1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 use_ml: true
30 target:
31 - doc
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 use_ml: true
66 target:
67 - doc
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 use_ml: true
90 target:
91 - doc
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 use_ml: true
121 target:
122 - doc
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 use_ml: true
138 target:
139 - doc
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 use_ml: true
163 target:
164 - doc
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 use_ml: true
187 target:
188 - doc
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 filter_type:
197 - ValuePatternCheck(4)
198 min_line_len: 36
199 required_substrings:
200 - "-"
201 required_regex: "[0-9A-Za-z_-]{15}"
202 use_ml: false
203 target:
204 - code
205 - doc
206
207- name: Product Activation Key
208 severity: info
209 confidence: weak
210 type: pattern
211 values:
212 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Z]{5}(-[0-9A-Z]{5}){4})(?![0-9A-Za-z_+-])
213 filter_type:
214 - ValuePatternCheck(5)
215 min_line_len: 29
216 required_substrings:
217 - "-"
218 required_regex: "[0-9A-Za-z_-]{15}"
219 use_ml: false
220 target:
221 - code
222 - doc
223
224- name: Akamai Credentials
225 severity: high
226 confidence: strong
227 type: pattern
228 values:
229 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
230 filter_type: GeneralPattern
231 min_line_len: 38
232 required_substrings:
233 - akab-
234 target:
235 - code
236 - doc
237
238- name: Amazon Bedrock API Key
239 severity: high
240 confidence: moderate
241 type: pattern
242 values:
243 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
244 filter_type: GeneralPattern
245 min_line_len: 44
246 required_substrings:
247 - ABSK
248 - bedrock-api-key-
249 target:
250 - code
251 - doc
252
253- name: AWS AppSync GraphQL API Key
254 severity: high
255 confidence: moderate
256 type: pattern
257 values:
258 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>da2-[a-z0-9]{26})(?![0-9A-Za-z/+])
259 filter_type: GeneralPattern
260 min_line_len: 40
261 required_substrings:
262 - da2-
263 target:
264 - code
265 - doc
266
267- name: AWS Client ID
268 severity: medium
269 confidence: moderate
270 type: pattern
271 values:
272 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
273 filter_type: GeneralPattern
274 min_line_len: 20
275 required_substrings:
276 - A3T
277 - ABIA
278 - ACCA
279 - AGPA
280 - AIDA
281 - AIPA
282 - AKIA
283 - ANPA
284 - ANVA
285 - AROA
286 - APKA
287 - ASCA
288 - ASIA
289 target:
290 - code
291 - doc
292
293- name: AWS Multi
294 severity: high
295 confidence: moderate
296 type: multi
297 values:
298 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
299 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
300 filter_type:
301 - LineSpecificKeyCheck
302 - ValuePatternCheck
303 - ValueBase64PartCheck
304 - ValueMorphemesCheck
305 min_line_len: 20
306 required_substrings:
307 - AKIA
308 - ASIA
309 target:
310 - code
311 - doc
312
313- name: Alibaba Access Key ID
314 severity: medium
315 confidence: moderate
316 type: pattern
317 values:
318 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
319 filter_type: GeneralPattern
320 min_line_len: 16
321 required_substrings:
322 - LTAI
323 target:
324 - code
325 - doc
326
327- name: Alibaba Multi
328 severity: high
329 confidence: moderate
330 type: multi
331 values:
332 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
333 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){30}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
334 filter_type:
335 - LineSpecificKeyCheck
336 - ValuePatternCheck
337 - ValueBase64PartCheck
338 - ValueMorphemesCheck
339 min_line_len: 20
340 required_substrings:
341 - LTAI
342 target:
343 - code
344 - doc
345
346- name: AWS MWS Key
347 severity: high
348 confidence: strong
349 type: pattern
350 values:
351 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
352 filter_type: GeneralPattern
353 min_line_len: 30
354 required_substrings:
355 - amzn.mws.
356 target:
357 - code
358 - doc
359
360- name: Defined Networking API Key
361 severity: high
362 confidence: strong
363 type: pattern
364 values:
365 - (?P<value>dnkey-[A-Z2-7]{26}-[A-Z2-7]{52})
366 filter_type: GeneralPattern
367 min_line_len: 85
368 required_substrings:
369 - dnkey-
370 target:
371 - code
372 - doc
373
374- name: Dynatrace API Token
375 severity: high
376 confidence: moderate
377 type: pattern
378 values:
379 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[a-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
380 filter_type: TokenPattern
381 min_line_len: 90
382 required_substrings:
383 - dt0
384 target:
385 - code
386 - doc
387
388- name: Doppler API Key
389 severity: high
390 confidence: strong
391 type: pattern
392 values:
393 - (?P<value>dp\.pt\.[0-9A-Za-z]{43})
394 filter_type: GeneralPattern
395 min_line_len: 49
396 required_substrings:
397 - dp.pt.
398 target:
399 - code
400 - doc
401
402- name: Facebook Access Token
403 severity: high
404 confidence: moderate
405 type: pattern
406 values:
407 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
408 filter_type:
409 - ValuePatternCheck
410 - ValueBase64PartCheck
411 - ValueNotPartEncodedCheck
412 min_line_len: 80
413 required_substrings:
414 - EAA
415 target:
416 - code
417 - doc
418
419- name: Facebook App Token
420 severity: high
421 confidence: moderate
422 type: pattern
423 values:
424 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
425 filter_type: TokenPattern
426 min_line_len: 33
427 required_substrings:
428 - "|"
429 required_regex: "[0-9A-Za-z_-]{15}"
430 target:
431 - code
432 - doc
433
434- name: Google API Key
435 severity: high
436 confidence: moderate
437 type: pattern
438 values:
439 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
440 filter_type: TokenPattern
441 min_line_len: 39
442 required_substrings:
443 - AIza
444 target:
445 - code
446 - doc
447
448- name: Google Multi
449 severity: high
450 confidence: moderate
451 type: multi
452 values:
453 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
454 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
455 filter_type: GeneralPattern
456 min_line_len: 40
457 required_substrings:
458 - .apps.googleusercontent.com
459 target:
460 - code
461 - doc
462
463- name: Google OAuth Secret
464 severity: high
465 confidence: strong
466 type: pattern
467 values:
468 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
469 filter_type: TokenPattern
470 min_line_len: 40
471 required_substrings:
472 - GOCSPX-
473 target:
474 - code
475 - doc
476
477- name: Google OAuth Access Token
478 severity: high
479 confidence: moderate
480 type: pattern
481 values:
482 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
483 filter_type: TokenPattern
484 min_line_len: 27
485 required_substrings:
486 - ya29.
