1- name: DOC_GET
2 severity: medium
3 confidence: weak
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - LineGitBinaryCheck
10 - LineUUEPartCheck
11 - ValueFilePathCheck
12 - ValuePatternCheck(5)
13 - ValueLengthCheck(4,80)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pw
18 - token
19 - secret
20 - key
21 - cred
22 - 비밀번호
23 - 비번
24 - 패스워드
25 - 암호
26 - 키
27 - 토큰
28 target:
29 - doc
30 use_ml: true
31
32- name: DOC_CREDENTIALS
33 severity: medium
34 confidence: weak
35 type: pattern
36 values:
37 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,80}|[^\"'`]{4,80})|(?(wrap)[^\"'`)]{4,80}|\S{4,80})))
38 filter_type:
39 - ValueAllowlistCheck
40 - LineGitBinaryCheck
41 - LineUUEPartCheck
42 - ValueFilePathCheck
43 - ValuePatternCheck(5)
44 - ValueLengthCheck(4,80)
45 min_line_len: 8
46 required_substrings:
47 - pass
48 - sword
49 - pw
50 - p/w
51 - paasw
52 - 비밀번호
53 - 비번
54 - 패스워드
55 - 암호
56 - token
57 - secret
58 - key
59 - credential
60 - 키
61 - 토큰
62 target:
63 - doc
64 use_ml: true
65
66- name: SECRET_PAIR
67 severity: medium
68 confidence: moderate
69 type: pattern
70 values:
71 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
72 filter_type:
73 - ValueAllowlistCheck
74 - ValuePatternCheck(4)
75 - ValueEntropyBase64Check
76 - ValueMorphemesCheck
77 min_line_len: 16
78 required_substrings:
79 - token
80 - secret
81 - key
82 - 키
83 - 암호
84 - 토큰
85 target:
86 - doc
87 use_ml: true
88
89- name: PASSWD_PAIR
90 severity: medium
91 confidence: moderate
92 type: pattern
93 values:
94 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
95 filter_type:
96 - ValueAllowlistCheck
97 - ValuePatternCheck(4)
98 - ValueDictionaryKeywordCheck
99 - LineGitBinaryCheck
100 - LineUUEPartCheck
101 - ValueFilePathCheck
102 - ValueHexNumberCheck
103 min_line_len: 10
104 required_substrings:
105 - pass
106 - sword
107 - pw
108 - p/w
109 - paasw
110 - 비밀번호
111 - 비번
112 - 패스워드
113 - 암호
114 target:
115 - doc
116 use_ml: true
117
118- name: IP_ID_PASSWORD_TRIPLE
119 severity: medium
120 confidence: moderate
121 type: pattern
122 values:
123 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
124 filter_type:
125 - ValueAllowlistCheck
126 - ValuePatternCheck(4)
127 - ValueDictionaryKeywordCheck
128 min_line_len: 10
129 required_substrings:
130 - "."
131 target:
132 - doc
133 use_ml: true
134
135- name: ID_PAIR_PASSWD_PAIR
136 severity: medium
137 confidence: moderate
138 type: pattern
139 values:
140 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
141 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
142 filter_type:
143 - ValueAllowlistCheck
144 - ValuePatternCheck(4)
145 min_line_len: 10
146 required_substrings:
147 - pass
148 - sword
149 - p/w
150 - pw
151 - 비밀번호
152 - 비번
153 - 패스워드
154 - 암호
155 target:
156 - doc
157 use_ml: true
158
159- name: ID_PASSWD_PAIR
160 severity: medium
161 confidence: moderate
162 type: pattern
163 values:
164 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
165 filter_type:
166 - ValueAllowlistCheck
167 - ValuePatternCheck(4)
168 - ValueDictionaryKeywordCheck
169 min_line_len: 10
170 required_substrings:
171 - pw
172 - pass
173 - sword
174 - 비밀번호
175 - 비번
176 - 패스워드
177 - 암호
178 target:
179 - doc
180 use_ml: true
181
182- name: UUID
183 severity: info
184 confidence: strong
185 type: pattern
186 values:
187 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
188 min_line_len: 36
189 required_substrings:
190 - "-"
191 filter_type:
192 - ValuePatternCheck(4)
193 use_ml: false
194 target:
195 - code
196 - doc
197
198- name: Akamai Credentials
199 severity: high
200 confidence: strong
201 type: pattern
202 values:
203 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
204 filter_type: GeneralPattern
205 required_substrings:
206 - akab-
207 min_line_len: 38
208 target:
209 - code
210 - doc
211
212- name: Amazon Bedrock API Key
213 severity: high
214 confidence: moderate
215 type: pattern
216 values:
217 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
218 filter_type: GeneralPattern
219 required_substrings:
220 - ABSK
221 - bedrock-api-key-
222 min_line_len: 44
223 target:
224 - code
225 - doc
226
227- name: AWS Client ID
228 severity: high
229 confidence: moderate
230 type: pattern
231 values:
232 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
233 filter_type: GeneralPattern
234 required_substrings:
235 - A3T
236 - ABIA
237 - ACCA
238 - AGPA
239 - AIDA
240 - AIPA
241 - AKIA
242 - ANPA
243 - ANVA
244 - AROA
245 - APKA
246 - ASCA
247 - ASIA
248 min_line_len: 20
249 required_regex: "[0-9A-Za-z_/+-]{15}"
250 target:
251 - code
252 - doc
253
254- name: AWS Multi
255 severity: high
256 confidence: moderate
257 type: multi
258 values:
259 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
260 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
261 filter_type:
262 - LineSpecificKeyCheck
263 - ValuePatternCheck
264 - ValueBase64PartCheck
265 - ValueMorphemesCheck
266 required_substrings:
267 - AKIA
268 - ASIA
269 min_line_len: 20
270 required_regex: "[0-9A-Za-z_/+-]{15}"
271 target:
272 - code
273 - doc
274
275- name: AWS MWS Key
276 severity: high
277 confidence: strong
278 type: pattern
279 values:
280 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
281 filter_type: GeneralPattern
282 required_substrings:
283 - amzn.mws.
