1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 target:
30 - doc
31 use_ml: true
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 target:
66 - doc
67 use_ml: true
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 target:
90 - doc
91 use_ml: true
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 target:
121 - doc
122 use_ml: true
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 target:
138 - doc
139 use_ml: true
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 target:
163 - doc
164 use_ml: true
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 target:
187 - doc
188 use_ml: true
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 min_line_len: 36
197 required_substrings:
198 - "-"
199 filter_type:
200 - ValuePatternCheck(4)
201 use_ml: false
202 target:
203 - code
204 - doc
205
206- name: Akamai Credentials
207 severity: high
208 confidence: strong
209 type: pattern
210 values:
211 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
212 filter_type: GeneralPattern
213 required_substrings:
214 - akab-
215 min_line_len: 38
216 target:
217 - code
218 - doc
219
220- name: Amazon Bedrock API Key
221 severity: high
222 confidence: moderate
223 type: pattern
224 values:
225 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
226 filter_type: GeneralPattern
227 required_substrings:
228 - ABSK
229 - bedrock-api-key-
230 min_line_len: 44
231 target:
232 - code
233 - doc
234
235- name: AWS Client ID
236 severity: high
237 confidence: moderate
238 type: pattern
239 values:
240 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
241 filter_type: GeneralPattern
242 required_substrings:
243 - A3T
244 - ABIA
245 - ACCA
246 - AGPA
247 - AIDA
248 - AIPA
249 - AKIA
250 - ANPA
251 - ANVA
252 - AROA
253 - APKA
254 - ASCA
255 - ASIA
256 min_line_len: 20
257 required_regex: "[0-9A-Za-z_/+-]{15}"
258 target:
259 - code
260 - doc
261
262- name: AWS Multi
263 severity: high
264 confidence: moderate
265 type: multi
266 values:
267 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
268 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
269 filter_type:
270 - LineSpecificKeyCheck
271 - ValuePatternCheck
272 - ValueBase64PartCheck
273 - ValueMorphemesCheck
274 required_substrings:
275 - AKIA
276 - ASIA
277 min_line_len: 20
278 required_regex: "[0-9A-Za-z_/+-]{15}"
279 target:
280 - code
281 - doc
282
283- name: AWS MWS Key
284 severity: high
285 confidence: strong
286 type: pattern
287 values:
288 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
289 filter_type: GeneralPattern
290 required_substrings:
291 - amzn.mws.
292 min_line_len: 30
293 target:
294 - code
295 - doc
296
297- name: Dynatrace API Token
298 severity: high
299 confidence: moderate
300 type: pattern
301 values:
302 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
303 filter_type: TokenPattern
304 required_substrings:
305 - dt0
306 min_line_len: 90
307 target:
308 - code
309 - doc
310
311- name: Facebook Access Token
312 severity: high
313 confidence: moderate
314 type: pattern
315 values:
316 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
317 filter_type:
318 - ValuePatternCheck
319 - ValueBase64PartCheck
320 - ValueNotPartEncodedCheck
321 required_substrings:
322 - EAA
323 min_line_len: 80
324 target:
325 - code
326 - doc
327
328- name: Facebook App Token
329 severity: high
330 confidence: moderate
331 type: pattern
332 values:
333 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
334 filter_type: TokenPattern
335 required_substrings:
336 - "|"
337 required_regex: "[0-9A-Za-z_/+-]{15}"
338 min_line_len: 33
339 target:
340 - code
341 - doc
342
343- name: Google API Key
344 severity: high
345 confidence: moderate
346 type: pattern
347 values:
348 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
349 filter_type: TokenPattern
350 required_substrings:
351 - AIza
352 min_line_len: 39
353 target:
354 - code
355 - doc
356
357- name: Google Multi
358 severity: high
359 confidence: moderate
360 type: multi
361 values:
362 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
363 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
364 filter_type: GeneralPattern
365 required_substrings:
366 - .apps.googleusercontent.com
367 min_line_len: 40
368 target:
369 - code
370 - doc
371
372- name: Google OAuth Secret
373 severity: high
374 confidence: strong
375 type: pattern
376 values:
377 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
378 filter_type: TokenPattern
379 required_substrings:
380 - GOCSPX-
381 min_line_len: 40
382 target:
383 - code
384 - doc
385
386- name: Google OAuth Access Token
387 severity: high
388 confidence: moderate
389 type: pattern
390 values:
391 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
392 filter_type: TokenPattern
393 required_substrings:
394 - ya29.
