1- name: DOC_GET
2 severity: medium
3 confidence: weak
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*,\s*(default\s*=\s*)?([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - LineGitBinaryCheck
10 - LineUUEPartCheck
11 - ValueFilePathCheck
12 - ValuePatternCheck(5)
13 - ValueLengthCheck(4,80)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pw
18 - token
19 - secret
20 - key
21 - cred
22 - 비밀번호
23 - 비번
24 - 패스워드
25 - 암호
26 - 키
27 - 토큰
28 target:
29 - doc
30 use_ml: true
31
32- name: DOC_CREDENTIALS
33 severity: medium
34 confidence: weak
35 type: pattern
36 values:
37 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,80}|[^\"'`]{4,80})|(?(wrap)[^\"'`)]{4,80}|\S{4,80})))
38 filter_type:
39 - ValueAllowlistCheck
40 - LineGitBinaryCheck
41 - LineUUEPartCheck
42 - ValueFilePathCheck
43 - ValuePatternCheck(5)
44 - ValueLengthCheck(4,80)
45 min_line_len: 8
46 required_substrings:
47 - pass
48 - sword
49 - pw
50 - p/w
51 - paasw
52 - 비밀번호
53 - 비번
54 - 패스워드
55 - 암호
56 - token
57 - secret
58 - key
59 - credential
60 - 키
61 - 토큰
62 target:
63 - doc
64 use_ml: true
65
66- name: SECRET_PAIR
67 severity: medium
68 confidence: moderate
69 type: pattern
70 values:
71 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
72 filter_type:
73 - ValueAllowlistCheck
74 - ValuePatternCheck(4)
75 - ValueEntropyBase64Check
76 - ValueMorphemesCheck
77 min_line_len: 16
78 required_substrings:
79 - token
80 - secret
81 - key
82 - 키
83 - 암호
84 - 토큰
85 target:
86 - doc
87
88- name: PASSWD_PAIR
89 severity: medium
90 confidence: moderate
91 type: pattern
92 values:
93 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*[=:](\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
94 filter_type:
95 - ValueAllowlistCheck
96 - ValuePatternCheck(4)
97 - ValueDictionaryKeywordCheck
98 - LineGitBinaryCheck
99 - LineUUEPartCheck
100 - ValueFilePathCheck
101 - ValueHexNumberCheck
102 min_line_len: 10
103 required_substrings:
104 - pass
105 - sword
106 - pw
107 - p/w
108 - paasw
109 - 비밀번호
110 - 비번
111 - 패스워드
112 - 암호
113 target:
114 - doc
115
116- name: IP_ID_PASSWORD_TRIPLE
117 severity: medium
118 confidence: moderate
119 type: pattern
120 values:
121 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
122 filter_type:
123 - ValueAllowlistCheck
124 - ValuePatternCheck(4)
125 - ValueDictionaryKeywordCheck
126 min_line_len: 10
127 required_substrings:
128 - "."
129 target:
130 - doc
131
132- name: ID_PAIR_PASSWD_PAIR
133 severity: medium
134 confidence: moderate
135 type: pattern
136 values:
137 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
138 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
139 filter_type:
140 - ValueAllowlistCheck
141 - ValuePatternCheck(4)
142 min_line_len: 10
143 required_substrings:
144 - pass
145 - sword
146 - p/w
147 - pw
148 - 비밀번호
149 - 비번
150 - 패스워드
151 - 암호
152 target:
153 - doc
154
155- name: ID_PASSWD_PAIR
156 severity: medium
157 confidence: moderate
158 type: pattern
159 values:
160 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
161 filter_type:
162 - ValueAllowlistCheck
163 - ValuePatternCheck(4)
164 - ValueDictionaryKeywordCheck
165 min_line_len: 10
166 required_substrings:
167 - pw
168 - pass
169 - sword
170 - 비밀번호
171 - 비번
172 - 패스워드
173 - 암호
174 target:
175 - doc
176
177- name: UUID
178 severity: info
179 confidence: strong
180 type: pattern
181 values:
182 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
183 min_line_len: 36
184 required_substrings:
185 - "-"
186 filter_type:
187 - ValuePatternCheck(4)
188 use_ml: false
189 target:
190 - code
191 - doc
192
193- name: Akamai Credentials
194 severity: high
195 confidence: strong
196 type: pattern
197 values:
198 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
199 filter_type: GeneralPattern
200 required_substrings:
201 - akab-
202 min_line_len: 38
203 target:
204 - code
205 - doc
206
207- name: AWS Client ID
208 severity: high
209 confidence: moderate
210 type: pattern
211 values:
212 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
213 filter_type: GeneralPattern
214 required_substrings:
215 - ABIA
216 - ACCA
217 - AGPA
218 - AIDA
219 - AIPA
220 - AKIA
221 - ANPA
222 - ANVA
223 - AROA
224 - APKA
225 - ASCA
226 - ASIA
227 min_line_len: 20
228 required_regex: "[0-9A-Za-z_/+-]{15}"
229 target:
230 - code
231 - doc
232
233- name: AWS Multi
234 severity: high
235 confidence: moderate
236 type: multi
237 values:
238 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
239 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
240 filter_type:
241 - LineSpecificKeyCheck
242 - ValuePatternCheck
243 - ValueBase64PartCheck
244 - ValueMorphemesCheck
245 required_substrings:
246 - AKIA
247 - ASIA
248 min_line_len: 20
249 required_regex: "[0-9A-Za-z_/+-]{15}"
250 target:
251 - code
252 - doc
253
254- name: AWS MWS Key
255 severity: high
256 confidence: strong
257 type: pattern
258 values:
259 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
260 filter_type: GeneralPattern
261 required_substrings:
262 - amzn.mws.