284 min_line_len: 30
285 target:
286 - code
287 - doc
288
289- name: Dynatrace API Token
290 severity: high
291 confidence: moderate
292 type: pattern
293 values:
294 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
295 filter_type: TokenPattern
296 required_substrings:
297 - dt0
298 min_line_len: 90
299 target:
300 - code
301 - doc
302
303- name: Facebook Access Token
304 severity: high
305 confidence: moderate
306 type: pattern
307 values:
308 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
309 filter_type:
310 - ValuePatternCheck
311 - ValueBase64PartCheck
312 - ValueNotPartEncodedCheck
313 required_substrings:
314 - EAA
315 min_line_len: 80
316 target:
317 - code
318 - doc
319
320- name: Facebook App Token
321 severity: high
322 confidence: moderate
323 type: pattern
324 values:
325 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
326 filter_type: TokenPattern
327 required_substrings:
328 - "|"
329 required_regex: "[0-9A-Za-z_/+-]{15}"
330 min_line_len: 33
331 target:
332 - code
333 - doc
334
335- name: Google API Key
336 severity: high
337 confidence: moderate
338 type: pattern
339 values:
340 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
341 filter_type: TokenPattern
342 required_substrings:
343 - AIza
344 min_line_len: 39
345 target:
346 - code
347 - doc
348
349- name: Google Multi
350 severity: high
351 confidence: moderate
352 type: multi
353 values:
354 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
355 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
356 filter_type: GeneralPattern
357 required_substrings:
358 - .apps.googleusercontent.com
359 min_line_len: 40
360 target:
361 - code
362 - doc
363
364- name: Google OAuth Secret
365 severity: high
366 confidence: strong
367 type: pattern
368 values:
369 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
370 filter_type: TokenPattern
371 required_substrings:
372 - GOCSPX-
373 min_line_len: 40
374 target:
375 - code
376 - doc
377
378- name: Google OAuth Access Token
379 severity: high
380 confidence: moderate
381 type: pattern
382 values:
383 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
384 filter_type: TokenPattern
385 required_substrings:
386 - ya29.