395 min_line_len: 27
396 target:
397 - code
398 - doc
399
400- name: Google OAuth Refresh Token
401 severity: medium
402 confidence: weak
403 type: pattern
404 values:
405 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
406 filter_type: TokenPattern
407 required_substrings:
408 - 1//0
409 min_line_len: 84
410 target:
411 - code
412 - doc
413
414- name: Heroku Credentials
415 severity: high
416 confidence: strong
417 type: pattern
418 values:
419 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
420 filter_type: TokenPattern
421 required_substrings:
422 - HRKU-
423 min_line_len: 41
424 target:
425 - code
426 - doc
427
428- name: Instagram Access Token
429 severity: high
430 confidence: strong
431 type: pattern
432 values:
433 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
434 filter_type: TokenPattern
435 required_substrings:
436 - IGQVJ
437 min_line_len: 105
438 target:
439 - code
440 - doc
441
442- name: JSON Web Token
443 severity: medium
444 confidence: strong
445 type: pattern
446 values:
447 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
448 filter_type:
449 - ValueJsonWebTokenCheck
450 required_substrings:
451 - eyJ
452 min_line_len: 64
453 target:
454 - code
455 - doc
456
457- name: JSON Web Key
458 severity: medium
459 confidence: strong
460 type: pattern
461 values:
462 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
463 filter_type:
464 - ValueJsonWebKeyCheck
465 required_substrings:
466 - eyJ
467 - eyAi
468 - ewoi
469 - ewog
470 - ew0K
471 - WyJ
472 - W3si
473 - Wwp7
474 - Wwog
475 - Ww0K
476 - W3sK
477 min_line_len: 64
478 target:
479 - code
480 - doc
481
482- name: JWK
483 severity: medium
484 confidence: moderate
485 type: multi
486 values:
487 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
488 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
489 filter_type:
490 - ValuePatternCheck
491 - ValueMorphemesCheck
492 required_substrings:
493 - kty
494 min_line_len: 8
495 target:
496 - code
497 - doc
498
499- name: MailChimp API Key
500 severity: high
501 confidence: moderate
502 type: pattern
503 values:
504 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
505 filter_type: TokenPattern
506 required_substrings:
507 - -us
508 min_line_len: 35
509 target:
510 - code
511 - doc
512
513- name: MailGun API Key
514 severity: high
515 confidence: moderate
516 type: pattern
517 values:
518 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
519 filter_type: TokenPattern
520 required_regex: "[0-9A-Za-z_/+-]{15}"
521 min_line_len: 36
522 target:
523 - code
524 - doc
525
526- name: PayPal Braintree Access Token
527 severity: high
528 confidence: strong
529 type: pattern
530 values:
531 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
532 filter_type: GeneralPattern
533 required_substrings:
534 - access_token$production$
535 min_line_len: 72
536 target:
537 - code
538 - doc
539
540- name: PEM Private Key
541 severity: high
542 confidence: strong
543 type: pem_key
544 values:
545 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
546 min_line_len: 27
547 target:
548 - code
549 - doc
550
551- name: BASE64 encoded PEM Private Key
552 severity: high
553 confidence: strong
554 type: pattern
555 values:
556 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
557 filter_type:
558 - ValueBase64EncodedPem
559 min_line_len: 300
560 required_substrings:
561 - UFJJVkFURSBLRVkt
562 - QUklWQVRFIEtFWS0t
563 - FBSSVZBVEUgS0VZ
564 target:
565 - code
566 - doc
567
568- name: BASE64 Private Key
569 severity: high
570 confidence: strong
571 type: pattern
572 values:
573 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
574 filter_type:
575 - ValueBase64KeyCheck
576 min_line_len: 160
577 required_substrings:
578 - MII
579 target:
580 - code
581 - doc
582
583- name: Picatic API Key
584 severity: high
585 confidence: strong
586 type: pattern
587 values:
588 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
589 filter_type: GeneralPattern
590 required_substrings:
591 - sk_live_
592 min_line_len: 40
593 target:
594 - code
595 - doc
596
597- name: SendGrid API Key
598 severity: high
599 confidence: moderate
600 type: pattern
601 values:
602 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
603 filter_type: TokenPattern
604 required_substrings:
605 - SG.
