
462
463- name: Google OAuth Access Token
464 severity: high
465 confidence: moderate
466 type: pattern
467 values:
468 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
469 filter_type: TokenPattern
470 required_substrings:
471 - ya29.
472 min_line_len: 27
473 target:
474 - code
475 - doc
476
477- name: Google OAuth Refresh Token
478 severity: medium
479 confidence: weak
480 type: pattern
481 values:
482 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
483 filter_type: TokenPattern
484 required_substrings:
485 - 1//0
486 min_line_len: 84
487 target:
488 - code
489 - doc
490
491- name: Heroku Credentials
492 severity: high
493 confidence: strong
494 type: pattern
495 values:
496 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
497 filter_type: TokenPattern
498 required_substrings:
499 - HRKU-
500 min_line_len: 41
501 target:
502 - code
503 - doc
504
505- name: Instagram Access Token
506 severity: high
507 confidence: strong
508 type: pattern
509 values:
510 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
511 filter_type: TokenPattern
512 required_substrings:
513 - IGQVJ
514 min_line_len: 105
515 target:
516 - code
517 - doc
518
519- name: JSON Web Token
520 severity: medium
521 confidence: strong
522 type: pattern
523 values:
524 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
525 filter_type:
526 - ValueJsonWebTokenCheck
527 required_substrings:
528 - eyJ
529 min_line_len: 64
530 target:
531 - code
532 - doc
533
534- name: JSON Web Key
535 severity: medium
536 confidence: strong
537 type: pattern
538 values:
539 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
540 filter_type:
541 - ValueJsonWebKeyCheck
542 required_substrings:
543 - eyJ
544 - eyAi
545 - ewoi
546 - ewog
547 - ew0K
548 - WyJ
549 - W3si
550 - Wwp7
551 - Wwog
552 - Ww0K
553 - W3sK
554 min_line_len: 64
555 target:
556 - code
557 - doc
558
559- name: JWK
560 severity: medium
561 confidence: moderate
562 type: multi
563 values:
564 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
565 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
566 filter_type:
567 - ValuePatternCheck
568 - ValueMorphemesCheck
569 required_substrings:
570 - kty
571 min_line_len: 8
572 target:
573 - code
574 - doc
575
576- name: MailChimp API Key
577 severity: high
578 confidence: moderate
579 type: pattern
580 values:
581 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
582 filter_type: TokenPattern
583 required_substrings:
584 - -us
585 min_line_len: 35
586 target:
587 - code
588 - doc
589
590- name: MailGun API Key
591 severity: high
592 confidence: moderate
593 type: pattern
594 values:
595 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
596 filter_type: TokenPattern
597 required_regex: "[0-9A-Za-z_/+-]{15}"
598 min_line_len: 36
599 target:
600 - code
601 - doc
602
603- name: PayPal Braintree Access Token
604 severity: high
605 confidence: strong
606 type: pattern
607 values:
608 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
609 filter_type: GeneralPattern
610 required_substrings:
611 - access_token$production$
612 min_line_len: 72
613 target:
614 - code
615 - doc
616
617- name: PEM Private Key
618 severity: high
619 confidence: strong
620 type: pem_key
621 values:
622 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
623 min_line_len: 27
624 target:
625 - code
626 - doc
627
628- name: BASE64 encoded PEM Private Key
629 severity: high
630 confidence: strong
631 type: pattern
632 values:
633 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
634 filter_type:
635 - ValueBase64EncodedPem
636 min_line_len: 300
637 required_substrings:
638 - UFJJVkFURSBLRVkt
639 - QUklWQVRFIEtFWS0t
640 - FBSSVZBVEUgS0VZ
641 target:
642 - code
643 - doc
644
645- name: BASE64 Private Key
646 severity: high
647 confidence: strong
648 type: pattern
649 values:
650 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
651 filter_type:
652 - ValueBase64KeyCheck
653 min_line_len: 160
654 required_substrings:
655 - MII
656 target:
657 - code
658 - doc
659
660- name: Picatic API Key
661 severity: high
662 confidence: strong
663 type: pattern
664 values:
665 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
666 filter_type: GeneralPattern
667 required_substrings:
668 - sk_live_
669 min_line_len: 40
670 target:
671 - code
672 - doc
673
674- name: SendGrid API Key
675 severity: high
676 confidence: moderate
677 type: pattern
678 values:
679 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
680 filter_type: TokenPattern
681 required_substrings:
682 - SG.