487 target:
488 - code
489 - doc
490
491- name: Google OAuth Refresh Token
492 severity: medium
493 confidence: weak
494 type: pattern
495 values:
496 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
497 filter_type: TokenPattern
498 min_line_len: 84
499 required_substrings:
500 - 1//0
501 target:
502 - code
503 - doc
504
505- name: Heroku Credentials
506 severity: high
507 confidence: strong
508 type: pattern
509 values:
510 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
511 filter_type: TokenPattern
512 min_line_len: 41
513 required_substrings:
514 - HRKU-
515 target:
516 - code
517 - doc
518
519- name: Instagram Access Token
520 severity: high
521 confidence: strong
522 type: pattern
523 values:
524 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
525 filter_type: TokenPattern
526 min_line_len: 105
527 required_substrings:
528 - IGQVJ
529 target:
530 - code
531 - doc
532
533- name: PASETO Token
534 severity: medium
535 confidence: moderate
536 type: pattern
537 values:
538 - (?P<value>v[1-4]\.(public|local)\.[0-9A-Za-z_-]{15,8000}(\.[0-9A-Za-z_-]{0,8000})?)
539 filter_type:
540 - ValuePatternCheck
541 min_line_len: 64
542 required_substrings:
543 - .public.
544 - .local.
545 target:
546 - code
547 - doc
548
549- name: PASERK Keys
550 severity: high
551 confidence: strong
552 type: pattern
553 values:
554 - (?P<value>k[1-4]\.(local|secret)(-pw)?\.[0-9A-Za-z_-]{15,8000})
555 filter_type:
556 - ValuePatternCheck
557 min_line_len: 64
558 required_substrings:
559 - local
560 - secret
561 target:
562 - code
563 - doc
564
565- name: JSON Web Token
566 severity: medium
567 confidence: strong
568 type: pattern
569 values:
570 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
571 filter_type:
572 - ValueJsonWebTokenCheck
573 min_line_len: 64
574 required_substrings:
575 - eyJ
576 target:
577 - code
578 - doc
579
580- name: JSON Web Key
581 severity: medium
582 confidence: strong
583 type: pattern
584 values:
585 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
586 filter_type:
587 - ValueJsonWebKeyCheck
588 min_line_len: 64
589 required_substrings:
590 - eyJ
591 - eyAi
592 - ewoi
593 - ewog
594 - ew0K
595 - WyJ
596 - W3si
597 - Wwp7
598 - Wwog
599 - Ww0K
600 - W3sK
601 target:
602 - code
603 - doc
604
605- name: JWK
606 severity: medium
607 confidence: moderate
608 type: multi
609 values:
610 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
611 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
612 filter_type:
613 - ValuePatternCheck
614 - ValueMorphemesCheck
615 min_line_len: 8
616 required_substrings:
617 - kty
618 target:
619 - code
620 - doc
621
622- name: MailChimp API Key
623 severity: high
624 confidence: moderate
625 type: pattern
626 values:
627 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
628 filter_type: TokenPattern
629 min_line_len: 35
630 required_substrings:
631 - -us
632 target:
633 - code
634 - doc
635
636- name: MailGun API Key
637 severity: high
638 confidence: moderate
639 type: pattern
640 values:
641 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
642 filter_type: TokenPattern
643 min_line_len: 36
644 required_substrings:
645 - "-"
646 - key-
647 required_regex: "[0-9A-Za-z_-]{15}"
648 target:
649 - code
650 - doc
651
652- name: PayPal Braintree Access Token
653 severity: high
654 confidence: strong
655 type: pattern
656 values:
657 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
658 filter_type: GeneralPattern
659 min_line_len: 72
660 required_substrings:
661 - access_token$production$
662 target:
663 - code
664 - doc
665
666- name: PEM Private Key
667 severity: high
668 confidence: strong
669 type: pem_key
670 values:
671 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
672 min_line_len: 27
673 target:
674 - code
675 - doc
676
677- name: BASE64 encoded PEM Private Key
678 severity: high
679 confidence: strong
680 type: pattern
681 values:
682 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
683 filter_type:
684 - ValueBase64EncodedPem
685 min_line_len: 300
686 required_substrings:
687 - UFJJVkFURSBLRVkt
688 - QUklWQVRFIEtFWS0t
689 - FBSSVZBVEUgS0VZ
690 target:
691 - code
692 - doc
693
694- name: BASE64 Private Key
695 severity: high
696 confidence: strong
697 type: pattern
698 values:
699 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
700 filter_type:
701 - ValueBase64KeyCheck
702 min_line_len: 160
703 required_substrings:
704 - MII
705 target:
706 - code
707 - doc
708
709- name: Picatic API Key
710 severity: high
711 confidence: strong
712 type: pattern
713 values:
714 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
715 filter_type: GeneralPattern
716 min_line_len: 40
717 required_substrings:
718 - sk_live_
719 target:
720 - code
721 - doc
722
723- name: SendGrid API Key
724 severity: high
725 confidence: moderate
726 type: pattern
727 values:
728 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
729 filter_type: TokenPattern
730 min_line_len: 34
731 required_substrings:
732 - SG.
