Rules Configuration

   1- name: DOC_GET
   2  severity: medium
   3  confidence: weak
   4  type: pattern
   5  values:
   6    - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*,\s*(default\s*=\s*)?([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
   7  filter_type:
   8    - ValueAllowlistCheck
   9    - LineGitBinaryCheck
  10    - LineUUEPartCheck
  11    - ValueFilePathCheck
  12    - ValuePatternCheck(5)
  13    - ValueLengthCheck(4,80)
  14  min_line_len: 8
  15  required_substrings:
  16    - pass
  17    - pw
  18    - token
  19    - secret
  20    - key
  21    - cred
  22    - 비밀번호
  23    - 비번
  24    - 패스워드
  25    - 암호
  26    - 키
  27    - 토큰
  28  target:
  29    - doc
  30  use_ml: true
  31
  32- name: DOC_CREDENTIALS
  33  severity: medium
  34  confidence: weak
  35  type: pattern
  36  values:
  37    - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(설정은|[=:!]{1,3})\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,80}|[^\"'`]{4,80})|(?(wrap)[^\"'`)]{4,80}|\S{4,80})))
  38  filter_type:
  39    - ValueAllowlistCheck
  40    - LineGitBinaryCheck
  41    - LineUUEPartCheck
  42    - ValueFilePathCheck
  43    - ValuePatternCheck(5)
  44    - ValueLengthCheck(4,80)
  45  min_line_len: 8
  46  required_substrings:
  47    - pass
  48    - sword
  49    - pw
  50    - p/w
  51    - paasw
  52    - 비밀번호
  53    - 비번
  54    - 패스워드
  55    - 암호
  56    - token
  57    - secret
  58    - key
  59    - credential
  60    - 키
  61    - 토큰
  62  target:
  63    - doc
  64  use_ml: true
  65
  66- name: SECRET_PAIR
  67  severity: medium
  68  confidence: moderate
  69  type: pattern
  70  values:
  71    - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
  72  filter_type:
  73    - ValueAllowlistCheck
  74    - ValuePatternCheck(4)
  75    - ValueEntropyBase64Check
  76    - ValueMorphemesCheck
  77  min_line_len: 16
  78  required_substrings:
  79    - token
  80    - secret
  81    - key
  82    - 키
  83    - 암호
  84    - 토큰
  85  target:
  86    - doc
  87
  88- name: PASSWD_PAIR
  89  severity: medium
  90  confidence: moderate
  91  type: pattern
  92  values:
  93    - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
  94  filter_type:
  95    - ValueAllowlistCheck
  96    - ValuePatternCheck(4)
  97    - ValueDictionaryKeywordCheck
  98    - LineGitBinaryCheck
  99    - LineUUEPartCheck
 100    - ValueFilePathCheck
 101    - ValueHexNumberCheck
 102  min_line_len: 10
 103  required_substrings:
 104    - pass
 105    - sword
 106    - pw
 107    - p/w
 108    - paasw
 109    - 비밀번호
 110    - 비번
 111    - 패스워드
 112    - 암호
 113  target:
 114    - doc
 115
 116- name: IP_ID_PASSWORD_TRIPLE
 117  severity: medium
 118  confidence: moderate
 119  type: pattern
 120  values:
 121    - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
 122  filter_type:
 123    - ValueAllowlistCheck
 124    - ValuePatternCheck(4)
 125    - ValueDictionaryKeywordCheck
 126  min_line_len: 10
 127  required_substrings:
 128    - "."
 129  target:
 130    - doc
 131
 132- name: ID_PAIR_PASSWD_PAIR
 133  severity: medium
 134  confidence: moderate
 135  type: pattern
 136  values:
 137    - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
 138    - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
 139  filter_type:
 140    - ValueAllowlistCheck
 141    - ValuePatternCheck(4)
 142  min_line_len: 10
 143  required_substrings:
 144    - pass
 145    - sword
 146    - p/w
 147    - pw
 148    - 비밀번호
 149    - 비번
 150    - 패스워드
 151    - 암호
 152  target:
 153    - doc
 154
 155- name: ID_PASSWD_PAIR
 156  severity: medium
 157  confidence: moderate
 158  type: pattern
 159  values:
 160    - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
 161  filter_type:
 162    - ValueAllowlistCheck
 163    - ValuePatternCheck(4)
 164    - ValueDictionaryKeywordCheck
 165  min_line_len: 10
 166  required_substrings:
 167    - pw
 168    - pass
 169    - sword
 170    - 비밀번호
 171    - 비번
 172    - 패스워드
 173    - 암호
 174  target:
 175    - doc
 176
 177- name: UUID
 178  severity: info
 179  confidence: strong
 180  type: pattern
 181  values:
 182    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
 183  min_line_len: 36