387 min_line_len: 27
388 target:
389 - code
390 - doc
391
392- name: Google OAuth Refresh Token
393 severity: medium
394 confidence: weak
395 type: pattern
396 values:
397 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
398 filter_type: TokenPattern
399 required_substrings:
400 - 1//0
401 min_line_len: 84
402 target:
403 - code
404 - doc
405
406- name: Heroku Credentials
407 severity: high
408 confidence: strong
409 type: pattern
410 values:
411 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
412 filter_type: TokenPattern
413 required_substrings:
414 - HRKU-
415 min_line_len: 41
416 target:
417 - code
418 - doc
419
420- name: Instagram Access Token
421 severity: high
422 confidence: strong
423 type: pattern
424 values:
425 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
426 filter_type: TokenPattern
427 required_substrings:
428 - IGQVJ
429 min_line_len: 105
430 target:
431 - code
432 - doc
433
434- name: JSON Web Token
435 severity: medium
436 confidence: strong
437 type: pattern
438 values:
439 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
440 filter_type:
441 - ValueJsonWebTokenCheck
442 required_substrings:
443 - eyJ
444 min_line_len: 64
445 target:
446 - code
447 - doc
448
449- name: JSON Web Key
450 severity: medium
451 confidence: strong
452 type: pattern
453 values:
454 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
455 filter_type:
456 - ValueJsonWebKeyCheck
457 required_substrings:
458 - eyJ
459 - eyAi
460 - ewoi
461 - ewog
462 - ew0K
463 - WyJ
464 - W3si
465 - Wwp7
466 - Wwog
467 - Ww0K
468 - W3sK
469 min_line_len: 64
470 target:
471 - code
472 - doc
473
474- name: JWK
475 severity: medium
476 confidence: moderate
477 type: multi
478 values:
479 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
480 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
481 filter_type:
482 - ValuePatternCheck
483 - ValueMorphemesCheck
484 required_substrings:
485 - kty
486 min_line_len: 8
487 target:
488 - code
489 - doc
490
491- name: MailChimp API Key
492 severity: high
493 confidence: moderate
494 type: pattern
495 values:
496 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
497 filter_type: TokenPattern
498 required_substrings:
499 - -us
500 min_line_len: 35
501 target:
502 - code
503 - doc
504
505- name: MailGun API Key
506 severity: high
507 confidence: moderate
508 type: pattern
509 values:
510 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
511 filter_type: TokenPattern
512 required_regex: "[0-9A-Za-z_/+-]{15}"
513 min_line_len: 36
514 target:
515 - code
516 - doc
517
518- name: PayPal Braintree Access Token
519 severity: high
520 confidence: strong
521 type: pattern
522 values:
523 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
524 filter_type: GeneralPattern
525 required_substrings:
526 - access_token$production$
527 min_line_len: 72
528 target:
529 - code
530 - doc
531
532- name: PEM Private Key
533 severity: high
534 confidence: strong
535 type: pem_key
536 values:
537 - (?P<value>-----BEGIN\s(?!ENCRYPTED)[^-]{0,80}PRIVATE[^-]{0,80}KEY[^-]{0,40}-----(.+-----END[^-]{1,80}KEY[^-]{0,40}-----)?)
538 min_line_len: 27
539 target:
540 - code
541 - doc
542
543- name: BASE64 encoded PEM Private Key
544 severity: high
545 confidence: strong
546 type: pattern
547 values:
548 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
549 filter_type:
550 - ValueBase64EncodedPem
551 min_line_len: 300
552 required_substrings:
553 - UFJJVkFURSBLRVkt
554 - QUklWQVRFIEtFWS0t
555 - FBSSVZBVEUgS0VZ
556 target:
557 - code
558 - doc
559
560- name: BASE64 Private Key
561 severity: high
562 confidence: strong
563 type: pattern
564 values:
565 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
566 filter_type:
567 - ValueBase64KeyCheck
568 min_line_len: 160
569 required_substrings:
570 - MII
571 target:
572 - code
573 - doc
574
575- name: Picatic API Key
576 severity: high
577 confidence: strong
578 type: pattern
579 values:
580 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
581 filter_type: GeneralPattern
582 required_substrings:
583 - sk_live_
584 min_line_len: 40
585 target:
586 - code
587 - doc
588
589- name: SendGrid API Key
590 severity: high
591 confidence: moderate
592 type: pattern
593 values:
594 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
595 filter_type: TokenPattern
596 required_substrings:
597 - SG.
598 min_line_len: 34
599 target:
600 - code
601 - doc
602
603- name: Shopify Token
604 severity: high
605 confidence: strong
606 type: pattern
607 values:
608 - (?P<value>shp(at|ca|pa|ss)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
609 filter_type: TokenPattern
610 required_substrings:
611 - shp
612 min_line_len: 38
613 target:
614 - code
615 - doc
616
617- name: Slack Token
618 severity: high
619 confidence: strong
620 type: pattern
621 values:
622 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
623 filter_type: TokenPattern
624 required_substrings:
625 - xox
626 - xapp
627 min_line_len: 15
628 target:
629 - code
630 - doc
631
632- name: Slack Webhook
633 severity: medium
634 confidence: strong
635 type: pattern
636 values:
637 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
638 filter_type: GeneralPattern
639 required_substrings:
640 - hooks.slack.com/services/T
641 min_line_len: 61
642 target:
643 - code
644 - doc
645
646- name: Stripe Credentials
647 severity: high
648 confidence: strong
649 type: pattern
650 values:
651 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
652 filter_type: GeneralPattern
653 required_substrings:
654 - k_live_
655 - k_test_
656 - whsec_
657 min_line_len: 32
658 target:
659 - code
660 - doc
661
662- name: Square Access Token
663 severity: high
664 confidence: moderate
665 type: pattern
666 values:
667 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
668 filter_type:
669 - ValuePatternCheck
670 - ValueBase64PartCheck
671 required_substrings:
672 - EAAA
673 min_line_len: 64
674 target:
675 - code
676 - doc
677
678- name: Square Credentials
679 severity: medium
680 confidence: strong
681 type: pattern
682 values:
683 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
684 filter_type: TokenPattern
685 required_substrings:
686 - sq0
687 min_line_len: 29
688 target:
689 - code
690 - doc
691
692- name: Twilio Credentials
693 severity: high
694 confidence: moderate
695 type: pattern
696 values:
697 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
698 filter_type: TokenPattern
699 required_substrings:
700 - AC
701 - AD
702 - AL
703 - CA
704 - CF
705 - CL
706 - CN
707 - CR
708 - FW
709 - IP
710 - KS
711 - MM
712 - "NO"
713 - PK
714 - PN
715 - QU
716 - RE
717 - SC
718 - SD
719 - SK
720 - SM
721 - TR
722 - UT
723 - XE
724 - XR
725 min_line_len: 34
726 target:
727 - code
728 - doc
729
730- name: Telegram Bot API Token
731 severity: high
732 confidence: moderate
733 type: pattern
734 values:
735 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
736 filter_type: TokenPattern
737 required_substrings:
738 - :AA
739 min_line_len: 45
740 target:
741 - code
742 - doc
743
744- name: PyPi API Token
745 severity: high
746 confidence: strong
747 type: pattern
748 values:
749 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
750 filter_type: TokenPattern
751 required_substrings:
752 - pypi-
753 min_line_len: 155
754 target:
755 - code
756 - doc
757
758- name: NPM Token
759 severity: high
760 confidence: strong
761 type: pattern
762 values:
763 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
764 filter_type:
765 - ValueGitHubCheck
766 required_substrings:
767 - npm_
768 min_line_len: 40
769 target:
770 - code
771 - doc
772
773- name: Github Classic Token
774 severity: high
775 confidence: strong
776 type: pattern
777 values:
778 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
779 filter_type:
780 - ValueGitHubCheck
781 required_substrings:
782 - ghp_
783 - gho_
784 - ghu_
785 - ghs_
786 - ghr_
787 min_line_len: 40
788 target:
789 - code
790 - doc
791
792- name: Github Fine-granted Token
793 severity: high
794 confidence: strong
795 type: pattern
796 values:
797 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
798 filter_type: GeneralPattern
799 required_substrings:
800 - github_pat_
801 min_line_len: 90
802 target:
803 - code
804 - doc
805
806- name: Firebase Domain
807 severity: info
808 confidence: moderate
809 type: pattern
810 values:
811 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
812 filter_type: GeneralPattern
813 required_substrings:
814 - .firebase
815 min_line_len: 16
816 target:
817 - code
818 - doc
819
820- name: AWS S3 Bucket
821 severity: info
822 confidence: moderate
823 type: pattern
824 values:
825 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
826 filter_type: GeneralPattern
827 required_substrings:
828 - .s3-website
829 - .s3.amazonaws.com
830 min_line_len: 14
831 target:
832 - code
833 - doc
834
835- name: Jfrog Token
836 severity: high
837 confidence: strong
838 type: pattern
839 values:
840 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
841 filter_type:
842 - ValueJfrogTokenCheck
843 required_substrings:
844 - cmVmdGtuO
845 - AKCp
846 min_line_len: 64
847 target:
848 - code
849 - doc
850
851- name: Azure Access Token
852 severity: high
853 confidence: strong
854 type: pattern
855 values:
856 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
857 filter_type:
858 - ValueAzureTokenCheck
859 required_substrings:
860 - eyJ
861 min_line_len: 148
862 target:
863 - code
864 - doc
865
866- name: Azure Secret Value
867 severity: high
868 confidence: moderate
869 type: pattern
870 values:
871 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
872 filter_type: TokenPattern
873 min_line_len: 40
874 required_substrings:
875 - 8Q~
876 target:
877 - code
878 - doc
879
880- name: Azure Storage Account Key
881 severity: high
882 confidence: moderate
883 type: pattern
884 values:
885 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
886 min_line_len: 80
887 filter_type:
888 - ValuePatternCheck(17)
889 required_substrings:
890 - JQQJ99
891 - JQQJ9D
892 - JQQJ9H
893 target:
894 - code
895 - doc
896
897- name: Bitbucket App Password
898 severity: high
899 confidence: strong
900 type: pattern
901 values:
902 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
903 filter_type:
904 - ValueAtlassianTokenCheck
905 min_line_len: 28
906 required_substrings:
907 - ATBB
908 target:
909 - code
910 - doc
911
912- name: Bitbucket Repository Access Token
913 severity: high
914 confidence: strong
915 type: pattern
916 values:
917 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
918 filter_type:
919 - ValueAtlassianTokenCheck
920 min_line_len: 160
921 required_substrings:
922 - ATCTT3xFfGN0
923 target:
924 - code
925 - doc
926
927- name: Bitbucket HTTP Access Token
928 severity: high
929 confidence: strong
930 type: pattern
931 values:
932 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
933 filter_type:
934 - ValueAtlassianTokenCheck
935 min_line_len: 49
936 required_substrings:
937 - BBDC-
938 target:
939 - code
940 - doc
941
942- name: Jira / Confluence PAT token
943 severity: high
944 confidence: strong
945 type: pattern
946 values:
947 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
948 filter_type:
949 - ValueAtlassianTokenCheck
950 min_line_len: 44
951 required_substrings:
952 - M
953 - N
954 - O
955 required_regex: "[0-9A-Za-z_/+-]{15}"
956 target:
957 - code
958 - doc
959
960- name: Atlassian PAT token
961 severity: high
962 confidence: strong
963 type: pattern
964 values:
965 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
966 filter_type:
967 - ValueAtlassianTokenCheck
968 min_line_len: 160
969 required_substrings:
970 - ATATT3xFfGF0
971 target:
972 - code
973 - doc
974
975- name: Digital Ocean Token
976 severity: high
977 confidence: strong
978 type: pattern
979 values:
980 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
981 filter_type: TokenPattern
982 min_line_len: 71
983 required_substrings:
984 - doo_v1_
985 - dop_v1_
986 - dor_v1_
987 target:
988 - code
989 - doc
990
991- name: Dropbox OAuth2 API Access Token
992 severity: high
993 confidence: moderate
994 type: pattern
995 values:
996 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
997 filter_type: TokenPattern
998 min_line_len: 80
999 required_substrings:
1000 - sl.
1001 target:
1002 - code
1003 - doc
1004
1005- name: NuGet API key
1006 severity: high
1007 confidence: moderate
1008 type: pattern
1009 values:
1010 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1011 filter_type: TokenPattern
1012 min_line_len: 46
1013 required_substrings:
1014 - oy2
1015 target:
1016 - code
1017 - doc
1018
1019- name: Gitlab Prefix Token
1020 severity: high
1021 confidence: strong
1022 type: pattern
1023 values:
1024 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1025 filter_type:
1026 - ValuePatternCheck
1027 min_line_len: 25
1028 required_substrings:
1029 - _gitlab_session=
1030 - GR1348941
1031 - glagent-
1032 - glsoat-
1033 - glffct-
1034 - glpat-
1035 - gloas-
1036 - glptt-
1037 - glcbt-
1038 - glimt-
1039 - gldt-
1040 - glft-
1041 - glrt-
1042 - glrtr-
1043 - glwt-
1044 target:
1045 - code
1046 - doc
1047
1048- name: Grafana Provisioned API Key
1049 severity: high
1050 confidence: strong
1051 type: pattern
1052 values:
1053 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1054 filter_type:
1055 - ValueGrafanaCheck
1056 min_line_len: 67
1057 required_substrings:
1058 - eyJ
1059 target:
1060 - code
1061 - doc
1062
1063- name: Grafana Access Policy Token
1064 severity: high
1065 confidence: strong
1066 type: pattern
1067 values:
1068 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1069 filter_type:
1070 - ValueGrafanaCheck
1071 min_line_len: 87
1072 required_substrings:
1073 - glc_eyJ
1074 target:
1075 - code
1076 - doc
1077
1078- name: Grafana Service Account Token
1079 severity: high
1080 confidence: strong
1081 type: pattern
1082 values:
1083 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1084 min_line_len: 46
1085 filter_type:
1086 - ValueGrafanaServiceCheck
1087 required_substrings:
1088 - glsa_
1089 target:
1090 - code
1091 - doc
1092
1093- name: Dropbox API secret (long term)
1094 severity: high
1095 confidence: weak
1096 type: pattern
1097 values:
1098 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1099 filter_type: [ ]
1100 min_line_len: 43
1101 required_substrings:
1102 - AAAAAAAAAA
1103 target:
1104 - code
1105 - doc
1106
1107- name: Dropbox App secret
1108 severity: info
1109 confidence: weak
1110 type: pattern
1111 values:
1112 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1113 filter_type: WeirdBase36Token
1114 min_line_len: 15
1115 required_regex: "[0-9A-Za-z_/+-]{15}"
1116 target:
1117 - code
1118 - doc
1119
1120- name: Hashicorp Vault Token
1121 severity: high
1122 confidence: strong
1123 type: pattern
1124 values:
1125 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1126 filter_type:
1127 - ValuePatternCheck
1128 - ValueEntropyBase64Check
1129 min_line_len: 90
1130 required_substrings:
1131 - hvb.
1132 - hvr.
1133 - hvs.
1134 target:
1135 - code
1136 - doc
1137
1138- name: Hashicorp Terraform Token
1139 severity: high
1140 confidence: strong
1141 type: pattern
1142 values:
1143 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1144 filter_type:
1145 - ValuePatternCheck
1146 - ValueMorphemesCheck
1147 min_line_len: 90
1148 required_substrings:
1149 - .atlasv1.