733 target:
734 - code
735 - doc
736
737- name: Clojars Deploy Token
738 severity: high
739 confidence: strong
740 type: pattern
741 values:
742 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
743 filter_type: TokenPattern
744 min_line_len: 68
745 required_substrings:
746 - CLOJARS_
747 target:
748 - code
749 - doc
750
751- name: Shopify Token
752 severity: high
753 confidence: strong
754 type: pattern
755 values:
756 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
757 filter_type: TokenPattern
758 min_line_len: 38
759 required_substrings:
760 - shp
761 target:
762 - code
763 - doc
764
765- name: Slack Token
766 severity: high
767 confidence: strong
768 type: pattern
769 values:
770 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
771 filter_type: TokenPattern
772 min_line_len: 15
773 required_substrings:
774 - xox
775 - xapp
776 target:
777 - code
778 - doc
779
780- name: Slack Webhook
781 severity: medium
782 confidence: strong
783 type: pattern
784 values:
785 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
786 filter_type: GeneralPattern
787 min_line_len: 61
788 required_substrings:
789 - hooks.slack.com/services/T
790 target:
791 - code
792 - doc
793
794- name: Stripe Credentials
795 severity: high
796 confidence: strong
797 type: pattern
798 values:
799 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
800 filter_type: GeneralPattern
801 min_line_len: 32
802 required_substrings:
803 - k_live_
804 - k_test_
805 - whsec_
806 target:
807 - code
808 - doc
809
810- name: Square Access Token
811 severity: high
812 confidence: moderate
813 type: pattern
814 values:
815 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
816 filter_type:
817 - ValuePatternCheck
818 - ValueBase64PartCheck
819 min_line_len: 64
820 required_substrings:
821 - EAAA
822 target:
823 - code
824 - doc
825
826- name: Square Credentials
827 severity: medium
828 confidence: strong
829 type: pattern
830 values:
831 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
832 filter_type: TokenPattern
833 min_line_len: 29
834 required_substrings:
835 - sq0
836 target:
837 - code
838 - doc
839
840- name: Twilio Credentials
841 severity: high
842 confidence: moderate
843 type: pattern
844 values:
845 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
846 filter_type: TokenPattern
847 min_line_len: 34
848 required_substrings:
849 - AC
850 - AD
851 - AL
852 - CA
853 - CF
854 - CL
855 - CN
856 - CR
857 - FW
858 - IP
859 - KS
860 - MM
861 - "NO"
862 - PK
863 - PN
864 - QU
865 - RE
866 - SC
867 - SD
868 - SK
869 - SM
870 - TR
871 - UT
872 - XE
873 - XR
874 required_regex: "[0-9A-Za-z_-]{15}"
875 target:
876 - code
877 - doc
878
879- name: Twilio Multi
880 severity: critical
881 confidence: moderate
882 type: multi
883 values:
884 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|SK)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
885 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9a-f]{32})(?![0-9A-Za-z_+-])
886 filter_type:
887 - ValuePatternCheck
888 - ValueMorphemesCheck
889 min_line_len: 34
890 required_substrings:
891 - AC
892 - SK
893 required_regex: "[0-9A-Za-z_-]{15}"
894 target:
895 - code
896 - doc
897
898- name: Telegram Bot API Token
899 severity: high
900 confidence: moderate
901 type: pattern
902 values:
903 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
904 filter_type: TokenPattern
905 min_line_len: 45
906 required_substrings:
907 - :AA
908 target:
909 - code
910 - doc
911
912- name: PyPi API Token
913 severity: high
914 confidence: strong
915 type: pattern
916 values:
917 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
918 filter_type: TokenPattern
919 min_line_len: 155
920 required_substrings:
921 - pypi-
922 target:
923 - code
924 - doc
925
926- name: NPM Token
927 severity: high
928 confidence: strong
929 type: pattern
930 values:
931 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
932 filter_type:
933 - ValueGitHubCheck
934 min_line_len: 40
935 required_substrings:
936 - npm_
937 target:
938 - code
939 - doc
940
941- name: Github App Installation Token
942 severity: high
943 confidence: strong
944 type: pattern
945 values:
946 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
947 filter_type:
948 - ValuePatternCheck
949 min_line_len: 40
950 required_substrings:
951 - ghs_
952 target:
953 - code
954 - doc
955
956- name: Github Classic Token
957 severity: high
958 confidence: strong
959 type: pattern
960 values:
961 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
962 filter_type:
963 - ValueGitHubCheck
964 min_line_len: 40
965 required_substrings:
966 - ghp_
967 - gho_
968 - ghu_
969 - ghs_
970 - ghr_
971 target:
972 - code
973 - doc
974
975- name: Github Fine-granted Token
976 severity: high
977 confidence: strong
978 type: pattern
979 values:
980 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
981 filter_type: GeneralPattern
982 min_line_len: 90
983 required_substrings:
984 - github_pat_
985 target:
986 - code
987 - doc
988
989- name: Firebase Domain
990 severity: info
991 confidence: moderate
992 type: pattern
993 values:
994 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
995 filter_type: GeneralPattern
996 min_line_len: 16
997 required_substrings:
998 - .firebase
999 target:
1000 - code
1001 - doc
1002
1003- name: AWS S3 Bucket
1004 severity: info
1005 confidence: moderate
1006 type: pattern
1007 values:
1008 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
1009 filter_type: GeneralPattern
1010 min_line_len: 14
1011 required_substrings:
1012 - .s3-website
1013 - .s3.amazonaws.com
1014 target:
1015 - code
1016 - doc
1017
1018- name: Jfrog Token
1019 severity: high
1020 confidence: strong
1021 type: pattern
1022 values:
1023 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
1024 filter_type:
1025 - ValueJfrogTokenCheck
1026 min_line_len: 64
1027 required_substrings:
1028 - cmVmdGtuO
1029 - AKCp
1030 target:
1031 - code
1032 - doc
1033
1034- name: Azure Access Token
1035 severity: high
1036 confidence: strong
1037 type: pattern
1038 values:
1039 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
1040 filter_type:
1041 - ValueAzureTokenCheck
1042 min_line_len: 148
1043 required_substrings:
1044 - eyJ
1045 target:
1046 - code
1047 - doc
1048
1049- name: Azure Secret Value
1050 severity: high
1051 confidence: moderate
1052 type: pattern
1053 values:
1054 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
1055 filter_type: TokenPattern
1056 min_line_len: 40
1057 required_substrings:
1058 - 8Q~
1059 target:
1060 - code
1061 - doc
1062
1063- name: Azure Storage Account Key
1064 severity: high
1065 confidence: moderate
1066 type: pattern
1067 values:
1068 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
1069 filter_type:
1070 - ValuePatternCheck(17)
1071 min_line_len: 80
1072 required_substrings:
1073 - JQQJ99
1074 - JQQJ9D
1075 - JQQJ9H
1076 target:
1077 - code
1078 - doc
1079
1080- name: Bitbucket App Password
1081 severity: high
1082 confidence: strong
1083 type: pattern
1084 values:
1085 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
1086 filter_type:
1087 - ValueAtlassianTokenCheck
1088 min_line_len: 28
1089 required_substrings:
1090 - ATBB
1091 target:
1092 - code
1093 - doc
1094