 184  required_substrings:
 185    - "-"
 186  filter_type:
 187    - ValuePatternCheck(4)
 188  use_ml: false
 189  target:
 190    - code
 191    - doc
 192
 193- name: Akamai Credentials
 194  severity: high
 195  confidence: strong
 196  type: pattern
 197  values:
 198    - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
 199  filter_type: GeneralPattern
 200  required_substrings:
 201    - akab-
 202  min_line_len: 38
 203  target:
 204    - code
 205    - doc
 206
 207- name: AWS Client ID
 208  severity: high
 209  confidence: moderate
 210  type: pattern
 211  values:
 212    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
 213  filter_type: GeneralPattern
 214  required_substrings:
 215    - ABIA
 216    - ACCA
 217    - AGPA
 218    - AIDA
 219    - AIPA
 220    - AKIA
 221    - ANPA
 222    - ANVA
 223    - AROA
 224    - APKA
 225    - ASCA
 226    - ASIA
 227  min_line_len: 20
 228  required_regex: "[0-9A-Za-z_/+-]{15}"
 229  target:
 230    - code
 231    - doc
 232
 233- name: AWS Multi
 234  severity: high
 235  confidence: moderate
 236  type: multi
 237  values:
 238    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
 239    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
 240  filter_type:
 241    - LineSpecificKeyCheck
 242    - ValuePatternCheck
 243    - ValueBase64PartCheck
 244    - ValueMorphemesCheck
 245  required_substrings:
 246    - AKIA
 247    - ASIA
 248  min_line_len: 20
 249  required_regex: "[0-9A-Za-z_/+-]{15}"
 250  target:
 251    - code
 252    - doc
 253
 254- name: AWS MWS Key
 255  severity: high
 256  confidence: strong
 257  type: pattern
 258  values:
 259    - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
 260  filter_type: GeneralPattern
 261  required_substrings:
 262    - amzn.mws.
 263  min_line_len: 30
 264  target:
 265    - code
 266    - doc
 267
 268- name: Dynatrace API Token
 269  severity: high
 270  confidence: moderate
 271  type: pattern
 272  values:
 273    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
 274  filter_type: TokenPattern
 275  required_substrings:
 276    - dt0
 277  min_line_len: 90
 278  target:
 279    - code
 280    - doc
 281
 282- name: Facebook Access Token
 283  severity: high
 284  confidence: moderate
 285  type: pattern
 286  values:
 287    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
 288  filter_type:
 289    - ValuePatternCheck
 290    - ValueBase64PartCheck
 291  required_substrings:
 292    - EAA
 293  min_line_len: 80
 294  target:
 295    - code
 296    - doc
 297
 298- name: Facebook App Token
 299  severity: high
 300  confidence: moderate
 301  type: pattern
 302  values:
 303    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
 304  filter_type: TokenPattern
 305  required_substrings:
 306    - "|"
 307  required_regex: "[0-9A-Za-z_/+-]{15}"
 308  min_line_len: 33
 309  target:
 310    - code
 311    - doc
 312
 313- name: Google API Key
 314  severity: high
 315  confidence: moderate
 316  type: pattern
 317  values:
 318    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
 319  filter_type: TokenPattern
 320  required_substrings:
 321    - AIza
 322  min_line_len: 39
 323  target:
 324    - code
 325    - doc
 326
 327- name: Google Multi
 328  severity: high
 329  confidence: moderate
 330  type: multi
 331  values:
 332    - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
 333    - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
 334  filter_type: GeneralPattern
 335  required_substrings:
 336    - .apps.googleusercontent.com
 337  min_line_len: 40
 338  target:
 339    - code
 340    - doc
 341
 342- name: Google OAuth Secret
 343  severity: high
 344  confidence: strong
 345  type: pattern
 346  values:
 347    - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
 348  filter_type: TokenPattern
 349  required_substrings:
 350    - GOCSPX-
 351  min_line_len: 40
 352  target:
 353    - code
 354    - doc
 355
 356- name: Google OAuth Access Token
 357  severity: high
 358  confidence: moderate
 359  type: pattern
 360  values:
 361    - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
 362  filter_type: TokenPattern
 363  required_substrings:
 364    - ya29.