683 min_line_len: 34
684 target:
685 - code
686 - doc
687
688- name: Clojars Deploy Token
689 severity: high
690 confidence: strong
691 type: pattern
692 values:
693 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
694 filter_type: TokenPattern
695 required_substrings:
696 - CLOJARS_
697 min_line_len: 68
698 target:
699 - code
700 - doc
701
702- name: Shopify Token
703 severity: high
704 confidence: strong
705 type: pattern
706 values:
707 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
708 filter_type: TokenPattern
709 required_substrings:
710 - shp
711 min_line_len: 38
712 target:
713 - code
714 - doc
715
716- name: Slack Token
717 severity: high
718 confidence: strong
719 type: pattern
720 values:
721 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
722 filter_type: TokenPattern
723 required_substrings:
724 - xox
725 - xapp
726 min_line_len: 15
727 target:
728 - code
729 - doc
730
731- name: Slack Webhook
732 severity: medium
733 confidence: strong
734 type: pattern
735 values:
736 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
737 filter_type: GeneralPattern
738 required_substrings:
739 - hooks.slack.com/services/T
740 min_line_len: 61
741 target:
742 - code
743 - doc
744
745- name: Stripe Credentials
746 severity: high
747 confidence: strong
748 type: pattern
749 values:
750 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
751 filter_type: GeneralPattern
752 required_substrings:
753 - k_live_
754 - k_test_
755 - whsec_
756 min_line_len: 32
757 target:
758 - code
759 - doc
760
761- name: Square Access Token
762 severity: high
763 confidence: moderate
764 type: pattern
765 values:
766 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
767 filter_type:
768 - ValuePatternCheck
769 - ValueBase64PartCheck
770 required_substrings:
771 - EAAA
772 min_line_len: 64
773 target:
774 - code
775 - doc
776
777- name: Square Credentials
778 severity: medium
779 confidence: strong
780 type: pattern
781 values:
782 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
783 filter_type: TokenPattern
784 required_substrings:
785 - sq0
786 min_line_len: 29
787 target:
788 - code
789 - doc
790
791- name: Twilio Credentials
792 severity: high
793 confidence: moderate
794 type: pattern
795 values:
796 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
797 filter_type: TokenPattern
798 required_substrings:
799 - AC
800 - AD
801 - AL
802 - CA
803 - CF
804 - CL
805 - CN
806 - CR
807 - FW
808 - IP
809 - KS
810 - MM
811 - "NO"
812 - PK
813 - PN
814 - QU
815 - RE
816 - SC
817 - SD
818 - SK
819 - SM
820 - TR
821 - UT
822 - XE
823 - XR
824 min_line_len: 34
825 target:
826 - code
827 - doc
828
829- name: Telegram Bot API Token
830 severity: high
831 confidence: moderate
832 type: pattern
833 values:
834 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
835 filter_type: TokenPattern
836 required_substrings:
837 - :AA
838 min_line_len: 45
839 target:
840 - code
841 - doc
842
843- name: PyPi API Token
844 severity: high
845 confidence: strong
846 type: pattern
847 values:
848 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
849 filter_type: TokenPattern
850 required_substrings:
851 - pypi-
852 min_line_len: 155
853 target:
854 - code
855 - doc
856
857- name: NPM Token
858 severity: high
859 confidence: strong
860 type: pattern
861 values:
862 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
863 filter_type:
864 - ValueGitHubCheck
865 required_substrings:
866 - npm_
867 min_line_len: 40
868 target:
869 - code
870 - doc
871
872- name: Github App Installation Token
873 severity: high
874 confidence: strong
875 type: pattern
876 values:
877 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
878 filter_type:
879 - ValuePatternCheck
880 required_substrings:
881 - ghs_
882 min_line_len: 40
883 target:
884 - code
885 - doc
886
887- name: Github Classic Token
888 severity: high
889 confidence: strong
890 type: pattern
891 values:
892 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
893 filter_type:
894 - ValueGitHubCheck
895 required_substrings:
896 - ghp_
897 - gho_
898 - ghu_
899 - ghs_
900 - ghr_
901 min_line_len: 40
902 target:
903 - code
904 - doc
905
906- name: Github Fine-granted Token
907 severity: high
908 confidence: strong
909 type: pattern
910 values:
911 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