1095- name: Bitbucket Repository Access Token
1096 severity: high
1097 confidence: strong
1098 type: pattern
1099 values:
1100 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|(%|\\u00)3[dD])[A-F0-9]{8})
1101 filter_type:
1102 - ValueAtlassianTokenCheck
1103 min_line_len: 160
1104 required_substrings:
1105 - ATCTT3xFfGN0
1106 target:
1107 - code
1108 - doc
1109
1110- name: Bitbucket HTTP Access Token
1111 severity: high
1112 confidence: strong
1113 type: pattern
1114 values:
1115 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
1116 filter_type:
1117 - ValueAtlassianTokenCheck
1118 min_line_len: 49
1119 required_substrings:
1120 - BBDC-
1121 target:
1122 - code
1123 - doc
1124
1125- name: Jira / Confluence PAT token
1126 severity: high
1127 confidence: strong
1128 type: pattern
1129 values:
1130 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1131 filter_type:
1132 - ValueAtlassianTokenCheck
1133 min_line_len: 44
1134 required_substrings:
1135 - M
1136 - N
1137 - O
1138 required_regex: "[0-9A-Za-z_-]{15}"
1139 target:
1140 - code
1141 - doc
1142
1143- name: Atlassian PAT token
1144 severity: high
1145 confidence: strong
1146 type: pattern
1147 values:
1148 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|(%|\\u00)3[dD])[A-F0-9]{8})
1149 filter_type:
1150 - ValueAtlassianTokenCheck
1151 min_line_len: 160
1152 required_substrings:
1153 - ATATT3xFfGF0
1154 target:
1155 - code
1156 - doc
1157
1158- name: CircleCI Personal API Token
1159 severity: high
1160 confidence: strong
1161 type: pattern
1162 values:
1163 - (?P<value>CCIPAT_[0-9A-Za-z]{22}_[0-9a-f]{40})
1164 filter_type: TokenPattern
1165 min_line_len: 70
1166 required_substrings:
1167 - CCIPAT_
1168 target:
1169 - code
1170 - doc
1171
1172- name: Digital Ocean Token
1173 severity: high
1174 confidence: strong
1175 type: pattern
1176 values:
1177 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1178 filter_type: TokenPattern
1179 min_line_len: 71
1180 required_substrings:
1181 - doo_v1_
1182 - dop_v1_
1183 - dor_v1_
1184 target:
1185 - code
1186 - doc
1187
1188- name: Dropbox OAuth2 API Access Token
1189 severity: high
1190 confidence: moderate
1191 type: pattern
1192 values:
1193 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1194 filter_type: TokenPattern
1195 min_line_len: 80
1196 required_substrings:
1197 - sl.
1198 target:
1199 - code
1200 - doc
1201
1202- name: NuGet API key
1203 severity: high
1204 confidence: moderate
1205 type: pattern
1206 values:
1207 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1208 filter_type: TokenPattern
1209 min_line_len: 46
1210 required_substrings:
1211 - oy2
1212 target:
1213 - code
1214 - doc
1215
1216- name: Gitlab Prefix Token
1217 severity: high
1218 confidence: strong
1219 type: pattern
1220 values:
1221 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1222 filter_type:
1223 - ValuePatternCheck
1224 min_line_len: 25
1225 required_substrings:
1226 - _gitlab_session=
1227 - GR1348941
1228 - glagent-
1229 - glsoat-
1230 - glffct-
1231 - glpat-
1232 - gloas-
1233 - glptt-
1234 - glcbt-
1235 - glimt-
1236 - gldt-
1237 - glft-
1238 - glrt-
1239 - glrtr-
1240 - glwt-
1241 target:
1242 - code
1243 - doc
1244
1245- name: Grafana Provisioned API Key
1246 severity: high
1247 confidence: strong
1248 type: pattern
1249 values:
1250 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1251 filter_type:
1252 - ValueGrafanaCheck
1253 min_line_len: 67
1254 required_substrings:
1255 - eyJ
1256 target:
1257 - code
1258 - doc
1259
1260- name: Grafana Access Policy Token
1261 severity: high
1262 confidence: strong
1263 type: pattern
1264 values:
1265 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1266 filter_type:
1267 - ValueGrafanaCheck
1268 min_line_len: 87
1269 required_substrings:
1270 - glc_eyJ
1271 target:
1272 - code
1273 - doc
1274
1275- name: Grafana Service Account Token
1276 severity: high
1277 confidence: strong
1278 type: pattern
1279 values:
1280 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1281 filter_type:
1282 - ValueGrafanaServiceCheck
1283 min_line_len: 46
1284 required_substrings:
1285 - glsa_
1286 target:
1287 - code
1288 - doc
1289
1290- name: Dropbox API secret (long term)
1291 severity: high
1292 confidence: weak
1293 type: pattern
1294 values:
1295 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1296 filter_type: [ ]
1297 min_line_len: 43
1298 required_substrings:
1299 - AAAAAAAAAA
1300 target:
1301 - code
1302 - doc
1303
1304- name: X App-Only Authentication Bearer Token
1305 severity: high
1306 confidence: moderate
1307 type: pattern
1308 values:
1309 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AAAAAAAAAAAAAAAAAAAAA[0-9A-Za-z%]{40,42}(%|\\u00)3[dD][0-9A-Za-z]{50})(?![=0-9A-Za-z_/+-])
1310 filter_type: [ ]
1311 min_line_len: 100
1312 required_substrings:
1313 - AAAAAAAAAAAAAAAAAAAAA
1314 target:
1315 - code
1316 - doc
1317
1318- name: PlanetScale Credentials
1319 severity: high
1320 confidence: moderate
1321 type: pattern
1322 values:
1323 - (?P<value>pscale_(tkn|oauth|pw)_[.0-9A-Za-z_-]{32,64})
1324 filter_type:
1325 - ValuePatternCheck
1326 min_line_len: 42
1327 required_substrings:
1328 - pscale_
1329 target:
1330 - code
1331 - doc
1332
1333- name: NewRelic Credentials
1334 severity: high
1335 confidence: moderate
1336 type: pattern
1337 values:
1338 - (?P<value>NRAK-[0-9A-Z]{27}|NRBR-[0-9a-f]{19,20}|NRII-[0-9A-Za-z_-]{25}|NRJS-[0-9a-z]{19}|[0-9a-z]{5}[0-9a-f]{31}NRAL)
1339 filter_type:
1340 - ValuePatternCheck
1341 - ValueMorphemesCheck
1342 min_line_len: 24
1343 required_substrings:
1344 - NRAK-
1345 - NRBR-
1346 - NRII-
1347 - NRJS-
1348 - NRAL
1349 target:
1350 - code
1351 - doc
1352
1353- name: Linear API Key
1354 severity: high
1355 confidence: moderate
1356 type: pattern
1357 values:
1358 - (?P<value>lin_api_[0-9A-Za-z]{40})
1359 filter_type:
1360 - ValuePatternCheck
1361 min_line_len: 48
1362 required_substrings:
1363 - lin_api_
1364 target:
1365 - code
1366 - doc
1367
1368- name: CloudFlare API Token
1369 severity: high
1370 confidence: strong
1371 type: pattern
1372 values:
1373 - (?P<value>cf(at|ut|k)_[0-9A-Za-z]{40}[0-9a-f]{8})
1374 filter_type:
1375 - ValueCloudFlareCheck
1376 min_line_len: 24
1377 required_substrings:
1378 - cfat_
1379 - cfut_
1380 - cfk_
1381 target:
1382 - code
1383 - doc
1384
1385- name: Age Secret Key
1386 severity: high
1387 confidence: strong
1388 type: pattern
1389 values:
1390 - (?P<value>AGE-SECRET-KEY-1[0-9A-Z]{58})
1391 filter_type:
1392 - ValueBech32Check
1393 min_line_len: 74
1394 required_substrings:
1395 - AGE-SECRET-KEY-1
1396 target:
1397 - code
1398 - doc
1399
1400- name: Dropbox App secret
1401 severity: info
1402 confidence: weak
1403 type: pattern
1404 values:
1405 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1406 filter_type: WeirdBase36Token
1407 min_line_len: 15
1408 required_regex: "[0-9A-Za-z_-]{15}"
1409 target:
1410 - code
1411 - doc
1412
1413- name: Hashicorp Vault Token
1414 severity: high
1415 confidence: strong
1416 type: pattern
1417 values:
1418 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1419 filter_type:
1420 - ValuePatternCheck
1421 - ValueEntropyBase64Check
1422 min_line_len: 90
1423 required_substrings:
1424 - hvb.