606 min_line_len: 34
607 target:
608 - code
609 - doc
610
611- name: Clojars Deploy Token
612 severity: high
613 confidence: strong
614 type: pattern
615 values:
616 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
617 filter_type: TokenPattern
618 required_substrings:
619 - CLOJARS_
620 min_line_len: 68
621 target:
622 - code
623 - doc
624
625- name: Shopify Token
626 severity: high
627 confidence: strong
628 type: pattern
629 values:
630 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
631 filter_type: TokenPattern
632 required_substrings:
633 - shp
634 min_line_len: 38
635 target:
636 - code
637 - doc
638
639- name: Slack Token
640 severity: high
641 confidence: strong
642 type: pattern
643 values:
644 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
645 filter_type: TokenPattern
646 required_substrings:
647 - xox
648 - xapp
649 min_line_len: 15
650 target:
651 - code
652 - doc
653
654- name: Slack Webhook
655 severity: medium
656 confidence: strong
657 type: pattern
658 values:
659 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
660 filter_type: GeneralPattern
661 required_substrings:
662 - hooks.slack.com/services/T
663 min_line_len: 61
664 target:
665 - code
666 - doc
667
668- name: Stripe Credentials
669 severity: high
670 confidence: strong
671 type: pattern
672 values:
673 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
674 filter_type: GeneralPattern
675 required_substrings:
676 - k_live_
677 - k_test_
678 - whsec_
679 min_line_len: 32
680 target:
681 - code
682 - doc
683
684- name: Square Access Token
685 severity: high
686 confidence: moderate
687 type: pattern
688 values:
689 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
690 filter_type:
691 - ValuePatternCheck
692 - ValueBase64PartCheck
693 required_substrings:
694 - EAAA
695 min_line_len: 64
696 target:
697 - code
698 - doc
699
700- name: Square Credentials
701 severity: medium
702 confidence: strong
703 type: pattern
704 values:
705 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
706 filter_type: TokenPattern
707 required_substrings:
708 - sq0
709 min_line_len: 29
710 target:
711 - code
712 - doc
713
714- name: Twilio Credentials
715 severity: high
716 confidence: moderate
717 type: pattern
718 values:
719 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
720 filter_type: TokenPattern
721 required_substrings:
722 - AC
723 - AD
724 - AL
725 - CA
726 - CF
727 - CL
728 - CN
729 - CR
730 - FW
731 - IP
732 - KS
733 - MM
734 - "NO"
735 - PK
736 - PN
737 - QU
738 - RE
739 - SC
740 - SD
741 - SK
742 - SM
743 - TR
744 - UT
745 - XE
746 - XR
747 min_line_len: 34
748 target:
749 - code
750 - doc
751
752- name: Telegram Bot API Token
753 severity: high
754 confidence: moderate
755 type: pattern
756 values:
757 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
758 filter_type: TokenPattern
759 required_substrings:
760 - :AA
761 min_line_len: 45
762 target:
763 - code
764 - doc
765
766- name: PyPi API Token
767 severity: high
768 confidence: strong
769 type: pattern
770 values:
771 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
772 filter_type: TokenPattern
773 required_substrings:
774 - pypi-
775 min_line_len: 155
776 target:
777 - code
778 - doc
779
780- name: NPM Token
781 severity: high
782 confidence: strong
783 type: pattern
784 values:
785 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
786 filter_type:
787 - ValueGitHubCheck
788 required_substrings:
789 - npm_
790 min_line_len: 40
791 target:
792 - code
793 - doc
794
795- name: Github App Installation Token
796 severity: high
797 confidence: strong
798 type: pattern
799 values:
800 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
801 filter_type:
802 - ValuePatternCheck
803 required_substrings:
804 - ghs_
805 min_line_len: 40
806 target:
807 - code
808 - doc
809
810- name: Github Classic Token
811 severity: high
812 confidence: strong
813 type: pattern
814 values:
815 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
816 filter_type:
817 - ValueGitHubCheck
818 required_substrings:
819 - ghp_
820 - gho_
821 - ghu_
822 - ghs_
823 - ghr_
824 min_line_len: 40
825 target:
826 - code
827 - doc
828
829- name: Github Fine-granted Token
830 severity: high
831 confidence: strong
832 type: pattern
833 values:
834 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
835 filter_type: GeneralPattern
836 required_substrings:
837 - github_pat_
838 min_line_len: 90
839 target:
840 - code
841 - doc
842
843- name: Firebase Domain
844 severity: info
845 confidence: moderate
846 type: pattern
847 values:
848 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
849 filter_type: GeneralPattern
850 required_substrings:
851 - .firebase
852 min_line_len: 16
853 target:
854 - code
855 - doc
856
857- name: AWS S3 Bucket
858 severity: info
859 confidence: moderate
860 type: pattern
861 values:
862 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
863 filter_type: GeneralPattern
864 required_substrings:
865 - .s3-website
866 - .s3.amazonaws.com
867 min_line_len: 14
868 target:
869 - code
870 - doc
871
872- name: Jfrog Token
873 severity: high
874 confidence: strong
875 type: pattern
876 values:
877 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
878 filter_type:
879 - ValueJfrogTokenCheck
880 required_substrings:
881 - cmVmdGtuO
882 - AKCp
883 min_line_len: 64
884 target:
885 - code
886 - doc
887
888- name: Azure Access Token
889 severity: high
890 confidence: strong
891 type: pattern
892 values:
893 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
894 filter_type:
895 - ValueAzureTokenCheck
896 required_substrings:
897 - eyJ
898 min_line_len: 148