912 filter_type: GeneralPattern
913 required_substrings:
914 - github_pat_
915 min_line_len: 90
916 target:
917 - code
918 - doc
919
920- name: Firebase Domain
921 severity: info
922 confidence: moderate
923 type: pattern
924 values:
925 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
926 filter_type: GeneralPattern
927 required_substrings:
928 - .firebase
929 min_line_len: 16
930 target:
931 - code
932 - doc
933
934- name: AWS S3 Bucket
935 severity: info
936 confidence: moderate
937 type: pattern
938 values:
939 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
940 filter_type: GeneralPattern
941 required_substrings:
942 - .s3-website
943 - .s3.amazonaws.com
944 min_line_len: 14
945 target:
946 - code
947 - doc
948
949- name: Jfrog Token
950 severity: high
951 confidence: strong
952 type: pattern
953 values:
954 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
955 filter_type:
956 - ValueJfrogTokenCheck
957 required_substrings:
958 - cmVmdGtuO
959 - AKCp
960 min_line_len: 64
961 target:
962 - code
963 - doc
964
965- name: Azure Access Token
966 severity: high
967 confidence: strong
968 type: pattern
969 values:
970 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
971 filter_type:
972 - ValueAzureTokenCheck
973 required_substrings:
974 - eyJ
975 min_line_len: 148
976 target:
977 - code
978 - doc
979
980- name: Azure Secret Value
981 severity: high
982 confidence: moderate
983 type: pattern
984 values:
985 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
986 filter_type: TokenPattern
987 min_line_len: 40
988 required_substrings:
989 - 8Q~
990 target:
991 - code
992 - doc
993
994- name: Azure Storage Account Key
995 severity: high
996 confidence: moderate
997 type: pattern
998 values:
999 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
1000 min_line_len: 80
1001 filter_type:
1002 - ValuePatternCheck(17)
1003 required_substrings:
1004 - JQQJ99
1005 - JQQJ9D
1006 - JQQJ9H
1007 target:
1008 - code
1009 - doc
1010
1011- name: Bitbucket App Password
1012 severity: high
1013 confidence: strong
1014 type: pattern
1015 values:
1016 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
1017 filter_type:
1018 - ValueAtlassianTokenCheck
1019 min_line_len: 28
1020 required_substrings:
1021 - ATBB
1022 target:
1023 - code
1024 - doc
1025
1026- name: Bitbucket Repository Access Token
1027 severity: high
1028 confidence: strong
1029 type: pattern
1030 values:
1031 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1032 filter_type:
1033 - ValueAtlassianTokenCheck
1034 min_line_len: 160
1035 required_substrings:
1036 - ATCTT3xFfGN0
1037 target:
1038 - code
1039 - doc
1040
1041- name: Bitbucket HTTP Access Token
1042 severity: high
1043 confidence: strong
1044 type: pattern
1045 values:
1046 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
1047 filter_type:
1048 - ValueAtlassianTokenCheck
1049 min_line_len: 49
1050 required_substrings:
1051 - BBDC-
1052 target:
1053 - code
1054 - doc
1055
1056- name: Jira / Confluence PAT token
1057 severity: high
1058 confidence: strong
1059 type: pattern
1060 values:
1061 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1062 filter_type:
1063 - ValueAtlassianTokenCheck
1064 min_line_len: 44
1065 required_substrings:
1066 - M
1067 - N
1068 - O
1069 required_regex: "[0-9A-Za-z_/+-]{15}"
1070 target:
1071 - code
1072 - doc
1073
1074- name: Atlassian PAT token
1075 severity: high
1076 confidence: strong
1077 type: pattern
1078 values:
1079 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1080 filter_type:
1081 - ValueAtlassianTokenCheck
1082 min_line_len: 160
1083 required_substrings:
1084 - ATATT3xFfGF0
1085 target:
1086 - code
1087 - doc
1088
1089- name: Digital Ocean Token
1090 severity: high
1091 confidence: strong
1092 type: pattern
1093 values:
1094 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1095 filter_type: TokenPattern
1096 min_line_len: 71
1097 required_substrings:
1098 - doo_v1_
1099 - dop_v1_
1100 - dor_v1_
1101 target:
1102 - code
1103 - doc
1104
1105- name: Dropbox OAuth2 API Access Token
1106 severity: high
1107 confidence: moderate
1108 type: pattern
1109 values:
1110 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1111 filter_type: TokenPattern
1112 min_line_len: 80
1113 required_substrings:
1114 - sl.