1425 - hvr.
1426 - hvs.
1427 target:
1428 - code
1429 - doc
1430
1431- name: Hashicorp Terraform Token
1432 severity: high
1433 confidence: strong
1434 type: pattern
1435 values:
1436 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1437 filter_type:
1438 - ValuePatternCheck
1439 - ValueMorphemesCheck
1440 min_line_len: 90
1441 required_substrings:
1442 - .atlasv1.
1443 target:
1444 - code
1445 - doc
1446
1447- name: Airtable API Key
1448 severity: high
1449 confidence: moderate
1450 type: pattern
1451 values:
1452 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>pat[0-9A-Za-z]{14}\.[0-9a-f]{64})(?![=0-9A-Za-z_+-])
1453 filter_type:
1454 - ValuePatternCheck
1455 - ValueMorphemesCheck
1456 min_line_len: 82
1457 required_substrings:
1458 - pat
1459 target:
1460 - code
1461 - doc
1462
1463- name: NKEY Seed
1464 severity: high
1465 confidence: weak
1466 type: pattern
1467 values:
1468 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1469 filter_type:
1470 - ValueMorphemesCheck
1471 - ValuePatternCheck
1472 - ValueEntropyBase32Check
1473 - ValueBase32DataCheck
1474 - ValueTokenBase32Check
1475 min_line_len: 42
1476 required_substrings:
1477 - SA
1478 - SC
1479 - SN
1480 - SO
1481 - SP
1482 - SU
1483 - SX
1484 required_regex: "[0-9A-Za-z_-]{15}"
1485 target:
1486 - code
1487 - doc
1488
1489- name: OTP / 2FA Secret
1490 severity: info
1491 confidence: weak
1492 type: pattern
1493 values:
1494 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1495 filter_type:
1496 - ValueMorphemesCheck
1497 - ValuePatternCheck
1498 - ValueEntropyBase32Check
1499 - ValueBase32DataCheck
1500 - ValueTokenBase32Check
1501 - ValueBase64PartCheck
1502 min_line_len: 16
1503 required_regex: "[0-9A-Za-z_-]{15}"
1504 target:
1505 - code
1506 - doc
1507
1508- name: OpenAI Token
1509 severity: high
1510 confidence: strong
1511 type: pattern
1512 values:
1513 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1514 filter_type:
1515 - ValuePatternCheck
1516 - ValueMorphemesCheck
1517 min_line_len: 51
1518 required_substrings:
1519 - T3BlbkFJ
1520 - 9wZW5BS
1521 - PcGVuQU
1522 target:
1523 - code
1524 - doc
1525
1526- name: Docker Access Token
1527 severity: high
1528 confidence: strong
1529 type: pattern
1530 values:
1531 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1532 filter_type:
1533 - ValuePatternCheck
1534 - ValueMorphemesCheck
1535 min_line_len: 36
1536 required_substrings:
1537 - dckr_pat_
1538 - dckr_oat_
1539 target:
1540 - code
1541 - doc
1542
1543- name: Docker Swarm Token
1544 severity: high
1545 confidence: strong
1546 type: pattern
1547 values:
1548 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1549 filter_type:
1550 - ValuePatternCheck
1551 - ValueMorphemesCheck
1552 min_line_len: 85
1553 required_substrings:
1554 - SWMTKN-1-
1555 target:
1556 - code
1557 - doc
1558
1559- name: Docker Swarm Key
1560 severity: high
1561 confidence: strong
1562 type: pattern
1563 values:
1564 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1565 filter_type:
1566 - ValuePatternCheck
1567 - ValueMorphemesCheck
1568 min_line_len: 52
1569 required_substrings:
1570 - SWMKEY-1-
1571 target:
1572 - code
1573 - doc
1574
1575- name: Groq API Key
1576 severity: high
1577 confidence: strong
1578 type: pattern
1579 values:
1580 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1581 filter_type:
1582 - ValuePatternCheck
1583 min_line_len: 56
1584 required_substrings:
1585 - WGdyb3FY
1586 - hncm9xW
1587 - YZ3JvcV
1588 target:
1589 - code
1590 - doc
1591
1592- name: X AI API Key
1593 severity: high
1594 confidence: moderate
1595 type: pattern
1596 values:
1597 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1598 filter_type:
1599 - ValuePatternCheck
1600 - ValueEntropyBase64Check
1601 min_line_len: 84
1602 required_substrings:
1603 - xai-
1604 target:
1605 - code
1606 - doc
1607
1608- name: Composio Credentials
1609 severity: high
1610 confidence: weak
1611 type: pattern
1612 values:
1613 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(?:[ou]?a|c)k_[0-9A-Za-z_-]{16,80})
1614 filter_type:
1615 - ValueMorphemesCheck(1)
1616 - ValueBase64DataCheck
1617 - ValueTokenBase64Check
1618 - ValueEntropyBase64Check
1619 - ValuePatternCheck
1620 - ValueNotPartEncodedCheck
1621 - ValueBase64PartCheck
1622 min_line_len: 19
1623 required_substrings:
1624 - ak_
1625 - ck_
1626 target:
1627 - code
1628 - doc
1629
1630- name: Notion Integration Token
1631 severity: high
1632 confidence: strong
1633 type: pattern
1634 values:
1635 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1636 filter_type:
1637 - ValuePatternCheck
1638 - ValueEntropyBase64Check
1639 min_line_len: 50
1640 required_substrings:
1641 - ntn_
1642 target:
1643 - code
1644 - doc
1645
1646- name: Hugging Face User Access Token
1647 severity: high
1648 confidence: moderate
1649 type: pattern
1650 values:
1651 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1652 filter_type:
1653 - ValuePatternCheck
1654 - ValueEntropyBase64Check
1655 min_line_len: 37
1656 required_substrings:
1657 - hf_
1658 target:
1659 - code
1660 - doc
1661
1662- name: Anthropic API Key
1663 severity: high
1664 confidence: strong
1665 type: pattern
1666 values:
1667 - (?P<value>sk-ant-(api|admin)0[1-4]-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1668 filter_type:
1669 - ValuePatternCheck
1670 min_line_len: 77
1671 required_substrings:
1672 - sk-ant-
1673 target:
1674 - code
1675 - doc
1676
1677- name: Perplexity API Key
1678 severity: high
1679 confidence: strong
1680 type: pattern
1681 values:
1682 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1683 filter_type:
1684 - ValuePatternCheck