899 target:
900 - code
901 - doc
902
903- name: Azure Secret Value
904 severity: high
905 confidence: moderate
906 type: pattern
907 values:
908 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
909 filter_type: TokenPattern
910 min_line_len: 40
911 required_substrings:
912 - 8Q~
913 target:
914 - code
915 - doc
916
917- name: Azure Storage Account Key
918 severity: high
919 confidence: moderate
920 type: pattern
921 values:
922 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
923 min_line_len: 80
924 filter_type:
925 - ValuePatternCheck(17)
926 required_substrings:
927 - JQQJ99
928 - JQQJ9D
929 - JQQJ9H
930 target:
931 - code
932 - doc
933
934- name: Bitbucket App Password
935 severity: high
936 confidence: strong
937 type: pattern
938 values:
939 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
940 filter_type:
941 - ValueAtlassianTokenCheck
942 min_line_len: 28
943 required_substrings:
944 - ATBB
945 target:
946 - code
947 - doc
948
949- name: Bitbucket Repository Access Token
950 severity: high
951 confidence: strong
952 type: pattern
953 values:
954 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
955 filter_type:
956 - ValueAtlassianTokenCheck
957 min_line_len: 160
958 required_substrings:
959 - ATCTT3xFfGN0
960 target:
961 - code
962 - doc
963
964- name: Bitbucket HTTP Access Token
965 severity: high
966 confidence: strong
967 type: pattern
968 values:
969 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
970 filter_type:
971 - ValueAtlassianTokenCheck
972 min_line_len: 49
973 required_substrings:
974 - BBDC-
975 target:
976 - code
977 - doc
978
979- name: Jira / Confluence PAT token
980 severity: high
981 confidence: strong
982 type: pattern
983 values:
984 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
985 filter_type:
986 - ValueAtlassianTokenCheck
987 min_line_len: 44
988 required_substrings:
989 - M
990 - N
991 - O
992 required_regex: "[0-9A-Za-z_/+-]{15}"
993 target:
994 - code
995 - doc
996
997- name: Atlassian PAT token
998 severity: high
999 confidence: strong
1000 type: pattern
1001 values:
1002 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1003 filter_type:
1004 - ValueAtlassianTokenCheck
1005 min_line_len: 160
1006 required_substrings:
1007 - ATATT3xFfGF0
1008 target:
1009 - code
1010 - doc
1011
1012- name: Digital Ocean Token
1013 severity: high
1014 confidence: strong
1015 type: pattern
1016 values:
1017 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1018 filter_type: TokenPattern
1019 min_line_len: 71
1020 required_substrings:
1021 - doo_v1_
1022 - dop_v1_
1023 - dor_v1_
1024 target:
1025 - code
1026 - doc
1027
1028- name: Dropbox OAuth2 API Access Token
1029 severity: high
1030 confidence: moderate
1031 type: pattern
1032 values:
1033 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1034 filter_type: TokenPattern
1035 min_line_len: 80
1036 required_substrings:
1037 - sl.
1038 target:
1039 - code
1040 - doc
1041
1042- name: NuGet API key
1043 severity: high
1044 confidence: moderate
1045 type: pattern
1046 values:
1047 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1048 filter_type: TokenPattern
1049 min_line_len: 46
1050 required_substrings:
1051 - oy2
1052 target:
1053 - code
1054 - doc
1055
1056- name: Gitlab Prefix Token
1057 severity: high
1058 confidence: strong
1059 type: pattern
1060 values:
1061 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1062 filter_type:
1063 - ValuePatternCheck
1064 min_line_len: 25
1065 required_substrings:
1066 - _gitlab_session=
1067 - GR1348941
1068 - glagent-
1069 - glsoat-
1070 - glffct-
1071 - glpat-
1072 - gloas-
1073 - glptt-
1074 - glcbt-
1075 - glimt-
1076 - gldt-
1077 - glft-
1078 - glrt-
1079 - glrtr-
1080 - glwt-
1081 target:
1082 - code
1083 - doc
1084
1085- name: Grafana Provisioned API Key
1086 severity: high
1087 confidence: strong
1088 type: pattern
1089 values:
1090 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1091 filter_type:
1092 - ValueGrafanaCheck
1093 min_line_len: 67
1094 required_substrings:
1095 - eyJ
1096 target:
1097 - code
1098 - doc
1099
1100- name: Grafana Access Policy Token
1101 severity: high
1102 confidence: strong
1103 type: pattern
1104 values:
1105 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1106 filter_type:
1107 - ValueGrafanaCheck
1108 min_line_len: 87
1109 required_substrings:
1110 - glc_eyJ
1111 target:
1112 - code
1113 - doc
1114
1115- name: Grafana Service Account Token
1116 severity: high
1117 confidence: strong
1118 type: pattern
1119 values:
1120 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1121 min_line_len: 46
1122 filter_type:
1123 - ValueGrafanaServiceCheck
1124 required_substrings:
1125 - glsa_
1126 target:
1127 - code
1128 - doc
1129
1130- name: Dropbox API secret (long term)
1131 severity: high
1132 confidence: weak
1133 type: pattern
1134 values:
1135 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1136 filter_type: [ ]
1137 min_line_len: 43
1138 required_substrings:
1139 - AAAAAAAAAA
1140 target:
1141 - code
1142 - doc
1143
1144- name: Dropbox App secret
1145 severity: info
1146 confidence: weak
1147 type: pattern
1148 values:
1149 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1150 filter_type: WeirdBase36Token
1151 min_line_len: 15
1152 required_regex: "[0-9A-Za-z_/+-]{15}"
1153 target:
1154 - code
1155 - doc
1156
1157- name: Hashicorp Vault Token
1158 severity: high
1159 confidence: strong
1160 type: pattern
1161 values:
1162 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1163 filter_type:
1164 - ValuePatternCheck
1165 - ValueEntropyBase64Check
1166 min_line_len: 90
1167 required_substrings:
1168 - hvb.