1115 target:
1116 - code
1117 - doc
1118
1119- name: NuGet API key
1120 severity: high
1121 confidence: moderate
1122 type: pattern
1123 values:
1124 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1125 filter_type: TokenPattern
1126 min_line_len: 46
1127 required_substrings:
1128 - oy2
1129 target:
1130 - code
1131 - doc
1132
1133- name: Gitlab Prefix Token
1134 severity: high
1135 confidence: strong
1136 type: pattern
1137 values:
1138 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1139 filter_type:
1140 - ValuePatternCheck
1141 min_line_len: 25
1142 required_substrings:
1143 - _gitlab_session=
1144 - GR1348941
1145 - glagent-
1146 - glsoat-
1147 - glffct-
1148 - glpat-
1149 - gloas-
1150 - glptt-
1151 - glcbt-
1152 - glimt-
1153 - gldt-
1154 - glft-
1155 - glrt-
1156 - glrtr-
1157 - glwt-
1158 target:
1159 - code
1160 - doc
1161
1162- name: Grafana Provisioned API Key
1163 severity: high
1164 confidence: strong
1165 type: pattern
1166 values:
1167 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1168 filter_type:
1169 - ValueGrafanaCheck
1170 min_line_len: 67
1171 required_substrings:
1172 - eyJ
1173 target:
1174 - code
1175 - doc
1176
1177- name: Grafana Access Policy Token
1178 severity: high
1179 confidence: strong
1180 type: pattern
1181 values:
1182 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1183 filter_type:
1184 - ValueGrafanaCheck
1185 min_line_len: 87
1186 required_substrings:
1187 - glc_eyJ
1188 target:
1189 - code
1190 - doc
1191
1192- name: Grafana Service Account Token
1193 severity: high
1194 confidence: strong
1195 type: pattern
1196 values:
1197 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1198 min_line_len: 46
1199 filter_type:
1200 - ValueGrafanaServiceCheck
1201 required_substrings:
1202 - glsa_
1203 target:
1204 - code
1205 - doc
1206
1207- name: Dropbox API secret (long term)
1208 severity: high
1209 confidence: weak
1210 type: pattern
1211 values:
1212 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1213 filter_type: [ ]
1214 min_line_len: 43
1215 required_substrings:
1216 - AAAAAAAAAA
1217 target:
1218 - code
1219 - doc
1220
1221- name: X App-Only Authentication Bearer Token
1222 severity: high
1223 confidence: moderate
1224 type: pattern
1225 values:
1226 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AAAAAAAAAAAAAAAAAAAAA[0-9A-Za-z%]{40,42}%3D[0-9A-Za-z]{50})(?![=0-9A-Za-z_/+-])
1227 filter_type: [ ]
1228 min_line_len: 100
1229 required_substrings:
1230 - AAAAAAAAAAAAAAAAAAAAA
1231 target:
1232 - code
1233 - doc
1234
1235- name: PlanetScale Credentials
1236 severity: high
1237 confidence: moderate
1238 type: pattern
1239 values:
1240 - (?P<value>pscale_(tkn|oauth|pw)_[.0-9A-Za-z_-]{32,64})
1241 min_line_len: 42
1242 filter_type:
1243 - ValuePatternCheck
1244 required_substrings:
1245 - pscale_
1246 target:
1247 - code
1248 - doc
1249
1250- name: NewRelic Credentials
1251 severity: high
1252 confidence: moderate
1253 type: pattern
1254 values:
1255 - (?P<value>NRAK-[0-9A-Z]{27}|NRBR-[0-9a-f]{19,20}|NRII-[0-9A-Za-z_-]{25}|NRJS-[0-9a-z]{19}|[0-9a-z]{5}[0-9a-f]{31}NRAL)
1256 min_line_len: 24
1257 filter_type:
1258 - ValuePatternCheck
1259 - ValueMorphemesCheck
1260 required_substrings:
1261 - NRAK-
1262 - NRBR-
1263 - NRII-
1264 - NRJS-
1265 - NRAL
1266 target:
1267 - code
1268 - doc
1269
1270- name: Linear API Key
1271 severity: high
1272 confidence: moderate
1273 type: pattern
1274 values:
1275 - (?P<value>lin_api_[0-9A-Za-z]{40})
1276 min_line_len: 48
1277 filter_type:
1278 - ValuePatternCheck
1279 required_substrings:
1280 - lin_api_
1281 target:
1282 - code
1283 - doc
1284
1285- name: CloudFlare API Token
1286 severity: high
1287 confidence: moderate
1288 type: pattern
1289 values:
1290 - (?P<value>cf(at|ut|k)_[0-9A-Za-z]{48})
1291 min_line_len: 24
1292 filter_type:
1293 - ValuePatternCheck
1294 - ValueMorphemesCheck
1295 required_substrings:
1296 - cfat_
1297 - cfut_
1298 - cfk_
1299 target:
1300 - code
1301 - doc
1302
1303- name: Age Secret Key
1304 severity: high
1305 confidence: strong
1306 type: pattern
1307 values:
1308 - (?P<value>AGE-SECRET-KEY-1[0-9A-Z]{58})
1309 min_line_len: 74
1310 filter_type:
1311 - ValueBech32Check
1312 required_substrings:
1313 - AGE-SECRET-KEY-1
1314 target:
1315 - code
1316 - doc
1317
1318- name: Dropbox App secret
1319 severity: info
1320 confidence: weak
1321 type: pattern
1322 values:
1323 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1324 filter_type: WeirdBase36Token
1325 min_line_len: 15
1326 required_regex: "[0-9A-Za-z_/+-]{15}"
1327 target:
1328 - code
1329 - doc
1330
1331- name: Hashicorp Vault Token
1332 severity: high
1333 confidence: strong
1334 type: pattern
1335 values:
1336 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1337 filter_type:
1338 - ValuePatternCheck
1339 - ValueEntropyBase64Check
1340 min_line_len: 90
1341 required_substrings:
1342 - hvb.
1343 - hvr.
1344 - hvs.