1685 min_line_len: 45
1686 required_substrings:
1687 - pplx-
1688 target:
1689 - code
1690 - doc
1691
1692- name: Tailscale Credentials
1693 severity: high
1694 confidence: strong
1695 type: pattern
1696 values:
1697 - (?P<value>tskey-(api|auth|client|scim|webhook)-[0-9A-Za-z]{12,24}-[0-9A-Za-z]{32})
1698 filter_type:
1699 - ValuePatternCheck
1700 min_line_len: 61
1701 required_substrings:
1702 - tskey-
1703 target:
1704 - code
1705 - doc
1706
1707- name: Contentful Credentials
1708 severity: high
1709 confidence: strong
1710 type: pattern
1711 values:
1712 - (?P<value>CFPAT-[0-9A-Za-z_-]{43})(?![0-9A-Za-z_-])
1713 filter_type:
1714 - ValuePatternCheck
1715 min_line_len: 49
1716 required_substrings:
1717 - CFPAT-
1718 target:
1719 - code
1720 - doc
1721
1722- name: Pulumi Personal Access Token
1723 severity: high
1724 confidence: strong
1725 type: pattern
1726 values:
1727 - (?P<value>pul-[0-9a-f]{40})
1728 filter_type:
1729 - ValuePatternCheck
1730 min_line_len: 44
1731 required_substrings:
1732 - pul-
1733 target:
1734 - code
1735 - doc
1736
1737- name: DeepSeek API Key
1738 severity: high
1739 confidence: moderate
1740 type: pattern
1741 values:
1742 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1743 filter_type:
1744 - ValuePatternCheck
1745 min_line_len: 35
1746 required_substrings:
1747 - sk-
1748 target:
1749 - code
1750 - doc
1751
1752- name: Tavily API Key
1753 severity: high
1754 confidence: strong
1755 type: pattern
1756 values:
1757 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1758 filter_type:
1759 - ValuePatternCheck
1760 min_line_len: 37
1761 required_substrings:
1762 - tvly-
1763 target:
1764 - code
1765 - doc
1766
1767- name: Figma Personal Access Token
1768 severity: high
1769 confidence: strong
1770 type: pattern
1771 values:
1772 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1773 filter_type:
1774 - ValuePatternCheck
1775 min_line_len: 45
1776 required_substrings:
1777 - figd_
1778 target:
1779 - code
1780 - doc
1781
1782- name: 1Password Account Token
1783 severity: high
1784 confidence: strong
1785 type: pattern
1786 values:
1787 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1788 filter_type:
1789 - ValuePatternCheck
1790 min_line_len: 192
1791 required_substrings:
1792 - InNlY3JldEtleSI6
1793 - JzZWNyZXRLZXkiO
1794 - ic2VjcmV0S2V5Ij
1795 target:
1796 - code
1797 - doc
1798
1799- name: Brevo API Key
1800 severity: high
1801 confidence: strong
1802 type: pattern
1803 values:
1804 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1805 filter_type:
1806 - ValuePatternCheck
1807 min_line_len: 89
1808 required_substrings:
1809 - xkeysib-
1810 target:
1811 - code
1812 - doc
1813
1814- name: Together AI API Key
1815 severity: high
1816 confidence: strong
1817 type: pattern
1818 values:
1819 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1820 filter_type:
1821 - ValuePatternCheck
1822 min_line_len: 50
1823 required_substrings:
1824 - tgp_v1_
1825 target:
1826 - code
1827 - doc
1828
1829- name: LLAMA API Key
1830 severity: high
1831 confidence: strong
1832 type: pattern
1833 values:
1834 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1835 filter_type:
1836 - ValuePatternCheck
1837 min_line_len: 52
1838 required_substrings:
1839 - llx-
1840 target:
1841 - code
1842 - doc
1843
1844- name: SonarQube Credentials
1845 severity: medium
1846 confidence: moderate
1847 type: pattern
1848 values:
1849 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1850 filter_type:
1851 - ValuePatternCheck
1852 min_line_len: 44
1853 required_substrings:
1854 - sqa_
1855 - sqp_
1856 - squ_
1857 target:
1858 - code
1859 - doc
1860
1861- name: Sentry Organization Auth Token
1862 severity: high
1863 confidence: strong
1864 type: pattern
1865 values:
1866 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1867 filter_type:
1868 - ValuePatternCheck
1869 min_line_len: 37
1870 required_substrings:
1871 - sntrys_eyJ
1872 target:
1873 - code
1874 - doc
1875
1876- name: Sentry User Auth Token
1877 severity: high
1878 confidence: strong
1879 type: pattern
1880 values:
1881 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1882 filter_type:
1883 - ValuePatternCheck
1884 min_line_len: 37
1885 required_substrings:
1886 - sntryu_
1887 target:
1888 - code
1889 - doc
1890
1891- name: Discord Bot Token
1892 severity: high
1893 confidence: strong
1894 type: pattern
1895 values:
1896 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1897 filter_type:
1898 - ValueDiscordBotCheck
1899 min_line_len: 62
1900 required_substrings:
1901 - M
1902 - N
1903 - O
1904 required_regex: "[0-9A-Za-z_-]{15}"
1905 target:
1906 - code
1907 - doc
1908
1909- name: Discord Webhook
1910 severity: medium
1911 confidence: strong
1912 type: pattern
1913 values:
1914 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1915 filter_type:
1916 - ValueMorphemesCheck
1917 min_line_len: 61
1918 required_substrings:
1919 - discordapp.com/api/webhooks
1920 - discord.com/api/webhooks
1921 target:
1922 - code
1923 - doc
1924
1925- name: Nylas API Key
1926 severity: high
1927 confidence: strong
1928 type: pattern
1929 values:
1930 - (?P<value>nyk_v0_[0-9A-Za-z_-]{64})
1931 filter_type: TokenPattern
1932 min_line_len: 71
1933 required_substrings:
1934 - nyk_v0_
1935 target:
1936 - code
1937 - doc
1938
1939- name: WakaTime API Key
1940 severity: high
1941 confidence: strong
1942 type: pattern
1943 values:
1944 - (?P<value>waka_[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1945 filter_type: TokenPattern
1946 min_line_len: 40
1947 required_substrings:
1948 - waka_
1949 target:
1950 - code
1951 - doc
1952
1953- name: Riot Games API Key
1954 severity: high