 365  min_line_len: 27
 366  target:
 367    - code
 368    - doc
 369
 370- name: Google OAuth Refresh Token
 371  severity: medium
 372  confidence: weak
 373  type: pattern
 374  values:
 375    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
 376  filter_type: TokenPattern
 377  required_substrings:
 378    - 1//0
 379  min_line_len: 84
 380  target:
 381    - code
 382    - doc
 383
 384- name: Heroku Credentials
 385  severity: high
 386  confidence: strong
 387  type: pattern
 388  values:
 389    - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
 390  filter_type: TokenPattern
 391  required_substrings:
 392    - HRKU-
 393  min_line_len: 41
 394  target:
 395    - code
 396    - doc
 397
 398- name: Instagram Access Token
 399  severity: high
 400  confidence: strong
 401  type: pattern
 402  values:
 403    - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
 404  filter_type: TokenPattern
 405  required_substrings:
 406    - IGQVJ
 407  min_line_len: 105
 408  target:
 409    - code
 410    - doc
 411
 412- name: JSON Web Token
 413  severity: medium
 414  confidence: strong
 415  type: pattern
 416  values:
 417    - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
 418  filter_type:
 419    - ValueJsonWebTokenCheck
 420  required_substrings:
 421    - eyJ
 422  min_line_len: 64
 423  target:
 424    - code
 425    - doc
 426
 427- name: JSON Web Key
 428  severity: medium
 429  confidence: strong
 430  type: pattern
 431  values:
 432    - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
 433  filter_type:
 434    - ValueJsonWebKeyCheck
 435  required_substrings:
 436    - eyJ
 437    - eyAi
 438    - ewoi
 439    - ewog
 440    - ew0K
 441    - WyJ
 442    - W3si
 443    - Wwp7
 444    - Wwog
 445    - Ww0K
 446    - W3sK
 447  min_line_len: 64
 448  target:
 449    - code
 450    - doc
 451
 452- name: JWK
 453  severity: medium
 454  confidence: moderate
 455  type: multi
 456  values:
 457    - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
 458    - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
 459  filter_type:
 460    - ValuePatternCheck
 461    - ValueMorphemesCheck
 462  required_substrings:
 463    - kty
 464  min_line_len: 8
 465  target:
 466    - code
 467    - doc
 468
 469- name: MailChimp API Key
 470  severity: high
 471  confidence: moderate
 472  type: pattern
 473  values:
 474    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
 475  filter_type: TokenPattern
 476  required_substrings:
 477    - -us
 478  min_line_len: 35
 479  target:
 480    - code
 481    - doc
 482
 483- name: MailGun API Key
 484  severity: high
 485  confidence: moderate
 486  type: pattern
 487  values:
 488    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
 489  filter_type: TokenPattern
 490  required_regex: "[0-9A-Za-z_/+-]{15}"
 491  min_line_len: 36
 492  target:
 493    - code
 494    - doc
 495
 496- name: PayPal Braintree Access Token
 497  severity: high
 498  confidence: strong
 499  type: pattern
 500  values:
 501    - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
 502  filter_type: GeneralPattern
 503  required_substrings:
 504    - access_token$production$
 505  min_line_len: 72
 506  target:
 507    - code
 508    - doc
 509
 510- name: PEM Private Key
 511  severity: high
 512  confidence: strong
 513  type: pem_key
 514  values:
 515    - (?P<value>-----BEGIN\s(?!ENCRYPTED)[^-]{0,80}PRIVATE[^-]{0,80}KEY[^-]{0,40}-----(.+-----END[^-]{1,80}KEY[^-]{0,40}-----)?)
 516  min_line_len: 27
 517  target:
 518    - code
 519    - doc
 520
 521- name: BASE64 encoded PEM Private Key
 522  severity: high
 523  confidence: strong
 524  type: pattern
 525  values:
 526    - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
 527  filter_type:
 528    - ValueBase64EncodedPem
 529  min_line_len: 300
 530  required_substrings:
 531    - UFJJVkFURSBLRVkt
 532    - QUklWQVRFIEtFWS0t
 533    - FBSSVZBVEUgS0VZ
 534  target:
 535    - code
 536    - doc
 537
 538- name: BASE64 Private Key
 539  severity: high
 540  confidence: strong
 541  type: pattern
 542  values:
 543    - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
 544  filter_type:
 545    - ValueBase64KeyCheck
 546  min_line_len: 160
 547  required_substrings:
 548    - MII
 549  target:
 550    - code
 551    - doc
 552
 553- name: Picatic API Key
 554  severity: high
 555  confidence: strong
 556  type: pattern
 557  values:
 558    - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
 559  filter_type: GeneralPattern
 560  required_substrings:
 561    - sk_live_
 562  min_line_len: 40
 563  target:
 564    - code
 565    - doc
 566
 567- name: SendGrid API Key
 568  severity: high
 569  confidence: moderate
 570  type: pattern
 571  values:
 572    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
 573  filter_type: TokenPattern
 574  required_substrings:
 575    - SG.