1345 target:
1346 - code
1347 - doc
1348
1349- name: Hashicorp Terraform Token
1350 severity: high
1351 confidence: strong
1352 type: pattern
1353 values:
1354 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1355 filter_type:
1356 - ValuePatternCheck
1357 - ValueMorphemesCheck
1358 min_line_len: 90
1359 required_substrings:
1360 - .atlasv1.
1361 target:
1362 - code
1363 - doc
1364
1365- name: NKEY Seed
1366 severity: high
1367 confidence: weak
1368 type: pattern
1369 values:
1370 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1371 min_line_len: 42
1372 filter_type:
1373 - ValueMorphemesCheck
1374 - ValuePatternCheck
1375 - ValueEntropyBase32Check
1376 - ValueBase32DataCheck
1377 - ValueTokenBase32Check
1378 required_substrings:
1379 - SA
1380 - SC
1381 - SN
1382 - SO
1383 - SP
1384 - SU
1385 - SX
1386 required_regex: "[0-9A-Za-z_/+-]{15}"
1387 target:
1388 - code
1389 - doc
1390
1391- name: OTP / 2FA Secret
1392 severity: info
1393 confidence: weak
1394 type: pattern
1395 values:
1396 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1397 filter_type:
1398 - ValueMorphemesCheck
1399 - ValuePatternCheck
1400 - ValueEntropyBase32Check
1401 - ValueBase32DataCheck
1402 - ValueTokenBase32Check
1403 - ValueBase64PartCheck
1404 min_line_len: 16
1405 required_regex: "[0-9A-Za-z_/+-]{15}"
1406 target:
1407 - code
1408 - doc
1409
1410- name: OpenAI Token
1411 severity: high
1412 confidence: strong
1413 type: pattern
1414 values:
1415 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1416 min_line_len: 51
1417 filter_type:
1418 - ValuePatternCheck
1419 - ValueMorphemesCheck
1420 required_substrings:
1421 - T3BlbkFJ
1422 - 9wZW5BS
1423 - PcGVuQU
1424 target:
1425 - code
1426 - doc
1427
1428- name: Docker Access Token
1429 severity: high
1430 confidence: strong
1431 type: pattern
1432 values:
1433 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1434 min_line_len: 36
1435 filter_type:
1436 - ValuePatternCheck
1437 - ValueMorphemesCheck
1438 required_substrings:
1439 - dckr_pat_
1440 - dckr_oat_
1441 target:
1442 - code
1443 - doc
1444
1445- name: Docker Swarm Token
1446 severity: high
1447 confidence: strong
1448 type: pattern
1449 values:
1450 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1451 min_line_len: 85
1452 filter_type:
1453 - ValuePatternCheck
1454 - ValueMorphemesCheck
1455 required_substrings:
1456 - SWMTKN-1-
1457 target:
1458 - code
1459 - doc
1460
1461- name: Docker Swarm Key
1462 severity: high
1463 confidence: strong
1464 type: pattern
1465 values:
1466 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1467 min_line_len: 52
1468 filter_type:
1469 - ValuePatternCheck
1470 - ValueMorphemesCheck
1471 required_substrings:
1472 - SWMKEY-1-
1473 target:
1474 - code
1475 - doc
1476
1477- name: Groq API Key
1478 severity: high
1479 confidence: strong
1480 type: pattern
1481 values:
1482 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1483 min_line_len: 56
1484 filter_type:
1485 - ValuePatternCheck
1486 required_substrings:
1487 - WGdyb3FY
1488 - hncm9xW
1489 - YZ3JvcV
1490 target:
1491 - code
1492 - doc
1493
1494- name: X AI API Key
1495 severity: high
1496 confidence: moderate
1497 type: pattern
1498 values:
1499 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1500 min_line_len: 84
1501 filter_type:
1502 - ValuePatternCheck
1503 - ValueEntropyBase64Check
1504 required_substrings:
1505 - xai-
1506 target:
1507 - code
1508 - doc
1509
1510- name: Notion Integration Token
1511 severity: high
1512 confidence: strong
1513 type: pattern
1514 values:
1515 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1516 filter_type:
1517 - ValuePatternCheck
1518 - ValueEntropyBase64Check
1519 required_substrings:
1520 - ntn_
1521 min_line_len: 50
1522 target:
1523 - code
1524 - doc
1525
1526- name: Hugging Face User Access Token
1527 severity: high
1528 confidence: moderate
1529 type: pattern
1530 values:
1531 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1532 min_line_len: 37
1533 filter_type:
1534 - ValuePatternCheck
1535 - ValueEntropyBase64Check
1536 required_substrings:
1537 - hf_
1538 target:
1539 - code
1540 - doc
1541
1542- name: Anthropic API Key
1543 severity: high
1544 confidence: strong
1545 type: pattern
1546 values:
1547 - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1548 min_line_len: 77
1549 filter_type:
1550 - ValuePatternCheck
