1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 target:
30 - doc
31 use_ml: true
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 target:
66 - doc
67 use_ml: true
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 target:
90 - doc
91 use_ml: true
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 target:
121 - doc
122 use_ml: true
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 target:
138 - doc
139 use_ml: true
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 target:
163 - doc
164 use_ml: true
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 target:
187 - doc
188 use_ml: true
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 min_line_len: 36
197 required_substrings:
198 - "-"
199 filter_type:
200 - ValuePatternCheck(4)
201 use_ml: false
202 target:
203 - code
204 - doc
205
206- name: Akamai Credentials
207 severity: high
208 confidence: strong
209 type: pattern
210 values:
211 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
212 filter_type: GeneralPattern
213 required_substrings:
214 - akab-
215 min_line_len: 38
216 target:
217 - code
218 - doc
219
220- name: Amazon Bedrock API Key
221 severity: high
222 confidence: moderate
223 type: pattern
224 values:
225 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
226 filter_type: GeneralPattern
227 required_substrings:
228 - ABSK
229 - bedrock-api-key-
230 min_line_len: 44
231 target:
232 - code
233 - doc
234
235- name: AWS Client ID
236 severity: high
237 confidence: moderate
238 type: pattern
239 values:
240 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
241 filter_type: GeneralPattern
242 required_substrings:
243 - A3T
244 - ABIA
245 - ACCA
246 - AGPA
247 - AIDA
248 - AIPA
249 - AKIA
250 - ANPA
251 - ANVA
252 - AROA
253 - APKA
254 - ASCA
255 - ASIA
256 min_line_len: 20
257 required_regex: "[0-9A-Za-z_/+-]{15}"
258 target:
259 - code
260 - doc
261
262- name: AWS Multi
263 severity: high
264 confidence: moderate
265 type: multi
266 values:
267 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
268 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
269 filter_type:
270 - LineSpecificKeyCheck
271 - ValuePatternCheck
272 - ValueBase64PartCheck
273 - ValueMorphemesCheck
274 required_substrings:
275 - AKIA
276 - ASIA
277 min_line_len: 20
278 required_regex: "[0-9A-Za-z_/+-]{15}"
279 target:
280 - code
281 - doc
282
283- name: AWS MWS Key
284 severity: high
285 confidence: strong
286 type: pattern
287 values:
288 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
289 filter_type: GeneralPattern
290 required_substrings:
291 - amzn.mws.
292 min_line_len: 30
293 target:
294 - code
295 - doc
296
297- name: Dynatrace API Token
298 severity: high
299 confidence: moderate
300 type: pattern
301 values:
302 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
303 filter_type: TokenPattern
304 required_substrings:
305 - dt0
306 min_line_len: 90
307 target:
308 - code
309 - doc
310
311- name: Facebook Access Token
312 severity: high
313 confidence: moderate
314 type: pattern
315 values:
316 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
317 filter_type:
318 - ValuePatternCheck
319 - ValueBase64PartCheck
320 - ValueNotPartEncodedCheck
321 required_substrings:
322 - EAA
323 min_line_len: 80
324 target:
325 - code
326 - doc
327
328- name: Facebook App Token
329 severity: high
330 confidence: moderate
331 type: pattern
332 values:
333 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
334 filter_type: TokenPattern
335 required_substrings:
336 - "|"
337 required_regex: "[0-9A-Za-z_/+-]{15}"
338 min_line_len: 33
339 target:
340 - code
341 - doc
342
343- name: Google API Key
344 severity: high
345 confidence: moderate
346 type: pattern
347 values:
348 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
349 filter_type: TokenPattern
350 required_substrings:
351 - AIza
352 min_line_len: 39
353 target:
354 - code
355 - doc
356
357- name: Google Multi
358 severity: high
359 confidence: moderate
360 type: multi
361 values:
362 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
363 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
364 filter_type: GeneralPattern
365 required_substrings:
366 - .apps.googleusercontent.com
367 min_line_len: 40
368 target:
369 - code
370 - doc
371
372- name: Google OAuth Secret
373 severity: high
374 confidence: strong
375 type: pattern
376 values:
377 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
378 filter_type: TokenPattern
379 required_substrings:
380 - GOCSPX-
381 min_line_len: 40
382 target:
383 - code
384 - doc
385
386- name: Google OAuth Access Token
387 severity: high
388 confidence: moderate
389 type: pattern
390 values:
391 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
392 filter_type: TokenPattern
393 required_substrings:
394 - ya29.