 576  min_line_len: 34
 577  target:
 578    - code
 579    - doc
 580
 581- name: Shopify Token
 582  severity: high
 583  confidence: strong
 584  type: pattern
 585  values:
 586    - (?P<value>shp(at|ca|pa|ss)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
 587  filter_type: TokenPattern
 588  required_substrings:
 589    - shp
 590  min_line_len: 38
 591  target:
 592    - code
 593    - doc
 594
 595- name: Slack Token
 596  severity: high
 597  confidence: strong
 598  type: pattern
 599  values:
 600    - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
 601  filter_type: TokenPattern
 602  required_substrings:
 603    - xox
 604    - xapp
 605  min_line_len: 15
 606  target:
 607    - code
 608    - doc
 609
 610- name: Slack Webhook
 611  severity: medium
 612  confidence: strong
 613  type: pattern
 614  values:
 615    - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
 616  filter_type: GeneralPattern
 617  required_substrings:
 618    - hooks.slack.com/services/T
 619  min_line_len: 61
 620  target:
 621    - code
 622    - doc
 623
 624- name: Stripe Credentials
 625  severity: high
 626  confidence: strong
 627  type: pattern
 628  values:
 629    - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
 630  filter_type: GeneralPattern
 631  required_substrings:
 632    - k_live_
 633    - k_test_
 634    - whsec_
 635  min_line_len: 32
 636  target:
 637    - code
 638    - doc
 639
 640- name: Square Access Token
 641  severity: high
 642  confidence: moderate
 643  type: pattern
 644  values:
 645    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
 646  filter_type:
 647    - ValuePatternCheck
 648    - ValueBase64PartCheck
 649  required_substrings:
 650    - EAAA
 651  min_line_len: 64
 652  target:
 653    - code
 654    - doc
 655
 656- name: Square Credentials
 657  severity: medium
 658  confidence: strong
 659  type: pattern
 660  values:
 661    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
 662  filter_type: TokenPattern
 663  required_substrings:
 664    - sq0
 665  min_line_len: 29
 666  target:
 667    - code
 668    - doc
 669
 670- name: Twilio Credentials
 671  severity: high
 672  confidence: moderate
 673  type: pattern
 674  values:
 675    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
 676  filter_type: TokenPattern
 677  required_substrings:
 678    - AC
 679    - AD
 680    - AL
 681    - CA
 682    - CF
 683    - CL
 684    - CN
 685    - CR
 686    - FW
 687    - IP
 688    - KS
 689    - MM
 690    - "NO"
 691    - PK
 692    - PN
 693    - QU
 694    - RE
 695    - SC
 696    - SD
 697    - SK
 698    - SM
 699    - TR
 700    - UT
 701    - XE
 702    - XR
 703  min_line_len: 34
 704  target:
 705    - code
 706    - doc
 707
 708- name: Telegram Bot API Token
 709  severity: high
 710  confidence: moderate
 711  type: pattern
 712  values:
 713    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
 714  filter_type: TokenPattern
 715  required_substrings:
 716    - :AA
 717  min_line_len: 45
 718  target:
 719    - code
 720    - doc
 721
 722- name: PyPi API Token
 723  severity: high
 724  confidence: strong
 725  type: pattern
 726  values:
 727    - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
 728  filter_type: TokenPattern
 729  required_substrings:
 730    - pypi-
 731  min_line_len: 155
 732  target:
 733    - code
 734    - doc
 735
 736- name: NPM Token
 737  severity: high
 738  confidence: strong
 739  type: pattern
 740  values:
 741    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
 742  filter_type:
 743    - ValueGitHubCheck
 744  required_substrings:
 745    - npm_
 746  min_line_len: 40
 747  target:
 748    - code
 749    - doc
 750
 751- name: Github Classic Token
 752  severity: high
 753  confidence: strong
 754  type: pattern
 755  values:
 756    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
 757  filter_type:
 758    - ValueGitHubCheck
 759  required_substrings:
 760    - ghp_
 761    - gho_
 762    - ghu_
 763    - ghs_
 764    - ghr_
 765  min_line_len: 40
 766  target:
 767    - code
 768    - doc
 769
 770- name: Github Fine-granted Token
 771  severity: high
 772  confidence: strong
 773  type: pattern
 774  values:
 775    - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
 776  filter_type: GeneralPattern
 777  required_substrings:
 778    - github_pat_
 779  min_line_len: 90
 780  target:
 781    - code
 782    - doc
 783
 784- name: Firebase Domain
 785  severity: info
 786  confidence: moderate
 787  type: pattern
 788  values:
 789    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
 790  filter_type: GeneralPattern
 791  required_substrings:
 792    - .firebase
 793  min_line_len: 16
 794  target:
 795    - code
 796    - doc
 797
 798- name: AWS S3 Bucket
 799  severity: info
 800  confidence: moderate
 801  type: pattern
 802  values:
 803    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
 804  filter_type: GeneralPattern
 805  required_substrings:
 806    - .s3-website
 807    - .s3.amazonaws.com
 808  min_line_len: 14
 809  target:
 810    - code
 811    - doc
 812
 813- name: Jfrog Token
 814  severity: high
 815  confidence: strong
 816  type: pattern
 817  values:
 818    - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
 819  filter_type:
 820    - ValueJfrogTokenCheck
 821  required_substrings:
 822    - cmVmdGtuO
 823    - AKCp
 824  min_line_len: 64
 825  target:
 826    - code
 827    - doc
 828
 829- name: Azure Access Token
 830  severity: high
 831  confidence: strong
 832  type: pattern
 833  values:
 834    - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
 835  filter_type:
 836    - ValueAzureTokenCheck
 837  required_substrings:
 838    - eyJ
 839  min_line_len: 148
 840  target:
 841    - code
 842    - doc
 843
 844- name: Azure Secret Value
 845  severity: high
 846  confidence: moderate
 847  type: pattern
 848  values:
 849    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
 850  filter_type: TokenPattern
 851  min_line_len: 40
 852  required_substrings:
 853    - 8Q~
 854  target:
 855    - code
 856    - doc
 857
 858- name: Azure Storage Account Key
 859  severity: high
 860  confidence: moderate
 861  type: pattern
 862  values:
 863    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
 864  min_line_len: 80
 865  filter_type:
 866    - ValuePatternCheck(17)
 867  required_substrings:
 868    - JQQJ99
 869    - JQQJ9D
 870    - JQQJ9H
 871  target:
 872    - code
 873    - doc
 874
 875- name: Bitbucket App Password
 876  severity: high
 877  confidence: strong
 878  type: pattern
 879  values:
 880    - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
 881  filter_type:
 882    - ValueAtlassianTokenCheck
 883  min_line_len: 28
 884  required_substrings:
 885    - ATBB
 886  target:
 887    - code
 888    - doc
 889
 890- name: Bitbucket Repository Access Token
 891  severity: high
 892  confidence: strong
 893  type: pattern
 894  values:
 895    - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
 896  filter_type:
 897    - ValueAtlassianTokenCheck
 898  min_line_len: 160
 899  required_substrings:
 900    - ATCTT3xFfGN0
 901  target:
 902    - code
 903    - doc
 904
 905- name: Bitbucket HTTP Access Token
 906  severity: high
 907  confidence: strong
 908  type: pattern
 909  values:
 910    - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
 911  filter_type:
 912    - ValueAtlassianTokenCheck
 913  min_line_len: 49
 914  required_substrings:
 915    - BBDC-
 916  target:
 917    - code
 918    - doc
 919
 920- name: Jira / Confluence PAT token
 921  severity: high
 922  confidence: strong
 923  type: pattern
 924  values:
 925    - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
 926  filter_type:
 927    - ValueAtlassianTokenCheck
 928  min_line_len: 44
 929  required_substrings:
 930    - M
 931    - N
 932    - O
 933  required_regex: "[0-9A-Za-z_/+-]{15}"
 934  target:
 935    - code
 936    - doc
 937
 938- name: Atlassian PAT token
 939  severity: high
 940  confidence: strong
 941  type: pattern
 942  values:
 943    - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
 944  filter_type:
 945    - ValueAtlassianTokenCheck
 946  min_line_len: 160
 947  required_substrings:
 948    - ATATT3xFfGF0
 949  target:
 950    - code
 951    - doc
 952
 953- name: Digital Ocean Token
 954  severity: high
 955  confidence: strong
 956  type: pattern
 957  values:
 958    - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
 959  filter_type: TokenPattern
 960  min_line_len: 71
 961  required_substrings:
 962    - doo_v1_
 963    - dop_v1_
 964    - dor_v1_
 965  target:
 966    - code
 967    - doc
 968
 969- name: Dropbox OAuth2 API Access Token
 970  severity: high
 971  confidence: moderate
 972  type: pattern
 973  values:
 974    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
 975  filter_type: TokenPattern
 976  min_line_len: 138
 977  required_substrings:
 978    - sl.
 979  target:
 980    - code
 981    - doc
 982
 983- name: NuGet API key
 984  severity: high
 985  confidence: moderate
 986  type: pattern
 987  values:
 988    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
 989  filter_type: TokenPattern
 990  min_line_len: 46
 991  required_substrings:
 992    - oy2
 993  target:
 994    - code
 995    - doc
 996
 997- name: Gitlab Prefix Token
 998  severity: high
 999  confidence: strong
1000  type: pattern
1001  values:
1002    - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1003  filter_type:
1004    - ValuePatternCheck
1005  min_line_len: 25
1006  required_substrings:
1007    - _gitlab_session=
1008    - GR1348941
1009    - glagent-
1010    - glsoat-
1011    - glffct-
1012    - glpat-
1013    - gloas-
1014    - glptt-
1015    - glcbt-
1016    - glimt-
1017    - gldt-
1018    - glft-
1019    - glrt-
1020  target:
1021    - code
1022    - doc
1023
1024- name: Grafana Provisioned API Key
1025  severity: high
1026  confidence: strong
1027  type: pattern
1028  values:
1029    - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1030  filter_type:
1031    - ValueGrafanaCheck
1032  min_line_len: 67
1033  required_substrings:
1034    - eyJ
1035  target:
1036    - code
1037    - doc
1038
1039- name: Grafana Access Policy Token
1040  severity: high
1041  confidence: strong
1042  type: pattern
1043  values:
1044    - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1045  filter_type:
1046    - ValueGrafanaCheck
1047  min_line_len: 87
1048  required_substrings:
1049    - glc_eyJ
1050  target:
1051    - code
1052    - doc
1053
1054- name: Grafana Service Account Token
1055  severity: high
1056  confidence: strong
1057  type: pattern
1058  values:
1059    - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1060  min_line_len: 46
1061  filter_type:
1062    - ValueGrafanaServiceCheck
1063  required_substrings:
1064    - glsa_
1065  target:
1066    - code
1067    - doc
1068
1069- name: Dropbox API secret (long term)
1070  severity: high
1071  confidence: weak
1072  type: pattern
1073  values:
1074    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1075  filter_type: [ ]
1076  min_line_len: 43
1077  required_substrings:
1078    - AAAAAAAAAA
1079  target:
1080    - code
1081    - doc
1082
1083- name: Dropbox App secret
1084  severity: info
1085  confidence: weak
1086  type: pattern
1087  values:
1088    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1089  filter_type: WeirdBase36Token
1090  min_line_len: 15
1091  required_regex: "[0-9A-Za-z_/+-]{15}"
1092  target:
1093    - code
1094    - doc
1095
1096- name: Hashicorp Vault Token
1097  severity: high
1098  confidence: strong
1099  type: pattern
1100  values:
1101    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1102  filter_type:
1103    - ValuePatternCheck
1104    - ValueEntropyBase64Check
1105  min_line_len: 90
1106  required_substrings:
1107    - hvb.