1150 target:
1151 - code
1152 - doc
1153
1154- name: NKEY Seed
1155 severity: high
1156 confidence: weak
1157 type: pattern
1158 values:
1159 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1160 min_line_len: 42
1161 filter_type:
1162 - ValueMorphemesCheck
1163 - ValuePatternCheck
1164 - ValueEntropyBase32Check
1165 - ValueBase32DataCheck
1166 - ValueTokenBase32Check
1167 required_substrings:
1168 - SA
1169 - SC
1170 - SN
1171 - SO
1172 - SP
1173 - SU
1174 - SX
1175 required_regex: "[0-9A-Za-z_/+-]{15}"
1176 target:
1177 - code
1178 - doc
1179
1180- name: OTP / 2FA Secret
1181 severity: info
1182 confidence: weak
1183 type: pattern
1184 values:
1185 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1186 filter_type:
1187 - ValueMorphemesCheck
1188 - ValuePatternCheck
1189 - ValueEntropyBase32Check
1190 - ValueBase32DataCheck
1191 - ValueTokenBase32Check
1192 - ValueBase64PartCheck
1193 min_line_len: 16
1194 required_regex: "[0-9A-Za-z_/+-]{15}"
1195 target:
1196 - code
1197 - doc
1198
1199- name: OpenAI Token
1200 severity: high
1201 confidence: strong
1202 type: pattern
1203 values:
1204 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1205 min_line_len: 51
1206 filter_type:
1207 - ValuePatternCheck
1208 - ValueMorphemesCheck
1209 required_substrings:
1210 - T3BlbkFJ
1211 - 9wZW5BS
1212 - PcGVuQU
1213 target:
1214 - code
1215 - doc
1216
1217- name: Docker Access Token
1218 severity: high
1219 confidence: strong
1220 type: pattern
1221 values:
1222 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1223 min_line_len: 36
1224 filter_type:
1225 - ValuePatternCheck
1226 - ValueMorphemesCheck
1227 required_substrings:
1228 - dckr_pat_
1229 - dckr_oat_
1230 target:
1231 - code
1232 - doc
1233
1234- name: Docker Swarm Token
1235 severity: high
1236 confidence: strong
1237 type: pattern
1238 values:
1239 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1240 min_line_len: 85
1241 filter_type:
1242 - ValuePatternCheck
1243 - ValueMorphemesCheck
1244 required_substrings:
1245 - SWMTKN-1-
1246 target:
1247 - code
1248 - doc
1249
1250- name: Docker Swarm Key
1251 severity: high
1252 confidence: strong
1253 type: pattern
1254 values:
1255 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1256 min_line_len: 52
1257 filter_type:
1258 - ValuePatternCheck
1259 - ValueMorphemesCheck
1260 required_substrings:
1261 - SWMKEY-1-
1262 target:
1263 - code
1264 - doc
1265
1266- name: Groq API Key
1267 severity: high
1268 confidence: strong
1269 type: pattern
1270 values:
1271 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1272 min_line_len: 56
1273 filter_type:
1274 - ValuePatternCheck
1275 required_substrings:
1276 - WGdyb3FY
1277 - hncm9xW
1278 - YZ3JvcV
1279 target:
1280 - code
1281 - doc
1282
1283- name: X AI API Key
1284 severity: high
1285 confidence: moderate
1286 type: pattern
1287 values:
1288 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1289 min_line_len: 84
1290 filter_type:
1291 - ValuePatternCheck
1292 - ValueEntropyBase64Check
1293 required_substrings:
1294 - xai-
1295 target:
1296 - code
1297 - doc
1298
1299- name: Notion Integration Token
1300 severity: high
1301 confidence: strong
1302 type: pattern
1303 values:
1304 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1305 filter_type:
1306 - ValuePatternCheck
1307 - ValueEntropyBase64Check
1308 required_substrings:
1309 - ntn_
1310 min_line_len: 50
1311 target:
1312 - code
1313 - doc
1314
1315- name: Hugging Face User Access Token
1316 severity: high
1317 confidence: moderate
1318 type: pattern
1319 values:
1320 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1321 min_line_len: 37
1322 filter_type:
1323 - ValuePatternCheck
1324 - ValueEntropyBase64Check
1325 required_substrings:
1326 - hf_
1327 target:
1328 - code
1329 - doc
1330
1331- name: Anthropic API Key
1332 severity: high
1333 confidence: strong
1334 type: pattern
1335 values:
1336 - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1337 min_line_len: 77
1338 filter_type:
1339 - ValuePatternCheck
1340 required_substrings:
1341 - sk-ant-api03-
1342 target:
1343 - code
1344 - doc
1345
1346- name: Perplexity API Key
1347 severity: high
1348 confidence: strong
1349 type: pattern
1350 values:
1351 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1352 min_line_len: 45