1169 - hvr.
1170 - hvs.
1171 target:
1172 - code
1173 - doc
1174
1175- name: Hashicorp Terraform Token
1176 severity: high
1177 confidence: strong
1178 type: pattern
1179 values:
1180 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1181 filter_type:
1182 - ValuePatternCheck
1183 - ValueMorphemesCheck
1184 min_line_len: 90
1185 required_substrings:
1186 - .atlasv1.
1187 target:
1188 - code
1189 - doc
1190
1191- name: NKEY Seed
1192 severity: high
1193 confidence: weak
1194 type: pattern
1195 values:
1196 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1197 min_line_len: 42
1198 filter_type:
1199 - ValueMorphemesCheck
1200 - ValuePatternCheck
1201 - ValueEntropyBase32Check
1202 - ValueBase32DataCheck
1203 - ValueTokenBase32Check
1204 required_substrings:
1205 - SA
1206 - SC
1207 - SN
1208 - SO
1209 - SP
1210 - SU
1211 - SX
1212 required_regex: "[0-9A-Za-z_/+-]{15}"
1213 target:
1214 - code
1215 - doc
1216
1217- name: OTP / 2FA Secret
1218 severity: info
1219 confidence: weak
1220 type: pattern
1221 values:
1222 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1223 filter_type:
1224 - ValueMorphemesCheck
1225 - ValuePatternCheck
1226 - ValueEntropyBase32Check
1227 - ValueBase32DataCheck
1228 - ValueTokenBase32Check
1229 - ValueBase64PartCheck
1230 min_line_len: 16
1231 required_regex: "[0-9A-Za-z_/+-]{15}"
1232 target:
1233 - code
1234 - doc
1235
1236- name: OpenAI Token
1237 severity: high
1238 confidence: strong
1239 type: pattern
1240 values:
1241 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1242 min_line_len: 51
1243 filter_type:
1244 - ValuePatternCheck
1245 - ValueMorphemesCheck
1246 required_substrings:
1247 - T3BlbkFJ
1248 - 9wZW5BS
1249 - PcGVuQU
1250 target:
1251 - code
1252 - doc
1253
1254- name: Docker Access Token
1255 severity: high
1256 confidence: strong
1257 type: pattern
1258 values:
1259 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1260 min_line_len: 36
1261 filter_type:
1262 - ValuePatternCheck
1263 - ValueMorphemesCheck
1264 required_substrings:
1265 - dckr_pat_
1266 - dckr_oat_
1267 target:
1268 - code
1269 - doc
1270
1271- name: Docker Swarm Token
1272 severity: high
1273 confidence: strong
1274 type: pattern
1275 values:
1276 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1277 min_line_len: 85
1278 filter_type:
1279 - ValuePatternCheck
1280 - ValueMorphemesCheck
1281 required_substrings:
1282 - SWMTKN-1-
1283 target:
1284 - code
1285 - doc
1286
1287- name: Docker Swarm Key
1288 severity: high
1289 confidence: strong
1290 type: pattern
1291 values:
1292 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1293 min_line_len: 52
1294 filter_type:
1295 - ValuePatternCheck
1296 - ValueMorphemesCheck
1297 required_substrings:
1298 - SWMKEY-1-
1299 target:
1300 - code
1301 - doc
1302
1303- name: Groq API Key
1304 severity: high
1305 confidence: strong
1306 type: pattern
1307 values:
1308 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1309 min_line_len: 56
1310 filter_type:
1311 - ValuePatternCheck
1312 required_substrings:
1313 - WGdyb3FY
1314 - hncm9xW
1315 - YZ3JvcV
1316 target:
1317 - code
1318 - doc
1319
1320- name: X AI API Key
1321 severity: high
1322 confidence: moderate
1323 type: pattern
1324 values:
1325 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1326 min_line_len: 84
1327 filter_type:
1328 - ValuePatternCheck
1329 - ValueEntropyBase64Check
1330 required_substrings:
1331 - xai-
1332 target:
1333 - code
1334 - doc
1335
1336- name: Notion Integration Token
1337 severity: high
1338 confidence: strong
1339 type: pattern
1340 values:
1341 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1342 filter_type:
1343 - ValuePatternCheck
1344 - ValueEntropyBase64Check
1345 required_substrings:
1346 - ntn_
1347 min_line_len: 50
1348 target:
1349 - code
1350 - doc
1351
1352- name: Hugging Face User Access Token
1353 severity: high
1354 confidence: moderate
1355 type: pattern
1356 values:
1357 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1358 min_line_len: 37
1359 filter_type:
1360 - ValuePatternCheck
1361 - ValueEntropyBase64Check
1362 required_substrings:
1363 - hf_
1364 target:
1365 - code
1366 - doc
1367
1368- name: Anthropic API Key
1369 severity: high
1370 confidence: strong