1551 required_substrings:
1552 - sk-ant-api03-
1553 target:
1554 - code
1555 - doc
1556
1557- name: Perplexity API Key
1558 severity: high
1559 confidence: strong
1560 type: pattern
1561 values:
1562 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1563 min_line_len: 45
1564 filter_type:
1565 - ValuePatternCheck
1566 required_substrings:
1567 - pplx-
1568 target:
1569 - code
1570 - doc
1571
1572- name: DeepSeek API Key
1573 severity: high
1574 confidence: moderate
1575 type: pattern
1576 values:
1577 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1578 min_line_len: 35
1579 filter_type:
1580 - ValuePatternCheck
1581 required_substrings:
1582 - sk-
1583 target:
1584 - code
1585 - doc
1586
1587- name: Tavily API Key
1588 severity: high
1589 confidence: strong
1590 type: pattern
1591 values:
1592 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1593 min_line_len: 37
1594 filter_type:
1595 - ValuePatternCheck
1596 required_substrings:
1597 - tvly-
1598 target:
1599 - code
1600 - doc
1601
1602- name: Figma Personal Access Token
1603 severity: high
1604 confidence: strong
1605 type: pattern
1606 values:
1607 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1608 min_line_len: 45
1609 filter_type:
1610 - ValuePatternCheck
1611 required_substrings:
1612 - figd_
1613 target:
1614 - code
1615 - doc
1616
1617- name: 1Password Account Token
1618 severity: high
1619 confidence: strong
1620 type: pattern
1621 values:
1622 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1623 min_line_len: 192
1624 filter_type:
1625 - ValuePatternCheck
1626 required_substrings:
1627 - InNlY3JldEtleSI6
1628 - JzZWNyZXRLZXkiO
1629 - ic2VjcmV0S2V5Ij
1630 target:
1631 - code
1632 - doc
1633
1634- name: Brevo API Key
1635 severity: high
1636 confidence: strong
1637 type: pattern
1638 values:
1639 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1640 min_line_len: 89
1641 filter_type:
1642 - ValuePatternCheck
1643 required_substrings:
1644 - xkeysib-
1645 target:
1646 - code
1647 - doc
1648
1649- name: Together AI API Key
1650 severity: high
1651 confidence: strong
1652 type: pattern
1653 values:
1654 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1655 min_line_len: 50
1656 filter_type:
1657 - ValuePatternCheck
1658 required_substrings:
1659 - tgp_v1_
1660 target:
1661 - code
1662 - doc
1663
1664- name: LLAMA API Key
1665 severity: high
1666 confidence: strong
1667 type: pattern
1668 values:
1669 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1670 min_line_len: 52
1671 filter_type:
1672 - ValuePatternCheck
1673 required_substrings:
1674 - llx-
1675 target:
1676 - code
1677 - doc
1678
1679- name: SonarQube Credentials
1680 severity: medium
1681 confidence: moderate
1682 type: pattern
1683 values:
1684 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1685 min_line_len: 44
1686 filter_type:
1687 - ValuePatternCheck
1688 required_substrings:
1689 - sqa_
1690 - sqp_
1691 - squ_
1692 target:
1693 - code
1694 - doc
1695
1696- name: Sentry Organization Auth Token
1697 severity: high
1698 confidence: strong
1699 type: pattern
1700 values:
1701 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1702 min_line_len: 37
1703 filter_type:
1704 - ValuePatternCheck
1705 required_substrings:
1706 - sntrys_eyJ
1707 target:
1708 - code
1709 - doc
1710
1711- name: Sentry User Auth Token
1712 severity: high
1713 confidence: strong
1714 type: pattern
1715 values:
1716 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1717 min_line_len: 37
1718 filter_type:
1719 - ValuePatternCheck
1720 required_substrings:
1721 - sntryu_
1722 target:
1723 - code
1724 - doc
1725
1726- name: Discord Bot Token
1727 severity: high
1728 confidence: strong
1729 type: pattern
1730 values:
1731 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1732 min_line_len: 62
1733 filter_type:
1734 - ValueDiscordBotCheck
1735 required_substrings:
1736 - M
1737 - N
1738 - O
1739 required_regex: "[0-9A-Za-z_/+-]{15}"
1740 target:
1741 - code
1742 - doc
1743
1744- name: Discord Webhook
1745 severity: medium
1746 confidence: strong
1747 type: pattern
1748 values:
1749 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1750 filter_type:
1751 - ValueMorphemesCheck
1752 required_substrings:
1753 - discordapp.com/api/webhooks
1754 - discord.com/api/webhooks
1755 min_line_len: 61
1756 target:
1757 - code
1758 - doc
1759
1760- name: Vercel Token