263 min_line_len: 30
264 target:
265 - code
266 - doc
267
268- name: Dynatrace API Token
269 severity: high
270 confidence: moderate
271 type: pattern
272 values:
273 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
274 filter_type: TokenPattern
275 required_substrings:
276 - dt0
277 min_line_len: 90
278 target:
279 - code
280 - doc
281
282- name: Facebook Access Token
283 severity: high
284 confidence: moderate
285 type: pattern
286 values:
287 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
288 filter_type:
289 - ValuePatternCheck
290 - ValueBase64PartCheck
291 - ValueNotPartEncodedCheck
292 required_substrings:
293 - EAA
294 min_line_len: 80
295 target:
296 - code
297 - doc
298
299- name: Facebook App Token
300 severity: high
301 confidence: moderate
302 type: pattern
303 values:
304 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
305 filter_type: TokenPattern
306 required_substrings:
307 - "|"
308 required_regex: "[0-9A-Za-z_/+-]{15}"
309 min_line_len: 33
310 target:
311 - code
312 - doc
313
314- name: Google API Key
315 severity: high
316 confidence: moderate
317 type: pattern
318 values:
319 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
320 filter_type: TokenPattern
321 required_substrings:
322 - AIza
323 min_line_len: 39
324 target:
325 - code
326 - doc
327
328- name: Google Multi
329 severity: high
330 confidence: moderate
331 type: multi
332 values:
333 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
334 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
335 filter_type: GeneralPattern
336 required_substrings:
337 - .apps.googleusercontent.com
338 min_line_len: 40
339 target:
340 - code
341 - doc
342
343- name: Google OAuth Secret
344 severity: high
345 confidence: strong
346 type: pattern
347 values:
348 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
349 filter_type: TokenPattern
350 required_substrings:
351 - GOCSPX-
352 min_line_len: 40
353 target:
354 - code
355 - doc
356
357- name: Google OAuth Access Token
358 severity: high
359 confidence: moderate
360 type: pattern
361 values:
362 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
363 filter_type: TokenPattern
364 required_substrings:
365 - ya29.
366 min_line_len: 27
367 target:
368 - code
369 - doc
370
371- name: Google OAuth Refresh Token
372 severity: medium
373 confidence: weak
374 type: pattern
375 values:
376 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
377 filter_type: TokenPattern
378 required_substrings:
379 - 1//0
380 min_line_len: 84
381 target:
382 - code
383 - doc
384
385- name: Heroku Credentials
386 severity: high
387 confidence: strong
388 type: pattern
389 values:
390 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
391 filter_type: TokenPattern
392 required_substrings:
393 - HRKU-
394 min_line_len: 41
395 target:
396 - code
397 - doc
398
399- name: Instagram Access Token
400 severity: high
401 confidence: strong
402 type: pattern
403 values:
404 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
405 filter_type: TokenPattern
406 required_substrings:
407 - IGQVJ
408 min_line_len: 105
409 target:
410 - code
411 - doc
412
413- name: JSON Web Token
414 severity: medium
415 confidence: strong
416 type: pattern
417 values:
418 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
419 filter_type:
420 - ValueJsonWebTokenCheck
421 required_substrings:
422 - eyJ
423 min_line_len: 64
424 target:
425 - code
426 - doc
427
428- name: JSON Web Key
429 severity: medium
430 confidence: strong
431 type: pattern
432 values:
433 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
434 filter_type:
435 - ValueJsonWebKeyCheck
436 required_substrings:
437 - eyJ
438 - eyAi
439 - ewoi
440 - ewog
441 - ew0K
442 - WyJ
443 - W3si
444 - Wwp7
445 - Wwog
446 - Ww0K
447 - W3sK
448 min_line_len: 64
449 target:
450 - code
451 - doc
452
453- name: JWK
454 severity: medium
455 confidence: moderate
456 type: multi
457 values:
458 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
459 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
460 filter_type:
461 - ValuePatternCheck
462 - ValueMorphemesCheck
463 required_substrings:
464 - kty
465 min_line_len: 8
466 target:
467 - code
468 - doc
469
470- name: MailChimp API Key
471 severity: high
472 confidence: moderate
473 type: pattern
474 values:
475 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
476 filter_type: TokenPattern
477 required_substrings:
478 - -us
479 min_line_len: 35
480 target:
481 - code
482 - doc
483
484- name: MailGun API Key
485 severity: high
486 confidence: moderate
487 type: pattern
488 values:
489 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
490 filter_type: TokenPattern
491 required_regex: "[0-9A-Za-z_/+-]{15}"
492 min_line_len: 36
493 target:
494 - code
495 - doc
496
497- name: PayPal Braintree Access Token
498 severity: high