1353 filter_type:
1354 - ValuePatternCheck
1355 required_substrings:
1356 - pplx-
1357 target:
1358 - code
1359 - doc
1360
1361- name: Tavily API Key
1362 severity: high
1363 confidence: strong
1364 type: pattern
1365 values:
1366 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1367 min_line_len: 37
1368 filter_type:
1369 - ValuePatternCheck
1370 required_substrings:
1371 - tvly-
1372 target:
1373 - code
1374 - doc
1375
1376- name: Sentry Organization Auth Token
1377 severity: high
1378 confidence: strong
1379 type: pattern
1380 values:
1381 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1382 min_line_len: 37
1383 filter_type:
1384 - ValuePatternCheck
1385 required_substrings:
1386 - sntrys_eyJ
1387 target:
1388 - code
1389 - doc
1390
1391- name: Sentry User Auth Token
1392 severity: high
1393 confidence: strong
1394 type: pattern
1395 values:
1396 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1397 min_line_len: 37
1398 filter_type:
1399 - ValuePatternCheck
1400 required_substrings:
1401 - sntryu_
1402 target:
1403 - code
1404 - doc
1405
1406- name: Discord Bot Token
1407 severity: high
1408 confidence: strong
1409 type: pattern
1410 values:
1411 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1412 min_line_len: 62
1413 filter_type:
1414 - ValueDiscordBotCheck
1415 required_substrings:
1416 - M
1417 - N
1418 - O
1419 required_regex: "[0-9A-Za-z_/+-]{15}"
1420 target:
1421 - code
1422 - doc
1423
1424- name: Discord Webhook
1425 severity: medium
1426 confidence: strong
1427 type: pattern
1428 values:
1429 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1430 filter_type:
1431 - ValueMorphemesCheck
1432 required_substrings:
1433 - discordapp.com/api/webhooks
1434 - discord.com/api/webhooks
1435 min_line_len: 61
1436 target:
1437 - code
1438 - doc
1439
1440- name: Tencent WeChat API App ID
1441 severity: medium
1442 confidence: weak
1443 type: pattern
1444 values:
1445 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1446 min_line_len: 18
1447 filter_type: TokenPattern
1448 required_substrings:
1449 - wx
1450 target:
1451 - code
1452 - doc
1453
1454- name: Salesforce Credentials
1455 severity: medium
1456 confidence: weak
1457 type: pattern
1458 values:
1459 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1460 min_line_len: 12
1461 filter_type:
1462 - ValuePatternCheck(9)
1463 - ValueNumberCheck
1464 - ValueBase64PartCheck
1465 required_substrings:
1466 - 00D
1467 - 3MVG
1468 target:
1469 - code
1470 - doc
1471
1472- name: Postman Credentials
1473 severity: medium
1474 confidence: moderate
1475 type: pattern
1476 values:
1477 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1478 min_line_len: 29
1479 filter_type:
1480 - ValuePatternCheck
1481 required_substrings:
1482 - PMAK-
1483 - PMAT-
1484 target:
1485 - code
1486 - doc
1487
1488- name: NTLM Token
1489 severity: medium
1490 confidence: strong
1491 type: pattern
1492 values:
1493 - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1494 filter_type:
1495 - ValueMorphemesCheck(2)
1496 - ValuePatternCheck
1497 min_line_len: 160
1498 required_substrings:
1499 - TlRMTVNTUAADAAAA
1500 target:
1501 - doc
1502 - code
1503
1504- name: Basic Authorization
1505 severity: medium
1506 confidence: strong
1507 type: pattern
1508 values:
1509 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1510 min_line_len: 18
1511 filter_type:
1512 - ValueBasicAuthCheck
1513 required_substrings:
1514 - basic
1515 target:
1516 - code
1517 - doc
1518
1519- name: Bearer Authorization
1520 severity: medium
1521 confidence: moderate
1522 type: pattern
1523 values:
1524 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1525 min_line_len: 37
1526 filter_type: GeneralKeyword
1527 required_substrings:
1528 - bearer
1529 - ntlm
1530 target:
1531 - code
1532 - doc
1533
1534- name: SQL Password
1535 severity: medium
1536 confidence: weak
1537 type: pattern
1538 values:
1539 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1540 filter_type:
1541 - ValueAllowlistCheck
1542 - ValuePatternCheck
1543 use_ml: true
1544 min_line_len: 8
1545 required_substrings:
1546 - password
1547 - identified
1548 target:
1549 - doc
1550 - code
1551
1552- name: CURL User Password
1553 severity: high
1554 confidence: moderate