395 min_line_len: 27
396 target:
397 - code
398 - doc
399
400- name: Google OAuth Refresh Token
401 severity: medium
402 confidence: weak
403 type: pattern
404 values:
405 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
406 filter_type: TokenPattern
407 required_substrings:
408 - 1//0
409 min_line_len: 84
410 target:
411 - code
412 - doc
413
414- name: Heroku Credentials
415 severity: high
416 confidence: strong
417 type: pattern
418 values:
419 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
420 filter_type: TokenPattern
421 required_substrings:
422 - HRKU-
423 min_line_len: 41
424 target:
425 - code
426 - doc
427
428- name: Instagram Access Token
429 severity: high
430 confidence: strong
431 type: pattern
432 values:
433 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
434 filter_type: TokenPattern
435 required_substrings:
436 - IGQVJ
437 min_line_len: 105
438 target:
439 - code
440 - doc
441
442- name: JSON Web Token
443 severity: medium
444 confidence: strong
445 type: pattern
446 values:
447 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
448 filter_type:
449 - ValueJsonWebTokenCheck
450 required_substrings:
451 - eyJ
452 min_line_len: 64
453 target:
454 - code
455 - doc
456
457- name: JSON Web Key
458 severity: medium
459 confidence: strong
460 type: pattern
461 values:
462 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
463 filter_type:
464 - ValueJsonWebKeyCheck
465 required_substrings:
466 - eyJ
467 - eyAi
468 - ewoi
469 - ewog
470 - ew0K
471 - WyJ
472 - W3si
473 - Wwp7
474 - Wwog
475 - Ww0K
476 - W3sK
477 min_line_len: 64
478 target:
479 - code
480 - doc
481
482- name: JWK
483 severity: medium
484 confidence: moderate
485 type: multi
486 values:
487 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
488 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
489 filter_type:
490 - ValuePatternCheck
491 - ValueMorphemesCheck
492 required_substrings:
493 - kty
494 min_line_len: 8
495 target:
496 - code
497 - doc
498
499- name: MailChimp API Key
500 severity: high
501 confidence: moderate
502 type: pattern
503 values:
504 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
505 filter_type: TokenPattern
506 required_substrings:
507 - -us
508 min_line_len: 35
509 target:
510 - code
511 - doc
512
513- name: MailGun API Key
514 severity: high
515 confidence: moderate
516 type: pattern
517 values:
518 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
519 filter_type: TokenPattern
520 required_regex: "[0-9A-Za-z_/+-]{15}"
521 min_line_len: 36
522 target:
523 - code
524 - doc
525
526- name: PayPal Braintree Access Token
527 severity: high
528 confidence: strong
529 type: pattern
530 values:
531 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
532 filter_type: GeneralPattern
533 required_substrings:
534 - access_token$production$
535 min_line_len: 72
536 target:
537 - code
538 - doc
539
540- name: PEM Private Key
541 severity: high
542 confidence: strong
543 type: pem_key
544 values:
545 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
546 min_line_len: 27
547 target:
548 - code
549 - doc
550
551- name: BASE64 encoded PEM Private Key
552 severity: high
553 confidence: strong
554 type: pattern
555 values:
556 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
557 filter_type:
558 - ValueBase64EncodedPem
559 min_line_len: 300
560 required_substrings:
561 - UFJJVkFURSBLRVkt
562 - QUklWQVRFIEtFWS0t
563 - FBSSVZBVEUgS0VZ
564 target:
565 - code
566 - doc
567
568- name: BASE64 Private Key
569 severity: high
570 confidence: strong
571 type: pattern
572 values:
573 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
574 filter_type:
575 - ValueBase64KeyCheck
576 min_line_len: 160
577 required_substrings:
578 - MII
579 target:
580 - code
581 - doc
582
583- name: Picatic API Key
584 severity: high
585 confidence: strong
586 type: pattern
587 values:
588 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
589 filter_type: GeneralPattern
590 required_substrings:
591 - sk_live_
592 min_line_len: 40
593 target:
594 - code
595 - doc
596
597- name: SendGrid API Key
598 severity: high
599 confidence: moderate
600 type: pattern
601 values:
602 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
603 filter_type: TokenPattern
604 required_substrings:
605 - SG.