499 confidence: strong
500 type: pattern
501 values:
502 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
503 filter_type: GeneralPattern
504 required_substrings:
505 - access_token$production$
506 min_line_len: 72
507 target:
508 - code
509 - doc
510
511- name: PEM Private Key
512 severity: high
513 confidence: strong
514 type: pem_key
515 values:
516 - (?P<value>-----BEGIN\s(?!ENCRYPTED)[^-]{0,80}PRIVATE[^-]{0,80}KEY[^-]{0,40}-----(.+-----END[^-]{1,80}KEY[^-]{0,40}-----)?)
517 min_line_len: 27
518 target:
519 - code
520 - doc
521
522- name: BASE64 encoded PEM Private Key
523 severity: high
524 confidence: strong
525 type: pattern
526 values:
527 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
528 filter_type:
529 - ValueBase64EncodedPem
530 min_line_len: 300
531 required_substrings:
532 - UFJJVkFURSBLRVkt
533 - QUklWQVRFIEtFWS0t
534 - FBSSVZBVEUgS0VZ
535 target:
536 - code
537 - doc
538
539- name: BASE64 Private Key
540 severity: high
541 confidence: strong
542 type: pattern
543 values:
544 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
545 filter_type:
546 - ValueBase64KeyCheck
547 min_line_len: 160
548 required_substrings:
549 - MII
550 target:
551 - code
552 - doc
553
554- name: Picatic API Key
555 severity: high
556 confidence: strong
557 type: pattern
558 values:
559 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
560 filter_type: GeneralPattern
561 required_substrings:
562 - sk_live_
563 min_line_len: 40
564 target:
565 - code
566 - doc
567
568- name: SendGrid API Key
569 severity: high
570 confidence: moderate
571 type: pattern
572 values:
573 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
574 filter_type: TokenPattern
575 required_substrings:
576 - SG.
577 min_line_len: 34
578 target:
579 - code
580 - doc
581
582- name: Shopify Token
583 severity: high
584 confidence: strong
585 type: pattern
586 values:
587 - (?P<value>shp(at|ca|pa|ss)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
588 filter_type: TokenPattern
589 required_substrings:
590 - shp
591 min_line_len: 38
592 target:
593 - code
594 - doc
595
596- name: Slack Token
597 severity: high
598 confidence: strong
599 type: pattern
600 values:
601 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
602 filter_type: TokenPattern
603 required_substrings:
604 - xox
605 - xapp
606 min_line_len: 15
607 target:
608 - code
609 - doc
610
611- name: Slack Webhook
612 severity: medium
613 confidence: strong
614 type: pattern
615 values:
616 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
617 filter_type: GeneralPattern
618 required_substrings:
619 - hooks.slack.com/services/T
620 min_line_len: 61
621 target:
622 - code
623 - doc
624
625- name: Stripe Credentials
626 severity: high
627 confidence: strong
628 type: pattern
629 values:
630 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
631 filter_type: GeneralPattern
632 required_substrings:
633 - k_live_
634 - k_test_
635 - whsec_
636 min_line_len: 32
637 target:
638 - code
639 - doc
640
641- name: Square Access Token
642 severity: high
643 confidence: moderate
644 type: pattern
645 values:
646 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
647 filter_type:
648 - ValuePatternCheck
649 - ValueBase64PartCheck
650 required_substrings:
651 - EAAA
652 min_line_len: 64
653 target:
654 - code
655 - doc
656
657- name: Square Credentials
658 severity: medium
659 confidence: strong
660 type: pattern
661 values:
662 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
663 filter_type: TokenPattern
664 required_substrings:
665 - sq0
666 min_line_len: 29
667 target:
668 - code
669 - doc
670
671- name: Twilio Credentials
672 severity: high
673 confidence: moderate
674 type: pattern
675 values:
676 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
677 filter_type: TokenPattern
678 required_substrings:
679 - AC
680 - AD
681 - AL
682 - CA
683 - CF
684 - CL
685 - CN
686 - CR
687 - FW
688 - IP
689 - KS
690 - MM
691 - "NO"
692 - PK
693 - PN
694 - QU
695 - RE
696 - SC
697 - SD
698 - SK
699 - SM
700 - TR
701 - UT
702 - XE
703 - XR
704 min_line_len: 34
705 target:
706 - code
707 - doc
708
709- name: Telegram Bot API Token
710 severity: high
711 confidence: moderate
712 type: pattern
713 values:
714 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
715 filter_type: TokenPattern
716 required_substrings:
717 - :AA
718 min_line_len: 45
719 target:
720 - code
721 - doc
722
723- name: PyPi API Token
724 severity: high
725 confidence: strong
726 type: pattern
727 values:
728 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
729 filter_type: TokenPattern
730 required_substrings:
731 - pypi-
732 min_line_len: 155
733 target:
734 - code
735 - doc
736
737- name: NPM Token
738 severity: high
739 confidence: strong
740 type: pattern
741 values:
742 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