1555 type: pattern
1556 values:
1557 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1558 filter_type: GeneralKeyword
1559 use_ml: true
1560 required_substrings:
1561 - curl
1562 min_line_len: 16
1563 target:
1564 - doc
1565 - code
1566
1567- name: CMD ConvertTo-SecureString
1568 severity: high
1569 confidence: moderate
1570 type: pattern
1571 values:
1572 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1573 filter_type: GeneralKeyword
1574 use_ml: true
1575 required_substrings:
1576 - convertto-securestring
1577 min_line_len: 27
1578 target:
1579 - doc
1580 - code
1581
1582- name: CMD Password
1583 severity: high
1584 confidence: moderate
1585 type: pattern
1586 values:
1587 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1588 filter_type: GeneralKeyword
1589 use_ml: true
1590 required_substrings:
1591 - pass
1592 min_line_len: 12
1593 target:
1594 - doc
1595 - code
1596
1597- name: CMD Token
1598 severity: high
1599 confidence: moderate
1600 type: pattern
1601 values:
1602 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1603 filter_type: GeneralKeyword
1604 use_ml: true
1605 required_substrings:
1606 - token
1607 - oauth2-bearer
1608 min_line_len: 12
1609 target:
1610 - doc
1611 - code
1612
1613- name: CMD Secret
1614 severity: high
1615 confidence: moderate
1616 type: pattern
1617 values:
1618 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1619 filter_type: GeneralKeyword
1620 use_ml: true
1621 required_substrings:
1622 - secret
1623 min_line_len: 12
1624 target:
1625 - doc
1626 - code
1627
1628- name: URL Credentials
1629 severity: high
1630 confidence: moderate
1631 type: pattern
1632 values:
1633 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
1634 filter_type: UrlCredentialsGroup
1635 use_ml: true
1636 required_substrings:
1637 - ://
1638 min_line_len: 10
1639 target:
1640 - doc
1641 - code
1642
1643- name: API
1644 severity: low
1645 confidence: moderate
1646 type: keyword
1647 values:
1648 - api(?!tal)
1649 filter_type: GeneralKeyword
1650 use_ml: true
1651 min_line_len: 11
1652 required_substrings:
1653 - api
1654 target:
1655 - code
1656
1657- name: Auth
1658 severity: medium
1659 confidence: moderate
1660 type: keyword
1661 values:
1662 - auth(?!ors?(?!i[tz]))
1663 filter_type: GeneralKeyword
1664 use_ml: true
1665 min_line_len: 12
1666 required_substrings:
1667 - auth
1668 target:
1669 - code
1670
1671- name: Credential
1672 severity: medium
1673 confidence: moderate
1674 type: keyword
1675 values:
1676 - credential
1677 filter_type: GeneralKeyword
1678 use_ml: true
1679 min_line_len: 18
1680 required_substrings:
1681 - credential
1682 target:
1683 - code
1684
1685- name: Key
1686 severity: high
1687 confidence: moderate
1688 type: keyword
1689 values:
1690 - key(?!word|board|pad|name)
1691 filter_type: GeneralKeyword
1692 use_ml: true
1693 min_line_len: 11
1694 required_substrings:
1695 - key
1696 target:
1697 - code
1698
1699- name: Nonce
1700 severity: low
1701 confidence: moderate
1702 type: keyword
1703 values:
1704 - (?<!\\)nonce
1705 filter_type: GeneralKeyword
1706 use_ml: true
1707 min_line_len: 13
1708 required_substrings:
1709 - nonce
1710 target:
1711 - code
1712
1713- name: Password
1714 severity: high
1715 confidence: moderate
1716 type: keyword
1717 values:
1718 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|pw(d|\b)
1719 filter_type: PasswordKeyword
1720 use_ml: true
1721 min_line_len: 10
1722 required_substrings:
1723 - pass
1724 - pw
1725 target:
1726 - code
1727
1728- name: Salt
1729 severity: low
1730 confidence: moderate
1731 type: keyword
1732 values:
1733 - salt
1734 filter_type: GeneralKeyword
1735 use_ml: true
1736 min_line_len: 12
1737 required_substrings:
1738 - salt
1739 target:
1740 - code
1741
1742- name: Secret
1743 severity: medium
1744 confidence: moderate
1745 type: keyword
1746 values:
1747 - secret
1748 filter_type: GeneralKeyword
1749 use_ml: true
1750 min_line_len: 14
1751 required_substrings:
1752 - secret
1753 target:
1754 - code
1755
1756- name: Token
1757 severity: high
1758 confidence: moderate
1759 type: keyword
1760 values:
1761 - token(?!ize)
1762 filter_type: GeneralKeyword
1763 use_ml: true
1764 min_line_len: 13
1765 required_substrings:
1766 - token
1767 target:
1768 - code