1761 severity: medium
1762 confidence: weak
1763 type: pattern
1764 values:
1765 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
1766 min_line_len: 60
1767 filter_type: TokenPattern
1768 required_substrings:
1769 - vcp_
1770 target:
1771 - code
1772 - doc
1773
1774- name: Netlify Token
1775 severity: medium
1776 confidence: weak
1777 type: pattern
1778 values:
1779 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
1780 min_line_len: 40
1781 filter_type: TokenPattern
1782 required_substrings:
1783 - nfp_
1784 target:
1785 - code
1786 - doc
1787
1788- name: PostHog Credentials
1789 severity: medium
1790 confidence: weak
1791 type: pattern
1792 values:
1793 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
1794 min_line_len: 44
1795 filter_type: TokenPattern
1796 required_substrings:
1797 - phx_
1798 - phs_
1799 - phr_
1800 - pha_
1801 - phc_
1802 target:
1803 - code
1804 - doc
1805
1806- name: RubyGems API Key
1807 severity: medium
1808 confidence: strong
1809 type: pattern
1810 values:
1811 - (?P<value>rubygems_[0-9a-f]{48})
1812 min_line_len: 57
1813 filter_type: TokenPattern
1814 required_substrings:
1815 - rubygems_
1816 target:
1817 - code
1818 - doc
1819
1820- name: Databricks Access Token
1821 severity: medium
1822 confidence: strong
1823 type: pattern
1824 values:
1825 - (?P<value>dapi[0-9a-f]{32})
1826 min_line_len: 36
1827 filter_type: TokenPattern
1828 required_substrings:
1829 - dapi
1830 target:
1831 - code
1832 - doc
1833
1834- name: Tencent WeChat API App ID
1835 severity: medium
1836 confidence: weak
1837 type: pattern
1838 values:
1839 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1840 min_line_len: 18
1841 filter_type: TokenPattern
1842 required_substrings:
1843 - wx
1844 target:
1845 - code
1846 - doc
1847
1848- name: WunderGraph API Key
1849 severity: medium
1850 confidence: strong
1851 type: pattern
1852 values:
1853 - (?P<value>cosmo_[0-9a-f]{32})
1854 min_line_len: 38
1855 filter_type: TokenPattern
1856 required_substrings:
1857 - cosmo_
1858 target:
1859 - code
1860 - doc
1861
1862- name: Supabase Credentials
1863 severity: medium
1864 confidence: strong
1865 type: pattern
1866 values:
1867 - (?P<value>sbp_(v0_)?[0-9a-f]{40})
1868 min_line_len: 44
1869 filter_type: TokenPattern
1870 required_substrings:
1871 - sbp_
1872 target:
1873 - code
1874 - doc
1875
1876- name: Salesforce Credentials
1877 severity: medium
1878 confidence: weak
1879 type: pattern
1880 values:
1881 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1882 min_line_len: 12
1883 filter_type:
1884 - ValuePatternCheck(9)
1885 - ValueNumberCheck
1886 - ValueBase64PartCheck
1887 required_substrings:
1888 - "3MVG"
1889 - "00D"
1890 target:
1891 - code
1892 - doc
1893
1894- name: Postman Credentials
1895 severity: medium
1896 confidence: moderate
1897 type: pattern
1898 values:
1899 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1900 min_line_len: 29
1901 filter_type:
1902 - ValuePatternCheck
1903 required_substrings:
1904 - PMAK-
1905 - PMAT-
1906 target:
1907 - code
1908 - doc
1909
1910- name: NTLM Token
1911 severity: medium
1912 confidence: strong
1913 type: pattern
1914 values:
1915 - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1916 filter_type:
1917 - ValueMorphemesCheck(2)
1918 - ValuePatternCheck
1919 min_line_len: 160
1920 required_substrings:
1921 - TlRMTVNTUAADAAAA
1922 target:
1923 - doc
1924 - code
1925
1926- name: Basic Authorization
1927 severity: medium
1928 confidence: strong
1929 type: pattern
1930 values:
1931 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1932 min_line_len: 18
1933 filter_type:
1934 - ValueBasicAuthCheck
1935 required_substrings:
1936 - basic
1937 target:
1938 - code
1939 - doc
1940
1941- name: Bearer Authorization
1942 severity: medium
1943 confidence: moderate
1944 type: pattern
1945 values:
1946 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1947 min_line_len: 37
1948 filter_type: GeneralKeyword
1949 required_substrings:
1950 - bearer
1951 - ntlm
1952 target:
1953 - code
1954 - doc
1955
1956- name: SQL Password
1957 severity: medium
1958 confidence: weak
1959 type: pattern
1960 values:
1961 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1962 filter_type:
1963 - ValueAllowlistCheck
1964 - ValuePatternCheck
1965 use_ml: true
1966 min_line_len: 8
1967 required_substrings:
1968 - password
1969 - identified
1970 target:
1971 - doc