743 filter_type:
744 - ValueGitHubCheck
745 required_substrings:
746 - npm_
747 min_line_len: 40
748 target:
749 - code
750 - doc
751
752- name: Github Classic Token
753 severity: high
754 confidence: strong
755 type: pattern
756 values:
757 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
758 filter_type:
759 - ValueGitHubCheck
760 required_substrings:
761 - ghp_
762 - gho_
763 - ghu_
764 - ghs_
765 - ghr_
766 min_line_len: 40
767 target:
768 - code
769 - doc
770
771- name: Github Fine-granted Token
772 severity: high
773 confidence: strong
774 type: pattern
775 values:
776 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
777 filter_type: GeneralPattern
778 required_substrings:
779 - github_pat_
780 min_line_len: 90
781 target:
782 - code
783 - doc
784
785- name: Firebase Domain
786 severity: info
787 confidence: moderate
788 type: pattern
789 values:
790 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
791 filter_type: GeneralPattern
792 required_substrings:
793 - .firebase
794 min_line_len: 16
795 target:
796 - code
797 - doc
798
799- name: AWS S3 Bucket
800 severity: info
801 confidence: moderate
802 type: pattern
803 values:
804 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
805 filter_type: GeneralPattern
806 required_substrings:
807 - .s3-website
808 - .s3.amazonaws.com
809 min_line_len: 14
810 target:
811 - code
812 - doc
813
814- name: Jfrog Token
815 severity: high
816 confidence: strong
817 type: pattern
818 values:
819 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
820 filter_type:
821 - ValueJfrogTokenCheck
822 required_substrings:
823 - cmVmdGtuO
824 - AKCp
825 min_line_len: 64
826 target:
827 - code
828 - doc
829
830- name: Azure Access Token
831 severity: high
832 confidence: strong
833 type: pattern
834 values:
835 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
836 filter_type:
837 - ValueAzureTokenCheck
838 required_substrings:
839 - eyJ
840 min_line_len: 148
841 target:
842 - code
843 - doc
844
845- name: Azure Secret Value
846 severity: high
847 confidence: moderate
848 type: pattern
849 values:
850 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
851 filter_type: TokenPattern
852 min_line_len: 40
853 required_substrings:
854 - 8Q~
855 target:
856 - code
857 - doc
858
859- name: Azure Storage Account Key
860 severity: high
861 confidence: moderate
862 type: pattern
863 values:
864 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
865 min_line_len: 80
866 filter_type:
867 - ValuePatternCheck(17)
868 required_substrings:
869 - JQQJ99
870 - JQQJ9D
871 - JQQJ9H
872 target:
873 - code
874 - doc
875
876- name: Bitbucket App Password
877 severity: high
878 confidence: strong
879 type: pattern
880 values:
881 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
882 filter_type:
883 - ValueAtlassianTokenCheck
884 min_line_len: 28
885 required_substrings:
886 - ATBB
887 target:
888 - code
889 - doc
890
891- name: Bitbucket Repository Access Token
892 severity: high
893 confidence: strong
894 type: pattern
895 values:
896 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
897 filter_type:
898 - ValueAtlassianTokenCheck
899 min_line_len: 160
900 required_substrings:
901 - ATCTT3xFfGN0
902 target:
903 - code
904 - doc
905
906- name: Bitbucket HTTP Access Token
907 severity: high
908 confidence: strong
909 type: pattern
910 values:
911 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
912 filter_type:
913 - ValueAtlassianTokenCheck
914 min_line_len: 49
915 required_substrings:
916 - BBDC-
917 target:
918 - code
919 - doc
920
921- name: Jira / Confluence PAT token
922 severity: high
923 confidence: strong
924 type: pattern
925 values:
926 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
927 filter_type:
928 - ValueAtlassianTokenCheck
929 min_line_len: 44
930 required_substrings:
931 - M
932 - N
933 - O
934 required_regex: "[0-9A-Za-z_/+-]{15}"
935 target:
936 - code
937 - doc
938
939- name: Atlassian PAT token
940 severity: high
941 confidence: strong
942 type: pattern
943 values:
944 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
945 filter_type:
946 - ValueAtlassianTokenCheck
947 min_line_len: 160
948 required_substrings:
949 - ATATT3xFfGF0
950 target:
951 - code
952 - doc
953
954- name: Digital Ocean Token
955 severity: high
956 confidence: strong
957 type: pattern
958 values:
959 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
960 filter_type: TokenPattern
961 min_line_len: 71
962 required_substrings:
963 - doo_v1_
964 - dop_v1_
965 - dor_v1_
966 target:
967 - code
968 - doc
969
970- name: Dropbox OAuth2 API Access Token
971 severity: high
972 confidence: moderate
973 type: pattern
974 values:
975 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
976 filter_type: TokenPattern
977 min_line_len: 138
978 required_substrings:
979 - sl.