606 min_line_len: 34
607 target:
608 - code
609 - doc
610
611- name: Clojars Deploy Token
612 severity: high
613 confidence: strong
614 type: pattern
615 values:
616 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
617 filter_type: TokenPattern
618 required_substrings:
619 - CLOJARS_
620 min_line_len: 68
621 target:
622 - code
623 - doc
624
625- name: Shopify Token
626 severity: high
627 confidence: strong
628 type: pattern
629 values:
630 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
631 filter_type: TokenPattern
632 required_substrings:
633 - shp
634 min_line_len: 38
635 target:
636 - code
637 - doc
638
639- name: Slack Token
640 severity: high
641 confidence: strong
642 type: pattern
643 values:
644 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
645 filter_type: TokenPattern
646 required_substrings:
647 - xox
648 - xapp
649 min_line_len: 15
650 target:
651 - code
652 - doc
653
654- name: Slack Webhook
655 severity: medium
656 confidence: strong
657 type: pattern
658 values:
659 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
660 filter_type: GeneralPattern
661 required_substrings:
662 - hooks.slack.com/services/T
663 min_line_len: 61
664 target:
665 - code
666 - doc
667
668- name: Stripe Credentials
669 severity: high
670 confidence: strong
671 type: pattern
672 values:
673 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
674 filter_type: GeneralPattern
675 required_substrings:
676 - k_live_
677 - k_test_
678 - whsec_
679 min_line_len: 32
680 target:
681 - code
682 - doc
683
684- name: Square Access Token
685 severity: high
686 confidence: moderate
687 type: pattern
688 values:
689 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
690 filter_type:
691 - ValuePatternCheck
692 - ValueBase64PartCheck
693 required_substrings:
694 - EAAA
695 min_line_len: 64
696 target:
697 - code
698 - doc
699
700- name: Square Credentials
701 severity: medium
702 confidence: strong
703 type: pattern
704 values:
705 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
706 filter_type: TokenPattern
707 required_substrings:
708 - sq0
709 min_line_len: 29
710 target:
711 - code
712 - doc
713
714- name: Twilio Credentials
715 severity: high
716 confidence: moderate
717 type: pattern
718 values:
719 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
720 filter_type: TokenPattern
721 required_substrings:
722 - AC
723 - AD
724 - AL
725 - CA
726 - CF
727 - CL
728 - CN
729 - CR
730 - FW
731 - IP
732 - KS
733 - MM
734 - "NO"
735 - PK
736 - PN
737 - QU
738 - RE
739 - SC
740 - SD
741 - SK
742 - SM
743 - TR
744 - UT
745 - XE
746 - XR
747 min_line_len: 34
748 target:
749 - code
750 - doc
751
752- name: Telegram Bot API Token
753 severity: high
754 confidence: moderate
755 type: pattern
756 values:
757 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
758 filter_type: TokenPattern
759 required_substrings:
760 - :AA
761 min_line_len: 45
762 target:
763 - code
764 - doc
765
766- name: PyPi API Token
767 severity: high
768 confidence: strong
769 type: pattern
770 values:
771 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
772 filter_type: TokenPattern
773 required_substrings:
774 - pypi-
775 min_line_len: 155
776 target:
777 - code
778 - doc
779
780- name: NPM Token
781 severity: high
782 confidence: strong
783 type: pattern
784 values:
785 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
786 filter_type:
787 - ValueGitHubCheck
788 required_substrings:
789 - npm_
790 min_line_len: 40
791 target:
792 - code
793 - doc
794
795- name: Github App Installation Token
796 severity: high
797 confidence: strong
798 type: pattern
799 values:
800 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
801 filter_type:
802 - ValuePatternCheck
803 required_substrings:
804 - ghs_
805 min_line_len: 40
806 target:
807 - code
808 - doc
809
810- name: Github Classic Token