1108    - hvr.
1109    - hvs.
1110  target:
1111    - code
1112    - doc
1113
1114- name: Hashicorp Terraform Token
1115  severity: high
1116  confidence: strong
1117  type: pattern
1118  values:
1119    - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1120  filter_type:
1121    - ValuePatternCheck
1122    - ValueMorphemesCheck
1123  min_line_len: 90
1124  required_substrings:
1125    - .atlasv1.
1126  target:
1127    - code
1128    - doc
1129
1130- name: NKEY Seed
1131  severity: high
1132  confidence: weak
1133  type: pattern
1134  values:
1135    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1136  min_line_len: 42
1137  filter_type:
1138    - ValueMorphemesCheck
1139    - ValuePatternCheck
1140    - ValueEntropyBase32Check
1141    - ValueBase32DataCheck
1142    - ValueTokenBase32Check
1143  required_substrings:
1144    - SA
1145    - SC
1146    - SN
1147    - SO
1148    - SP
1149    - SU
1150    - SX
1151  required_regex: "[0-9A-Za-z_/+-]{15}"
1152  target:
1153    - code
1154    - doc
1155
1156- name: OTP / 2FA Secret
1157  severity: info
1158  confidence: weak
1159  type: pattern
1160  values:
1161    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1162  filter_type:
1163    - ValueMorphemesCheck
1164    - ValuePatternCheck
1165    - ValueEntropyBase32Check
1166    - ValueBase32DataCheck
1167    - ValueTokenBase32Check
1168    - ValueBase64PartCheck
1169  min_line_len: 16
1170  required_regex: "[0-9A-Za-z_/+-]{15}"
1171  target:
1172    - code
1173    - doc
1174
1175- name: OpenAI Token
1176  severity: high
1177  confidence: strong
1178  type: pattern
1179  values:
1180    - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1181  min_line_len: 51
1182  filter_type:
1183    - ValuePatternCheck
1184    - ValueMorphemesCheck
1185  required_substrings:
1186    - T3BlbkFJ
1187    - 9wZW5BS
1188    - PcGVuQU
1189  target:
1190    - code
1191    - doc
1192
1193- name: Docker Access Token
1194  severity: high
1195  confidence: strong
1196  type: pattern
1197  values:
1198    - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1199  min_line_len: 36
1200  filter_type:
1201    - ValuePatternCheck
1202    - ValueMorphemesCheck
1203  required_substrings:
1204    - dckr_pat_
1205    - dckr_oat_
1206  target:
1207    - code
1208    - doc
1209
1210- name: Docker Swarm Token
1211  severity: high
1212  confidence: strong
1213  type: pattern
1214  values:
1215    - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1216  min_line_len: 85
1217  filter_type:
1218    - ValuePatternCheck
1219    - ValueMorphemesCheck
1220  required_substrings:
1221    - SWMTKN-1-
1222  target:
1223    - code
1224    - doc
1225
1226- name: Docker Swarm Key
1227  severity: high
1228  confidence: strong
1229  type: pattern
1230  values:
1231    - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1232  min_line_len: 52
1233  filter_type:
1234    - ValuePatternCheck
1235    - ValueMorphemesCheck
1236  required_substrings:
1237    - SWMKEY-1-
1238  target:
1239    - code
1240    - doc
1241
1242- name: Groq API Key
1243  severity: high
1244  confidence: strong
1245  type: pattern
1246  values:
1247    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1248  min_line_len: 56
1249  filter_type:
1250    - ValuePatternCheck
1251  required_substrings:
1252    - WGdyb3FY
1253    - hncm9xW
1254    - YZ3JvcV
1255  target:
1256    - code
1257    - doc
1258
1259- name: X AI API Key
1260  severity: high
1261  confidence: moderate
1262  type: pattern
1263  values:
1264    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1265  min_line_len: 84
1266  filter_type:
1267    - ValuePatternCheck
1268    - ValueEntropyBase64Check
1269  required_substrings:
1270    - xai-
1271  target:
1272    - code
1273    - doc
1274
1275- name: Notion Integration Token
1276  severity: high
1277  confidence: strong
1278  type: pattern
1279  values:
1280    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1281  filter_type:
1282    - ValuePatternCheck
1283    - ValueEntropyBase64Check
1284  required_substrings:
1285    - ntn_
1286  min_line_len: 50
1287  target:
1288    - code
1289    - doc
1290
1291- name: Hugging Face User Access Token
1292  severity: high
1293  confidence: moderate
1294  type: pattern
1295  values:
1296    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1297  min_line_len: 37
1298  filter_type:
1299    - ValuePatternCheck
1300    - ValueEntropyBase64Check
1301  required_substrings:
1302    - hf_
1303  target:
1304    - code
1305    - doc
1306
1307- name: Anthropic API Key
1308  severity: high
1309  confidence: strong
1310  type: pattern
1311  values:
1312    - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1313  min_line_len: 77
1314  filter_type:
1315    - ValuePatternCheck
1316  required_substrings:
1317    - sk-ant-api03-
1318  target:
1319    - code
1320    - doc
1321
1322- name: Perplexity API Key
1323  severity: high
1324  confidence: strong
1325  type: pattern
1326  values:
1327    - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1328  min_line_len: 45
1329  filter_type:
1330    - ValuePatternCheck
1331  required_substrings:
1332    - pplx-
1333  target:
1334    - code
1335    - doc
1336
1337- name: Tavily API Key
1338  severity: high
1339  confidence: strong
1340  type: pattern
1341  values:
1342    - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1343  min_line_len: 37
1344  filter_type:
1345    - ValuePatternCheck
1346  required_substrings:
1347    - tvly-
1348  target:
1349    - code
1350    - doc
1351
1352- name: Sentry Organization Auth Token
1353  severity: high
1354  confidence: strong
1355  type: pattern
1356  values:
1357    - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1358  min_line_len: 37
1359  filter_type:
1360    - ValuePatternCheck
1361  required_substrings:
1362    - sntrys_eyJ
1363  target:
1364    - code
1365    - doc
1366
1367- name: Sentry User Auth Token
1368  severity: high
1369  confidence: strong
1370  type: pattern
1371  values:
1372    - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1373  min_line_len: 37
1374  filter_type:
1375    - ValuePatternCheck
1376  required_substrings:
1377    - sntryu_
1378  target:
1379    - code
1380    - doc
1381
1382- name: Discord Bot Token
1383  severity: high
1384  confidence: strong
1385  type: pattern
1386  values:
1387    - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1388  min_line_len: 62
1389  filter_type:
1390    - ValueDiscordBotCheck
1391  required_substrings:
1392    - M
1393    - N
1394    - O
1395  required_regex: "[0-9A-Za-z_/+-]{15}"
1396  target:
1397    - code
1398    - doc
1399
1400- name: Discord Webhook
1401  severity: medium
1402  confidence: strong
1403  type: pattern
1404  values:
1405    - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1406  filter_type:
1407    - ValueMorphemesCheck
1408  required_substrings:
1409    - discordapp.com/api/webhooks
1410    - discord.com/api/webhooks
1411  min_line_len: 61
1412  target:
1413    - code
1414    - doc
1415
1416- name: Tencent WeChat API App ID
1417  severity: medium
1418  confidence: weak
1419  type: pattern
1420  values:
1421    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1422  min_line_len: 18
1423  filter_type: TokenPattern
1424  required_substrings:
1425    - wx
1426  target:
1427    - code
1428    - doc
1429
1430- name: Salesforce Credentials
1431  severity: medium
1432  confidence: weak
1433  type: pattern
1434  values:
1435    - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1436  min_line_len: 12
1437  filter_type:
1438    - ValuePatternCheck(9)
1439    - ValueNumberCheck
1440    - ValueBase64PartCheck
1441  required_substrings:
1442    - 00D
1443    - 3MVG
1444  target:
1445    - code
1446    - doc
1447
1448- name: Postman Credentials
1449  severity: medium
1450  confidence: moderate
1451  type: pattern
1452  values:
1453    - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1454  min_line_len: 29
1455  filter_type:
1456    - ValuePatternCheck
1457  required_substrings:
1458    - PMAK-
1459    - PMAT-
1460  target:
1461    - code
1462    - doc
1463
1464- name: NTLM Token
1465  severity: medium
1466  confidence: strong
1467  type: pattern
1468  values:
1469    - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1470  filter_type:
1471    - ValueMorphemesCheck(2)
1472    - ValuePatternCheck
1473  min_line_len: 160
1474  required_substrings:
1475    - TlRMTVNTUAADAAAA
1476  target:
1477    - doc
1478    - code
1479
1480- name: Basic Authorization
1481  severity: medium
1482  confidence: strong
1483  type: pattern
1484  values:
1485    - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1486  min_line_len: 18
1487  filter_type:
1488    - ValueBasicAuthCheck
1489  required_substrings:
1490    - basic
1491  target:
1492    - code
1493    - doc
1494
1495- name: Bearer Authorization
1496  severity: medium
1497  confidence: moderate
1498  type: pattern
1499  values:
1500    - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1501  min_line_len: 37
1502  filter_type: GeneralKeyword
1503  required_substrings:
1504    - bearer
1505    - ntlm
1506  target:
1507    - code
1508    - doc
1509
1510- name: SQL Password
1511  severity: medium
1512  confidence: weak
1513  type: pattern
1514  values:
1515    - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}([^\s;]{1,80}\s{1,8}|VALUES\s*\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s*PASSWORD\b(\s*=)?)))\s*(?P<wrap>[(]\s*)?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\+([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1516  filter_type:
1517    - ValueAllowlistCheck
1518    - ValuePatternCheck
1519  use_ml: true
1520  min_line_len: 8
1521  required_substrings:
1522    - password
1523    - identified
1524  target:
1525    - doc
1526    - code
1527
1528- name: CURL User Password
1529  severity: high
1530  confidence: moderate
1531  type: pattern
1532  values:
1533    - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1534  filter_type: GeneralKeyword
1535  use_ml: true
1536  required_substrings:
1537    - curl
1538  min_line_len: 16
1539  target:
1540    - code
1541
1542- name: CMD ConvertTo-SecureString
1543  severity: high
1544  confidence: moderate
1545  type: pattern
1546  values:
1547    - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1548  filter_type: GeneralKeyword
1549  use_ml: true
1550  required_substrings:
1551    - convertto-securestring
1552  min_line_len: 27
1553  target:
1554    - code
1555
1556- name: CMD Password
1557  severity: high
1558  confidence: moderate
1559  type: pattern
1560  values:
1561    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1562  filter_type: GeneralKeyword
1563  use_ml: true
1564  required_substrings:
1565    - pass
1566  min_line_len: 12
1567  target:
1568    - code
1569
1570- name: CMD Token
1571  severity: high
1572  confidence: moderate
1573  type: pattern
1574  values:
1575    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1576  filter_type: GeneralKeyword
1577  use_ml: true
1578  required_substrings:
1579    - token
1580    - oauth2-bearer
1581  min_line_len: 12
1582  target:
1583    - code
1584
1585- name: CMD Secret
1586  severity: high
1587  confidence: moderate
1588  type: pattern
1589  values:
1590    - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1591  filter_type: GeneralKeyword
1592  use_ml: true
1593  required_substrings:
1594    - secret
1595  min_line_len: 12
1596  target:
1597    - code
1598
1599- name: URL Credentials
1600  severity: high
1601  confidence: moderate
1602  type: pattern
1603  values:
1604    - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
1605  filter_type: UrlCredentialsGroup
1606  use_ml: true
1607  required_substrings:
1608    - ://
1609  min_line_len: 10
1610  target:
1611    - code
1612
1613- name: API
1614  severity: low
1615  confidence: moderate
1616  type: keyword
1617  values:
1618    - api(?!tal)
1619  filter_type: GeneralKeyword
1620  use_ml: true
1621  min_line_len: 11
1622  required_substrings:
1623    - api
1624  target:
1625    - code
1626
1627- name: Auth
1628  severity: medium
1629  confidence: moderate
1630  type: keyword
1631  values:
1632    - auth(?!ors?(?!i[tz]))
1633  filter_type: GeneralKeyword
1634  use_ml: true
1635  min_line_len: 12
1636  required_substrings:
1637    - auth
1638  target:
1639    - code
1640
1641- name: Credential
1642  severity: medium
1643  confidence: moderate
1644  type: keyword
1645  values:
1646    - credential
1647  filter_type: GeneralKeyword
1648  use_ml: true
1649  min_line_len: 18
1650  required_substrings:
1651    - credential
1652  target:
1653    - code
1654
1655- name: Key
1656  severity: high
1657  confidence: moderate
1658  type: keyword
1659  values:
1660    - key(?!word|board|pad|name)
1661  filter_type: GeneralKeyword
1662  use_ml: true
1663  min_line_len: 11
1664  required_substrings:
1665    - key
1666  target:
1667    - code
1668
1669- name: Nonce
1670  severity: low
1671  confidence: moderate
1672  type: keyword
1673  values:
1674    - (?<!\\)nonce
1675  filter_type: GeneralKeyword
1676  use_ml: true
1677  min_line_len: 13
1678  required_substrings:
1679    - nonce
1680  target:
1681    - code
1682
1683- name: Password
1684  severity: high
1685  confidence: moderate
1686  type: keyword
1687  values:
1688    - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|pw(d|\b)
1689  filter_type: PasswordKeyword
1690  use_ml: true
1691  min_line_len: 10
1692  required_substrings:
1693    - pass
1694    - pw
1695  target:
1696    - code
1697
1698- name: Salt
1699  severity: low
1700  confidence: moderate
1701  type: keyword
1702  values:
1703    - salt
1704  filter_type: GeneralKeyword
1705  use_ml: true
1706  min_line_len: 12
1707  required_substrings:
1708    - salt
1709  target:
1710    - code
1711
1712- name: Secret
1713  severity: medium
1714  confidence: moderate
1715  type: keyword
1716  values:
1717    - secret
1718  filter_type: GeneralKeyword
1719  use_ml: true
1720  min_line_len: 14
1721  required_substrings:
1722    - secret
1723  target:
1724    - code
1725
1726- name: Token
1727  severity: high
1728  confidence: moderate
1729  type: keyword
1730  values:
1731    - token(?!ize)
1732  filter_type: GeneralKeyword
1733  use_ml: true
1734  min_line_len: 13
1735  required_substrings:
1736    - token
1737  target:
1738    - code