980 target:
981 - code
982 - doc
983
984- name: NuGet API key
985 severity: high
986 confidence: moderate
987 type: pattern
988 values:
989 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
990 filter_type: TokenPattern
991 min_line_len: 46
992 required_substrings:
993 - oy2
994 target:
995 - code
996 - doc
997
998- name: Gitlab Prefix Token
999 severity: high
1000 confidence: strong
1001 type: pattern
1002 values:
1003 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1004 filter_type:
1005 - ValuePatternCheck
1006 min_line_len: 25
1007 required_substrings:
1008 - _gitlab_session=
1009 - GR1348941
1010 - glagent-
1011 - glsoat-
1012 - glffct-
1013 - glpat-
1014 - gloas-
1015 - glptt-
1016 - glcbt-
1017 - glimt-
1018 - gldt-
1019 - glft-
1020 - glrt-
1021 target:
1022 - code
1023 - doc
1024
1025- name: Grafana Provisioned API Key
1026 severity: high
1027 confidence: strong
1028 type: pattern
1029 values:
1030 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1031 filter_type:
1032 - ValueGrafanaCheck
1033 min_line_len: 67
1034 required_substrings:
1035 - eyJ
1036 target:
1037 - code
1038 - doc
1039
1040- name: Grafana Access Policy Token
1041 severity: high
1042 confidence: strong
1043 type: pattern
1044 values:
1045 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1046 filter_type:
1047 - ValueGrafanaCheck
1048 min_line_len: 87
1049 required_substrings:
1050 - glc_eyJ
1051 target:
1052 - code
1053 - doc
1054
1055- name: Grafana Service Account Token
1056 severity: high
1057 confidence: strong
1058 type: pattern
1059 values:
1060 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1061 min_line_len: 46
1062 filter_type:
1063 - ValueGrafanaServiceCheck
1064 required_substrings:
1065 - glsa_
1066 target:
1067 - code
1068 - doc
1069
1070- name: Dropbox API secret (long term)
1071 severity: high
1072 confidence: weak
1073 type: pattern
1074 values:
1075 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1076 filter_type: [ ]
1077 min_line_len: 43
1078 required_substrings:
1079 - AAAAAAAAAA
1080 target:
1081 - code
1082 - doc
1083
1084- name: Dropbox App secret
1085 severity: info
1086 confidence: weak
1087 type: pattern
1088 values:
1089 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1090 filter_type: WeirdBase36Token
1091 min_line_len: 15
1092 required_regex: "[0-9A-Za-z_/+-]{15}"
1093 target:
1094 - code
1095 - doc
1096
1097- name: Hashicorp Vault Token
1098 severity: high
1099 confidence: strong
1100 type: pattern
1101 values:
1102 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1103 filter_type:
1104 - ValuePatternCheck
1105 - ValueEntropyBase64Check
1106 min_line_len: 90
1107 required_substrings:
1108 - hvb.
1109 - hvr.
1110 - hvs.
1111 target:
1112 - code
1113 - doc
1114
1115- name: Hashicorp Terraform Token
1116 severity: high
1117 confidence: strong
1118 type: pattern
1119 values:
1120 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1121 filter_type:
1122 - ValuePatternCheck
1123 - ValueMorphemesCheck
1124 min_line_len: 90
1125 required_substrings:
1126 - .atlasv1.