1371 type: pattern
1372 values:
1373 - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1374 min_line_len: 77
1375 filter_type:
1376 - ValuePatternCheck
1377 required_substrings:
1378 - sk-ant-api03-
1379 target:
1380 - code
1381 - doc
1382
1383- name: Perplexity API Key
1384 severity: high
1385 confidence: strong
1386 type: pattern
1387 values:
1388 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1389 min_line_len: 45
1390 filter_type:
1391 - ValuePatternCheck
1392 required_substrings:
1393 - pplx-
1394 target:
1395 - code
1396 - doc
1397
1398- name: DeepSeek API Key
1399 severity: high
1400 confidence: moderate
1401 type: pattern
1402 values:
1403 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1404 min_line_len: 35
1405 filter_type:
1406 - ValuePatternCheck
1407 required_substrings:
1408 - sk-
1409 target:
1410 - code
1411 - doc
1412
1413- name: Tavily API Key
1414 severity: high
1415 confidence: strong
1416 type: pattern
1417 values:
1418 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1419 min_line_len: 37
1420 filter_type:
1421 - ValuePatternCheck
1422 required_substrings:
1423 - tvly-
1424 target:
1425 - code
1426 - doc
1427
1428- name: Figma Personal Access Token
1429 severity: high
1430 confidence: strong
1431 type: pattern
1432 values:
1433 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1434 min_line_len: 45
1435 filter_type:
1436 - ValuePatternCheck
1437 required_substrings:
1438 - figd_
1439 target:
1440 - code
1441 - doc
1442
1443- name: 1Password Account Token
1444 severity: high
1445 confidence: strong
1446 type: pattern
1447 values:
1448 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1449 min_line_len: 192
1450 filter_type:
1451 - ValuePatternCheck
1452 required_substrings:
1453 - InNlY3JldEtleSI6
1454 - JzZWNyZXRLZXkiO
1455 - ic2VjcmV0S2V5Ij
1456 target:
1457 - code
1458 - doc
1459
1460- name: Brevo API Key
1461 severity: high
1462 confidence: strong
1463 type: pattern
1464 values:
1465 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1466 min_line_len: 89
1467 filter_type:
1468 - ValuePatternCheck
1469 required_substrings:
1470 - xkeysib-
1471 target:
1472 - code
1473 - doc
1474
1475- name: Together AI API Key
1476 severity: high
1477 confidence: strong
1478 type: pattern
1479 values:
1480 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1481 min_line_len: 50
1482 filter_type:
1483 - ValuePatternCheck
1484 required_substrings:
1485 - tgp_v1_
1486 target:
1487 - code
1488 - doc
1489
1490- name: LLAMA API Key
1491 severity: high
1492 confidence: strong
1493 type: pattern
1494 values:
1495 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1496 min_line_len: 52
1497 filter_type:
1498 - ValuePatternCheck
1499 required_substrings:
1500 - llx-
1501 target:
1502 - code
1503 - doc
1504
1505- name: SonarQube Credentials
1506 severity: medium
1507 confidence: moderate
1508 type: pattern
1509 values:
1510 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1511 min_line_len: 44
1512 filter_type:
1513 - ValuePatternCheck
1514 required_substrings:
1515 - sqa_
1516 - sqp_
1517 - squ_
1518 target:
1519 - code
1520 - doc
1521
1522- name: Sentry Organization Auth Token
1523 severity: high
1524 confidence: strong
1525 type: pattern
1526 values:
1527 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1528 min_line_len: 37
1529 filter_type:
1530 - ValuePatternCheck
1531 required_substrings:
1532 - sntrys_eyJ
1533 target:
1534 - code
1535 - doc
1536
1537- name: Sentry User Auth Token
1538 severity: high
1539 confidence: strong
1540 type: pattern
1541 values:
1542 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1543 min_line_len: 37
1544 filter_type:
1545 - ValuePatternCheck
1546 required_substrings:
1547 - sntryu_
1548 target:
1549 - code
1550 - doc
1551
1552- name: Discord Bot Token
1553 severity: high
1554 confidence: strong
1555 type: pattern
1556 values:
1557 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1558 min_line_len: 62
1559 filter_type:
1560 - ValueDiscordBotCheck
1561 required_substrings:
1562 - M
1563 - N
1564 - O
1565 required_regex: "[0-9A-Za-z_/+-]{15}"
1566 target:
1567 - code
1568 - doc
1569
1570- name: Discord Webhook
1571 severity: medium
1572 confidence: strong
1573 type: pattern
1574 values:
1575 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1576 filter_type:
1577 - ValueMorphemesCheck
1578 required_substrings:
1579 - discordapp.com/api/webhooks
1580 - discord.com/api/webhooks
1581 min_line_len: 61
1582 target:
1583 - code
1584 - doc
1585
1586- name: Vercel Token
1587 severity: medium
1588 confidence: weak
1589 type: pattern
1590 values:
1591 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
1592 min_line_len: 60
1593 filter_type: TokenPattern
1594 required_substrings:
1595 - vcp_
1596 target:
1597 - code
1598 - doc
1599
1600- name: Netlify Token
1601 severity: medium
1602 confidence: weak
1603 type: pattern
1604 values:
1605 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
1606 min_line_len: 40
1607 filter_type: TokenPattern
1608 required_substrings:
1609 - nfp_
1610 target:
1611 - code
1612 - doc
1613
1614- name: PostHog Credentials
1615 severity: medium
1616 confidence: weak
1617 type: pattern
1618 values:
1619 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
1620 min_line_len: 44
1621 filter_type: TokenPattern
1622 required_substrings:
1623 - phx_
1624 - phs_
1625 - phr_
1626 - pha_
1627 - phc_
1628 target:
1629 - code
1630 - doc
1631
1632- name: RubyGems API Key
1633 severity: medium
1634 confidence: strong
1635 type: pattern
1636 values:
1637 - (?P<value>rubygems_[0-9a-f]{48})
1638 min_line_len: 57
1639 filter_type: TokenPattern
1640 required_substrings:
1641 - rubygems_
1642 target:
1643 - code
1644 - doc
1645
1646- name: Databricks Access Token
1647 severity: medium
1648 confidence: strong
1649 type: pattern
1650 values:
1651 - (?P<value>dapi[0-9a-f]{32})
1652 min_line_len: 36
1653 filter_type: TokenPattern
1654 required_substrings:
1655 - dapi
1656 target:
1657 - code
1658 - doc
1659
1660- name: Tencent WeChat API App ID
1661 severity: medium
1662 confidence: weak
1663 type: pattern
1664 values:
1665 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1666 min_line_len: 18
1667 filter_type: TokenPattern
1668 required_substrings:
1669 - wx
1670 target:
1671 - code
1672 - doc
1673
1674- name: Salesforce Credentials
1675 severity: medium
1676 confidence: weak
1677 type: pattern
1678 values:
1679 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1680 min_line_len: 12
1681 filter_type:
1682 - ValuePatternCheck(9)
1683 - ValueNumberCheck
1684 - ValueBase64PartCheck
1685 required_substrings:
1686 - 00D
1687 - 3MVG
1688 target:
1689 - code
1690 - doc
1691
1692- name: Postman Credentials
1693 severity: medium
1694 confidence: moderate
1695 type: pattern
1696 values:
1697 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1698 min_line_len: 29
1699 filter_type:
1700 - ValuePatternCheck
1701 required_substrings:
1702 - PMAK-
1703 - PMAT-
1704 target:
1705 - code
1706 - doc
1707
1708- name: NTLM Token
1709 severity: medium
1710 confidence: strong
1711 type: pattern
1712 values:
1713 - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1714 filter_type:
1715 - ValueMorphemesCheck(2)
1716 - ValuePatternCheck
1717 min_line_len: 160
1718 required_substrings:
1719 - TlRMTVNTUAADAAAA
1720 target:
1721 - doc
1722 - code
1723
1724- name: Basic Authorization
1725 severity: medium
1726 confidence: strong
1727 type: pattern
1728 values:
1729 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1730 min_line_len: 18
1731 filter_type:
1732 - ValueBasicAuthCheck
1733 required_substrings:
1734 - basic
1735 target:
1736 - code
1737 - doc
1738
1739- name: Bearer Authorization
1740 severity: medium
1741 confidence: moderate
1742 type: pattern
1743 values:
1744 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1745 min_line_len: 37
1746 filter_type: GeneralKeyword
1747 required_substrings:
1748 - bearer
1749 - ntlm
1750 target:
1751 - code
1752 - doc
1753
1754- name: SQL Password
1755 severity: medium
1756 confidence: weak
1757 type: pattern
1758 values:
1759 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1760 filter_type:
1761 - ValueAllowlistCheck
1762 - ValuePatternCheck
1763 use_ml: true
1764 min_line_len: 8
1765 required_substrings:
1766 - password
1767 - identified
1768 target:
1769 - doc
1770 - code
1771
1772- name: CURL User Password
1773 severity: high
1774 confidence: moderate
1775 type: pattern
1776 values:
1777 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1778 filter_type: GeneralKeyword
1779 use_ml: true
1780 required_substrings:
1781 - curl
1782 min_line_len: 16
1783 target:
1784 - doc
1785 - code
1786
1787- name: CMD ConvertTo-SecureString
1788 severity: high
1789 confidence: moderate
1790 type: pattern
1791 values:
1792 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1793 filter_type: GeneralKeyword
1794 use_ml: true
1795 required_substrings:
1796 - convertto-securestring
1797 min_line_len: 27
1798 target:
1799 - doc
1800 - code
1801
1802- name: CMD Password
1803 severity: high
1804 confidence: moderate
1805 type: pattern
1806 values:
1807 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1808 filter_type: GeneralKeyword
1809 use_ml: true
1810 required_substrings:
1811 - pass
1812 min_line_len: 12
1813 target:
1814 - doc
1815 - code
1816
1817- name: CMD Token
1818 severity: high
1819 confidence: moderate
1820 type: pattern
1821 values:
1822 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1823 filter_type: GeneralKeyword
1824 use_ml: true
1825 required_substrings:
1826 - token
1827 - oauth2-bearer
1828 min_line_len: 12
1829 target:
1830 - doc
1831 - code
1832
1833- name: CMD Secret
1834 severity: high
1835 confidence: moderate
1836 type: pattern
1837 values:
1838 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1839 filter_type: GeneralKeyword
1840 use_ml: true
1841 required_substrings:
1842 - secret
1843 min_line_len: 12
1844 target:
1845 - doc
1846 - code
1847
1848- name: URL Credentials
1849 severity: high
1850 confidence: moderate
1851 type: pattern
1852 values:
1853 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
1854 filter_type: UrlCredentialsGroup
1855 use_ml: true
1856 required_substrings:
1857 - ://
1858 min_line_len: 10
1859 target:
1860 - doc
1861 - code
1862
1863- name: API
1864 severity: low
1865 confidence: moderate
1866 type: keyword
1867 values:
1868 - api(?!tal)
1869 filter_type: GeneralKeyword
1870 use_ml: true
1871 min_line_len: 11
1872 required_substrings:
1873 - api
1874 target:
1875 - code
1876
1877- name: Auth
1878 severity: medium
1879 confidence: moderate
1880 type: keyword
1881 values:
1882 - auth(?!ors?(?!i[tz]))
1883 filter_type: GeneralKeyword
1884 use_ml: true
1885 min_line_len: 12
1886 required_substrings:
1887 - auth
1888 target:
1889 - code
1890
1891- name: Credential
1892 severity: medium
1893 confidence: moderate
1894 type: keyword
1895 values:
1896 - credential
1897 filter_type: GeneralKeyword
1898 use_ml: true
1899 min_line_len: 18
1900 required_substrings:
1901 - credential
1902 target:
1903 - code
1904
1905- name: Key
1906 severity: high
1907 confidence: moderate
1908 type: keyword
1909 values:
1910 - key(?!word|board|pad|name)
1911 filter_type: GeneralKeyword
1912 use_ml: true
1913 min_line_len: 11
1914 required_substrings:
1915 - key
1916 target:
1917 - code
1918
1919- name: Nonce
1920 severity: low
1921 confidence: moderate
1922 type: keyword
1923 values:
1924 - (?<!\\)nonce
1925 filter_type: GeneralKeyword
1926 use_ml: true
1927 min_line_len: 13
1928 required_substrings:
1929 - nonce
1930 target:
1931 - code
1932
1933- name: Password
1934 severity: high
1935 confidence: moderate
1936 type: keyword
1937 values:
1938 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
1939 filter_type: PasswordKeyword
1940 use_ml: true
1941 min_line_len: 10
1942 required_substrings:
1943 - pass
1944 - pasw
1945 - pssw
1946 - psw
1947 - pw
1948 target:
1949 - code
1950
1951- name: Salt
1952 severity: low
1953 confidence: moderate
1954 type: keyword
1955 values:
1956 - salt
1957 filter_type: GeneralKeyword
1958 use_ml: true
1959 min_line_len: 12
1960 required_substrings:
1961 - salt
1962 target:
1963 - code
1964
1965- name: Secret
1966 severity: medium
1967 confidence: moderate
1968 type: keyword
1969 values:
1970 - secret
1971 filter_type: GeneralKeyword
1972 use_ml: true
1973 min_line_len: 14
1974 required_substrings:
1975 - secret
1976 target:
1977 - code
1978
1979- name: Token
1980 severity: high
1981 confidence: moderate
1982 type: keyword
1983 values:
1984 - token(?!ize)
1985 filter_type: GeneralKeyword
1986 use_ml: true
1987 min_line_len: 13
1988 required_substrings:
1989 - token
1990 target:
1991 - code