1972 - code
1973
1974- name: CURL User Password
1975 severity: high
1976 confidence: moderate
1977 type: pattern
1978 values:
1979 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1980 filter_type: GeneralKeyword
1981 use_ml: true
1982 required_substrings:
1983 - curl
1984 min_line_len: 16
1985 target:
1986 - doc
1987 - code
1988
1989- name: CMD ConvertTo-SecureString
1990 severity: high
1991 confidence: moderate
1992 type: pattern
1993 values:
1994 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1995 filter_type: GeneralKeyword
1996 use_ml: true
1997 required_substrings:
1998 - convertto-securestring
1999 min_line_len: 27
2000 target:
2001 - doc
2002 - code
2003
2004- name: CMD Password
2005 severity: high
2006 confidence: moderate
2007 type: pattern
2008 values:
2009 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2010 filter_type: GeneralKeyword
2011 use_ml: true
2012 required_substrings:
2013 - pass
2014 min_line_len: 12
2015 target:
2016 - doc
2017 - code
2018
2019- name: CMD Token
2020 severity: high
2021 confidence: moderate
2022 type: pattern
2023 values:
2024 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2025 filter_type: GeneralKeyword
2026 use_ml: true
2027 required_substrings:
2028 - token
2029 - oauth2-bearer
2030 min_line_len: 12
2031 target:
2032 - doc
2033 - code
2034
2035- name: CMD Secret
2036 severity: high
2037 confidence: moderate
2038 type: pattern
2039 values:
2040 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2041 filter_type: GeneralKeyword
2042 use_ml: true
2043 required_substrings:
2044 - secret
2045 min_line_len: 12
2046 target:
2047 - doc
2048 - code
2049
2050- name: URL Credentials
2051 severity: high
2052 confidence: moderate
2053 type: pattern
2054 values:
2055 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
2056 filter_type: UrlCredentialsGroup
2057 use_ml: true
2058 required_substrings:
2059 - ://
2060 min_line_len: 10
2061 target:
2062 - doc
2063 - code
2064
2065- name: API
2066 severity: low
2067 confidence: moderate
2068 type: keyword
2069 values:
2070 - api(?!tal)
2071 filter_type: GeneralKeyword
2072 use_ml: true
2073 min_line_len: 11
2074 required_substrings:
2075 - api
2076 target:
2077 - code
2078
2079- name: Auth
2080 severity: medium
2081 confidence: moderate
2082 type: keyword
2083 values:
2084 - auth(?!ors?(?!i[tz]))
2085 filter_type: GeneralKeyword
2086 use_ml: true
2087 min_line_len: 12
2088 required_substrings:
2089 - auth
2090 target:
2091 - code
2092
2093- name: Credential
2094 severity: medium
2095 confidence: moderate
2096 type: keyword
2097 values:
2098 - credential
2099 filter_type: GeneralKeyword
2100 use_ml: true
2101 min_line_len: 18
2102 required_substrings:
2103 - credential
2104 target:
2105 - code
2106
2107- name: Key
2108 severity: high
2109 confidence: moderate
2110 type: keyword
2111 values:
2112 - key(?!word|board|pad|name)
2113 filter_type: GeneralKeyword
2114 use_ml: true
2115 min_line_len: 11
2116 required_substrings:
2117 - key
2118 target:
2119 - code
2120
2121- name: Nonce
2122 severity: low
2123 confidence: moderate
2124 type: keyword
2125 values:
2126 - (?<!\\)nonce
2127 filter_type: GeneralKeyword
2128 use_ml: true
2129 min_line_len: 13
2130 required_substrings:
2131 - nonce
2132 target:
2133 - code
2134
2135- name: Password
2136 severity: high
2137 confidence: moderate
2138 type: keyword
2139 values:
2140 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
2141 filter_type: PasswordKeyword
2142 use_ml: true
2143 min_line_len: 10
2144 required_substrings:
2145 - pass
2146 - pasw
2147 - pssw
2148 - psw
2149 - pw
2150 target:
2151 - code
2152
2153- name: Salt
2154 severity: low
2155 confidence: moderate
2156 type: keyword
2157 values:
2158 - salt
2159 filter_type: GeneralKeyword
2160 use_ml: true
2161 min_line_len: 12
2162 required_substrings:
2163 - salt
2164 target:
2165 - code
2166
2167- name: Secret
2168 severity: medium
2169 confidence: moderate
2170 type: keyword
2171 values:
2172 - secret
2173 filter_type: GeneralKeyword
2174 use_ml: true
2175 min_line_len: 14
2176 required_substrings:
2177 - secret
2178 target:
2179 - code
2180
2181- name: Token
2182 severity: high
2183 confidence: moderate
2184 type: keyword
2185 values:
2186 - token(?!ize)
2187 filter_type: GeneralKeyword
2188 use_ml: true
2189 min_line_len: 13
2190 required_substrings:
2191 - token
2192 target:
2193 - code