1127 target:
1128 - code
1129 - doc
1130
1131- name: NKEY Seed
1132 severity: high
1133 confidence: weak
1134 type: pattern
1135 values:
1136 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1137 min_line_len: 42
1138 filter_type:
1139 - ValueMorphemesCheck
1140 - ValuePatternCheck
1141 - ValueEntropyBase32Check
1142 - ValueBase32DataCheck
1143 - ValueTokenBase32Check
1144 required_substrings:
1145 - SA
1146 - SC
1147 - SN
1148 - SO
1149 - SP
1150 - SU
1151 - SX
1152 required_regex: "[0-9A-Za-z_/+-]{15}"
1153 target:
1154 - code
1155 - doc
1156
1157- name: OTP / 2FA Secret
1158 severity: info
1159 confidence: weak
1160 type: pattern
1161 values:
1162 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1163 filter_type:
1164 - ValueMorphemesCheck
1165 - ValuePatternCheck
1166 - ValueEntropyBase32Check
1167 - ValueBase32DataCheck
1168 - ValueTokenBase32Check
1169 - ValueBase64PartCheck
1170 min_line_len: 16
1171 required_regex: "[0-9A-Za-z_/+-]{15}"
1172 target:
1173 - code
1174 - doc
1175
1176- name: OpenAI Token
1177 severity: high
1178 confidence: strong
1179 type: pattern
1180 values:
1181 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1182 min_line_len: 51
1183 filter_type:
1184 - ValuePatternCheck
1185 - ValueMorphemesCheck
1186 required_substrings:
1187 - T3BlbkFJ
1188 - 9wZW5BS
1189 - PcGVuQU
1190 target:
1191 - code
1192 - doc
1193
1194- name: Docker Access Token
1195 severity: high
1196 confidence: strong
1197 type: pattern
1198 values:
1199 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1200 min_line_len: 36
1201 filter_type:
1202 - ValuePatternCheck
1203 - ValueMorphemesCheck
1204 required_substrings:
1205 - dckr_pat_
1206 - dckr_oat_
1207 target:
1208 - code
1209 - doc
1210
1211- name: Docker Swarm Token
1212 severity: high
1213 confidence: strong
1214 type: pattern
1215 values:
1216 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1217 min_line_len: 85
1218 filter_type:
1219 - ValuePatternCheck
1220 - ValueMorphemesCheck
1221 required_substrings:
1222 - SWMTKN-1-
1223 target:
1224 - code
1225 - doc
1226
1227- name: Docker Swarm Key
1228 severity: high
1229 confidence: strong
1230 type: pattern
1231 values:
1232 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1233 min_line_len: 52
1234 filter_type:
1235 - ValuePatternCheck
1236 - ValueMorphemesCheck
1237 required_substrings:
1238 - SWMKEY-1-
1239 target:
1240 - code
1241 - doc
1242
1243- name: Groq API Key
1244 severity: high
1245 confidence: strong
1246 type: pattern
1247 values:
1248 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1249 min_line_len: 56
1250 filter_type:
1251 - ValuePatternCheck
1252 required_substrings:
1253 - WGdyb3FY
1254 - hncm9xW
1255 - YZ3JvcV
1256 target:
1257 - code
1258 - doc
1259
1260- name: X AI API Key
1261 severity: high
1262 confidence: moderate
1263 type: pattern
1264 values:
1265 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1266 min_line_len: 84
1267 filter_type:
1268 - ValuePatternCheck
1269 - ValueEntropyBase64Check
1270 required_substrings:
1271 - xai-
1272 target:
1273 - code
1274 - doc
1275
1276- name: Notion Integration Token
1277 severity: high
1278 confidence: strong
1279 type: pattern
1280 values:
1281 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1282 filter_type:
1283 - ValuePatternCheck
1284 - ValueEntropyBase64Check
1285 required_substrings:
1286 - ntn_
1287 min_line_len: 50
1288 target:
1289 - code
1290 - doc
1291
1292- name: Hugging Face User Access Token
1293 severity: high
1294 confidence: moderate
1295 type: pattern
1296 values:
1297 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1298 min_line_len: 37
1299 filter_type:
1300 - ValuePatternCheck
1301 - ValueEntropyBase64Check
1302 required_substrings:
1303 - hf_
1304 target:
1305 - code
1306 - doc
1307
1308- name: Anthropic API Key
1309 severity: high
1310 confidence: strong
1311 type: pattern
1312 values:
1313 - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1314 min_line_len: 77
1315 filter_type:
1316 - ValuePatternCheck
1317 required_substrings:
1318 - sk-ant-api03-
1319 target:
1320 - code
1321 - doc
1322
1323- name: Perplexity API Key
1324 severity: high
1325 confidence: strong
1326 type: pattern
1327 values:
1328 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1329 min_line_len: 45
1330 filter_type:
1331 - ValuePatternCheck