1955 confidence: strong
1956 type: pattern
1957 values:
1958 - (?P<value>RGAPI-[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1959 filter_type: TokenPattern
1960 min_line_len: 41
1961 required_substrings:
1962 - RGAPI-
1963 target:
1964 - code
1965 - doc
1966
1967- name: SourceGraph Credentials
1968 severity: medium
1969 confidence: moderate
1970 type: pattern
1971 values:
1972 - (?P<value>sgp_(local_|[0-9a-f]{16}_)?[0-9a-f]{40})
1973 filter_type: TokenPattern
1974 min_line_len: 44
1975 required_substrings:
1976 - sgp_
1977 target:
1978 - code
1979 - doc
1980
1981- name: Typeform API Personal Token
1982 severity: medium
1983 confidence: weak
1984 type: pattern
1985 values:
1986 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>tfp_[0-9A-Za-z_-]{56,60})(?![0-9A-Za-z_-])
1987 filter_type: TokenPattern
1988 min_line_len: 60
1989 required_substrings:
1990 - tfp_
1991 target:
1992 - code
1993 - doc
1994
1995- name: Vercel Token
1996 severity: medium
1997 confidence: weak
1998 type: pattern
1999 values:
2000 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
2001 filter_type: TokenPattern
2002 min_line_len: 60
2003 required_substrings:
2004 - vcp_
2005 target:
2006 - code
2007 - doc
2008
2009- name: Netlify Token
2010 severity: medium
2011 confidence: weak
2012 type: pattern
2013 values:
2014 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
2015 filter_type: TokenPattern
2016 min_line_len: 40
2017 required_substrings:
2018 - nfp_
2019 target:
2020 - code
2021 - doc
2022
2023- name: PostHog Credentials
2024 severity: medium
2025 confidence: weak
2026 type: pattern
2027 values:
2028 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
2029 filter_type: TokenPattern
2030 min_line_len: 44
2031 required_substrings:
2032 - phx_
2033 - phs_
2034 - phr_
2035 - pha_
2036 - phc_
2037 target:
2038 - code
2039 - doc
2040
2041- name: RubyGems API Key
2042 severity: medium
2043 confidence: strong
2044 type: pattern
2045 values:
2046 - (?P<value>rubygems_[0-9a-f]{48})
2047 filter_type: TokenPattern
2048 min_line_len: 57
2049 required_substrings:
2050 - rubygems_
2051 target:
2052 - code
2053 - doc
2054
2055- name: Databricks Access Token
2056 severity: medium
2057 confidence: strong
2058 type: pattern
2059 values:
2060 - (?P<value>dapi[0-9a-f]{32})
2061 filter_type: TokenPattern
2062 min_line_len: 36
2063 required_substrings:
2064 - dapi
2065 target:
2066 - code
2067 - doc
2068
2069- name: Tencent WeChat API App ID
2070 severity: medium
2071 confidence: weak
2072 type: pattern
2073 values:
2074 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
2075 filter_type: TokenPattern
2076 min_line_len: 18
2077 required_substrings:
2078 - wx
2079 target:
2080 - code
2081 - doc
2082
2083- name: WunderGraph API Key
2084 severity: medium
2085 confidence: strong
2086 type: pattern
2087 values:
2088 - (?P<value>cosmo_[0-9a-f]{32})
2089 filter_type: TokenPattern
2090 min_line_len: 38
2091 required_substrings:
2092 - cosmo_
2093 target:
2094 - code
2095 - doc
2096
2097- name: Supabase Credentials
2098 severity: medium
2099 confidence: strong
2100 type: pattern
2101 values:
2102 - (?P<value>sbp_(v0_)?[0-9a-f]{40})
2103 filter_type: TokenPattern
2104 min_line_len: 44
2105 required_substrings:
2106 - sbp_
2107 target:
2108 - code
2109 - doc
2110
2111- name: Salesforce Credentials
2112 severity: medium
2113 confidence: weak
2114 type: pattern
2115 values:
2116 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
2117 filter_type:
2118 - ValuePatternCheck(9)
2119 - ValueNumberCheck
2120 - ValueBase64PartCheck
2121 min_line_len: 12
2122 required_substrings:
2123 - "3MVG"
2124 - "00D"
2125 target:
2126 - code
2127 - doc
2128
2129- name: Postman Credentials
2130 severity: medium
2131 confidence: moderate
2132 type: pattern
2133 values:
2134 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
2135 filter_type:
2136 - ValuePatternCheck
2137 min_line_len: 29
2138 required_substrings:
2139 - PMAK-
2140 - PMAT-
2141 target:
2142 - code
2143 - doc
2144
2145- name: NTLM Token
2146 severity: medium
2147 confidence: strong
2148 type: pattern
2149 values:
2150 - (?P<value>TlRMTVNTUAA[BCD]AAAA[=0-9A-Za-z_/+-]{28,8000})(?![0-9A-Za-z_/+-])
2151 filter_type:
2152 - ValueMorphemesCheck(2)
2153 - ValuePatternCheck
2154 min_line_len: 44
2155 required_substrings:
2156 - TlRMTVNTUAA
2157 target:
2158 - doc
2159 - code
2160
2161- name: Basic Authorization
2162 severity: medium
2163 confidence: strong
2164 type: pattern
2165 values:
2166 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
2167 filter_type:
2168 - ValueBasicAuthCheck
2169 min_line_len: 14
2170 required_substrings:
2171 - basic
2172 target:
2173 - code
2174 - doc
2175
2176- name: Bearer Authorization
2177 severity: medium
2178 confidence: moderate
2179 type: pattern
2180 values:
2181 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
2182 filter_type: GeneralKeyword
2183 min_line_len: 37
2184 required_substrings:
2185 - bearer
2186 - ntlm
2187 target:
2188 - code
2189 - doc
2190
2191- name: SQL Password
2192 severity: medium
2193 confidence: weak
2194 type: pattern
2195 values:
2196 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
2197 filter_type:
2198 - ValueAllowlistCheck
2199 - ValuePatternCheck
2200 min_line_len: 8
2201 required_substrings:
2202 - password
2203 - identified
2204 use_ml: true
2205 target:
2206 - doc
2207 - code
2208
2209- name: CURL Options
2210 severity: high
2211 confidence: weak
2212 type: pattern
2213 values:
2214 - (?P<variable>CURLOPT_(XOAUTH2_BEARER|(?:PROXY)?PASSWORD|(?:PROXY)?USERPWD)|KEYPASSWD)\s*,\s*(?P<value_leftquote>")(?P<value>[^"]{4,8000})(?P<value_rightquote>")?