1332 required_substrings:
1333 - pplx-
1334 target:
1335 - code
1336 - doc
1337
1338- name: Tavily API Key
1339 severity: high
1340 confidence: strong
1341 type: pattern
1342 values:
1343 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1344 min_line_len: 37
1345 filter_type:
1346 - ValuePatternCheck
1347 required_substrings:
1348 - tvly-
1349 target:
1350 - code
1351 - doc
1352
1353- name: Sentry Organization Auth Token
1354 severity: high
1355 confidence: strong
1356 type: pattern
1357 values:
1358 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1359 min_line_len: 37
1360 filter_type:
1361 - ValuePatternCheck
1362 required_substrings:
1363 - sntrys_eyJ
1364 target:
1365 - code
1366 - doc
1367
1368- name: Sentry User Auth Token
1369 severity: high
1370 confidence: strong
1371 type: pattern
1372 values:
1373 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1374 min_line_len: 37
1375 filter_type:
1376 - ValuePatternCheck
1377 required_substrings:
1378 - sntryu_
1379 target:
1380 - code
1381 - doc
1382
1383- name: Discord Bot Token
1384 severity: high
1385 confidence: strong
1386 type: pattern
1387 values:
1388 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1389 min_line_len: 62
1390 filter_type:
1391 - ValueDiscordBotCheck
1392 required_substrings:
1393 - M
1394 - N
1395 - O
1396 required_regex: "[0-9A-Za-z_/+-]{15}"
1397 target:
1398 - code
1399 - doc
1400
1401- name: Discord Webhook
1402 severity: medium
1403 confidence: strong
1404 type: pattern
1405 values:
1406 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1407 filter_type:
1408 - ValueMorphemesCheck
1409 required_substrings:
1410 - discordapp.com/api/webhooks
1411 - discord.com/api/webhooks
1412 min_line_len: 61
1413 target:
1414 - code
1415 - doc
1416
1417- name: Tencent WeChat API App ID
1418 severity: medium
1419 confidence: weak
1420 type: pattern
1421 values:
1422 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1423 min_line_len: 18
1424 filter_type: TokenPattern
1425 required_substrings:
1426 - wx
1427 target:
1428 - code
1429 - doc
1430
1431- name: Salesforce Credentials
1432 severity: medium
1433 confidence: weak
1434 type: pattern
1435 values:
1436 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1437 min_line_len: 12
1438 filter_type:
1439 - ValuePatternCheck(9)
1440 - ValueNumberCheck
1441 - ValueBase64PartCheck
1442 required_substrings:
1443 - 00D
1444 - 3MVG
1445 target:
1446 - code
1447 - doc
1448
1449- name: Postman Credentials
1450 severity: medium
1451 confidence: moderate
1452 type: pattern
1453 values:
1454 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1455 min_line_len: 29
1456 filter_type:
1457 - ValuePatternCheck
1458 required_substrings:
1459 - PMAK-
1460 - PMAT-
1461 target:
1462 - code
1463 - doc
1464
1465- name: NTLM Token
1466 severity: medium
1467 confidence: strong
1468 type: pattern
1469 values:
1470 - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1471 filter_type:
1472 - ValueMorphemesCheck(2)
1473 - ValuePatternCheck
1474 min_line_len: 160
1475 required_substrings:
1476 - TlRMTVNTUAADAAAA
1477 target:
1478 - doc
1479 - code
1480
1481- name: Basic Authorization
1482 severity: medium
1483 confidence: strong
1484 type: pattern
1485 values:
1486 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1487 min_line_len: 18
1488 filter_type:
1489 - ValueBasicAuthCheck
1490 required_substrings:
1491 - basic
1492 target:
1493 - code
1494 - doc
1495
1496- name: Bearer Authorization
1497 severity: medium
1498 confidence: moderate
1499 type: pattern
1500 values:
1501 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1502 min_line_len: 37
1503 filter_type: GeneralKeyword
1504 required_substrings:
1505 - bearer
1506 - ntlm
1507 target:
1508 - code
1509 - doc
1510
1511- name: SQL Password
1512 severity: medium
1513 confidence: weak
1514 type: pattern
1515 values:
1516 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}([^\s;]{1,80}\s{1,8}|VALUES\s*\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s*PASSWORD\b(\s*=)?)))\s*(?P<wrap>[(]\s*)?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\+([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1517 filter_type:
1518 - ValueAllowlistCheck
1519 - ValuePatternCheck
1520 use_ml: true
1521 min_line_len: 8
1522 required_substrings:
1523 - password
1524 - identified
1525 target:
1526 - doc
1527 - code
1528
1529- name: CURL User Password
1530 severity: high
1531 confidence: moderate
1532 type: pattern
1533 values:
1534 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1535 filter_type: GeneralKeyword
1536 use_ml: true
1537 required_substrings:
1538 - curl
1539 min_line_len: 16
1540 target:
1541 - doc
1542 - code
1543
1544- name: CMD ConvertTo-SecureString
1545 severity: high
1546 confidence: moderate
1547 type: pattern
1548 values:
1549 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1550 filter_type: GeneralKeyword
1551 use_ml: true
1552 required_substrings:
1553 - convertto-securestring
1554 min_line_len: 27
1555 target:
1556 - doc
1557 - code
1558
1559- name: CMD Password
1560 severity: high
1561 confidence: moderate
1562 type: pattern
1563 values:
1564 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1565 filter_type: GeneralKeyword
1566 use_ml: true
1567 required_substrings:
1568 - pass
1569 min_line_len: 12
1570 target:
1571 - doc
1572 - code
1573
1574- name: CMD Token
1575 severity: high
1576 confidence: moderate
1577 type: pattern
1578 values:
1579 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1580 filter_type: GeneralKeyword
1581 use_ml: true
1582 required_substrings:
1583 - token
1584 - oauth2-bearer
1585 min_line_len: 12
1586 target:
1587 - doc
1588 - code
1589
1590- name: CMD Secret
1591 severity: high
1592 confidence: moderate
1593 type: pattern
1594 values:
1595 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1596 filter_type: GeneralKeyword
1597 use_ml: true
1598 required_substrings:
1599 - secret
1600 min_line_len: 12
1601 target:
1602 - doc
1603 - code
1604
1605- name: URL Credentials
1606 severity: high
1607 confidence: moderate
1608 type: pattern
1609 values:
1610 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
1611 filter_type: UrlCredentialsGroup
1612 use_ml: true
1613 required_substrings:
1614 - ://
1615 min_line_len: 10
1616 target:
1617 - doc
1618 - code
1619
1620- name: API
1621 severity: low
1622 confidence: moderate
1623 type: keyword
1624 values:
1625 - api(?!tal)
1626 filter_type: GeneralKeyword
1627 use_ml: true
1628 min_line_len: 11
1629 required_substrings:
1630 - api
1631 target:
1632 - code
1633
1634- name: Auth
1635 severity: medium
1636 confidence: moderate
1637 type: keyword
1638 values:
1639 - auth(?!ors?(?!i[tz]))
1640 filter_type: GeneralKeyword
1641 use_ml: true
1642 min_line_len: 12
1643 required_substrings:
1644 - auth
1645 target:
1646 - code
1647
1648- name: Credential
1649 severity: medium
1650 confidence: moderate
1651 type: keyword
1652 values:
1653 - credential
1654 filter_type: GeneralKeyword
1655 use_ml: true
1656 min_line_len: 18
1657 required_substrings:
1658 - credential
1659 target:
1660 - code
1661
1662- name: Key
1663 severity: high
1664 confidence: moderate
1665 type: keyword
1666 values:
1667 - key(?!word|board|pad|name)
1668 filter_type: GeneralKeyword
1669 use_ml: true
1670 min_line_len: 11
1671 required_substrings:
1672 - key
1673 target:
1674 - code
1675
1676- name: Nonce
1677 severity: low
1678 confidence: moderate
1679 type: keyword
1680 values:
1681 - (?<!\\)nonce
1682 filter_type: GeneralKeyword
1683 use_ml: true
1684 min_line_len: 13
1685 required_substrings:
1686 - nonce
1687 target:
1688 - code
1689
1690- name: Password
1691 severity: high
1692 confidence: moderate
1693 type: keyword
1694 values:
1695 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|pw(d|\b)
1696 filter_type: PasswordKeyword
1697 use_ml: true
1698 min_line_len: 10
1699 required_substrings:
1700 - pass
1701 - pw
1702 target:
1703 - code
1704
1705- name: Salt
1706 severity: low
1707 confidence: moderate
1708 type: keyword
1709 values:
1710 - salt
1711 filter_type: GeneralKeyword
1712 use_ml: true
1713 min_line_len: 12
1714 required_substrings:
1715 - salt
1716 target:
1717 - code
1718
1719- name: Secret
1720 severity: medium
1721 confidence: moderate
1722 type: keyword
1723 values:
1724 - secret
1725 filter_type: GeneralKeyword
1726 use_ml: true
1727 min_line_len: 14
1728 required_substrings:
1729 - secret
1730 target:
1731 - code
1732
1733- name: Token
1734 severity: high
1735 confidence: moderate
1736 type: keyword
1737 values:
1738 - token(?!ize)
1739 filter_type: GeneralKeyword
1740 use_ml: true
1741 min_line_len: 13
1742 required_substrings:
1743 - token
1744 target:
1745 - code