2215 filter_type: GeneralKeyword
2216 min_line_len: 32
2217 required_substrings:
2218 - CURLOPT_XOAUTH2_BEARER
2219 - CURLOPT_PASSWORD
2220 - CURLOPT_USERPWD
2221 - CURLOPT_PROXYPASSWORD
2222 - CURLOPT_PROXYUSERPWD
2223 - CURLOPT_KEYPASSWD
2224 use_ml: true
2225 target:
2226 - doc
2227 - code
2228
2229- name: CURL User Password
2230 severity: high
2231 confidence: moderate
2232 type: pattern
2233 values:
2234 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2235 filter_type: GeneralKeyword
2236 min_line_len: 16
2237 required_substrings:
2238 - curl
2239 use_ml: true
2240 target:
2241 - doc
2242 - code
2243
2244- name: CMD ConvertTo-SecureString
2245 severity: high
2246 confidence: moderate
2247 type: pattern
2248 values:
2249 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2250 filter_type: GeneralKeyword
2251 min_line_len: 27
2252 required_substrings:
2253 - convertto-securestring
2254 use_ml: true
2255 target:
2256 - doc
2257 - code
2258
2259- name: CMD Password
2260 severity: high
2261 confidence: moderate
2262 type: pattern
2263 values:
2264 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2265 filter_type: GeneralKeyword
2266 min_line_len: 12
2267 required_substrings:
2268 - pass
2269 use_ml: true
2270 target:
2271 - doc
2272 - code
2273
2274- name: CMD Token
2275 severity: high
2276 confidence: moderate
2277 type: pattern
2278 values:
2279 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2280 filter_type: GeneralKeyword
2281 min_line_len: 12
2282 required_substrings:
2283 - token
2284 - oauth2-bearer
2285 use_ml: true
2286 target:
2287 - doc
2288 - code
2289
2290- name: CMD Secret
2291 severity: high
2292 confidence: moderate
2293 type: pattern
2294 values:
2295 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2296 filter_type: GeneralKeyword
2297 min_line_len: 12
2298 required_substrings:
2299 - secret
2300 use_ml: true
2301 target:
2302 - doc
2303 - code
2304
2305- name: URL Credentials
2306 severity: high
2307 confidence: moderate
2308 type: pattern
2309 values:
2310 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
2311 filter_type: UrlCredentialsGroup
2312 min_line_len: 10
2313 required_substrings:
2314 - ://
2315 use_ml: true
2316 target:
2317 - doc
2318 - code
2319
2320- name: API
2321 severity: low
2322 confidence: moderate
2323 type: keyword
2324 values:
2325 - api(?!tal)
2326 filter_type: GeneralKeyword
2327 min_line_len: 11
2328 required_substrings:
2329 - api
2330 use_ml: true
2331 target:
2332 - code
2333
2334- name: Auth
2335 severity: medium
2336 confidence: moderate
2337 type: keyword
2338 values:
2339 - auth(?!ors?(?!i[tz]))
2340 filter_type: GeneralKeyword
2341 min_line_len: 12
2342 required_substrings:
2343 - auth
2344 use_ml: true
2345 target:
2346 - code
2347
2348- name: Credential
2349 severity: medium
2350 confidence: moderate
2351 type: keyword
2352 values:
2353 - credential
2354 filter_type: GeneralKeyword
2355 min_line_len: 18
2356 required_substrings:
2357 - credential
2358 use_ml: true
2359 target:
2360 - code
2361
2362- name: Key
2363 severity: high
2364 confidence: moderate
2365 type: keyword
2366 values:
2367 - key(?!word|board|pad|name)
2368 filter_type: GeneralKeyword
2369 min_line_len: 11
2370 required_substrings:
2371 - key
2372 use_ml: true
2373 target:
2374 - code
2375
2376- name: Nonce
2377 severity: low
2378 confidence: moderate
2379 type: keyword
2380 values:
2381 - (?<!\\)nonce
2382 filter_type: GeneralKeyword
2383 min_line_len: 13
2384 required_substrings:
2385 - nonce
2386 use_ml: true
2387 target:
2388 - code
2389
2390- name: Password
2391 severity: high
2392 confidence: moderate
2393 type: keyword
2394 values:
2395 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
2396 filter_type: PasswordKeyword
2397 min_line_len: 10
2398 required_substrings:
2399 - pass
2400 - pasw
2401 - pssw
2402 - psw
2403 - pw
2404 use_ml: true
2405 target:
2406 - code
2407
2408- name: Salt
2409 severity: low
2410 confidence: moderate
2411 type: keyword
2412 values:
2413 - salt
2414 filter_type: GeneralKeyword
2415 min_line_len: 12
2416 required_substrings:
2417 - salt
2418 use_ml: true
2419 target:
2420 - code
2421
2422- name: Secret
2423 severity: medium
2424 confidence: moderate
2425 type: keyword
2426 values:
2427 - secret
2428 filter_type: GeneralKeyword
2429 min_line_len: 14
2430 required_substrings:
2431 - secret
2432 use_ml: true
2433 target:
2434 - code
2435
2436- name: Token
2437 severity: high
2438 confidence: moderate
2439 type: keyword
2440 values:
2441 - token(?!ize)
2442 filter_type: GeneralKeyword
2443 min_line_len: 13
2444 required_substrings:
2445 - token
2446 use_ml: true
2447 target:
2448 - code