811 severity: high
812 confidence: strong
813 type: pattern
814 values:
815 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
816 filter_type:
817 - ValueGitHubCheck
818 required_substrings:
819 - ghp_
820 - gho_
821 - ghu_
822 - ghs_
823 - ghr_
824 min_line_len: 40
825 target:
826 - code
827 - doc
828
829- name: Github Fine-granted Token
830 severity: high
831 confidence: strong
832 type: pattern
833 values:
834 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
835 filter_type: GeneralPattern
836 required_substrings:
837 - github_pat_
838 min_line_len: 90
839 target:
840 - code
841 - doc
842
843- name: Firebase Domain
844 severity: info
845 confidence: moderate
846 type: pattern
847 values:
848 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
849 filter_type: GeneralPattern
850 required_substrings:
851 - .firebase
852 min_line_len: 16
853 target:
854 - code
855 - doc
856
857- name: AWS S3 Bucket
858 severity: info
859 confidence: moderate
860 type: pattern
861 values:
862 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
863 filter_type: GeneralPattern
864 required_substrings:
865 - .s3-website
866 - .s3.amazonaws.com
867 min_line_len: 14
868 target:
869 - code
870 - doc
871
872- name: Jfrog Token
873 severity: high
874 confidence: strong
875 type: pattern
876 values:
877 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
878 filter_type:
879 - ValueJfrogTokenCheck
880 required_substrings:
881 - cmVmdGtuO
882 - AKCp
883 min_line_len: 64
884 target:
885 - code
886 - doc
887
888- name: Azure Access Token
889 severity: high
890 confidence: strong
891 type: pattern
892 values:
893 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
894 filter_type:
895 - ValueAzureTokenCheck
896 required_substrings:
897 - eyJ
898 min_line_len: 148
899 target:
900 - code
901 - doc
902
903- name: Azure Secret Value
904 severity: high
905 confidence: moderate
906 type: pattern
907 values:
908 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
909 filter_type: TokenPattern
910 min_line_len: 40
911 required_substrings:
912 - 8Q~
913 target:
914 - code
915 - doc
916
917- name: Azure Storage Account Key
918 severity: high
919 confidence: moderate
920 type: pattern
921 values:
922 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
923 min_line_len: 80
924 filter_type:
925 - ValuePatternCheck(17)
926 required_substrings:
927 - JQQJ99
928 - JQQJ9D
929 - JQQJ9H
930 target:
931 - code
932 - doc
933
934- name: Bitbucket App Password
935 severity: high
936 confidence: strong
937 type: pattern
938 values:
939 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
940 filter_type:
941 - ValueAtlassianTokenCheck
942 min_line_len: 28
943 required_substrings:
944 - ATBB
945 target:
946 - code
947 - doc
948
949- name: Bitbucket Repository Access Token
950 severity: high
951 confidence: strong
952 type: pattern
953 values:
954 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
955 filter_type:
956 - ValueAtlassianTokenCheck
957 min_line_len: 160
958 required_substrings:
959 - ATCTT3xFfGN0
960 target:
961 - code
962 - doc
963
964- name: Bitbucket HTTP Access Token
965 severity: high
966 confidence: strong
967 type: pattern
968 values:
969 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
970 filter_type:
971 - ValueAtlassianTokenCheck
972 min_line_len: 49
973 required_substrings:
974 - BBDC-
975 target:
976 - code
977 - doc
978
979- name: Jira / Confluence PAT token
980 severity: high
981 confidence: strong
982 type: pattern
983 values:
984 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
985 filter_type:
986 - ValueAtlassianTokenCheck
987 min_line_len: 44
988 required_substrings:
989 - M
990 - N
991 - O
992 required_regex: "[0-9A-Za-z_/+-]{15}"
993 target:
994 - code
995 - doc
996
997- name: Atlassian PAT token
998 severity: high
999 confidence: strong
1000 type: pattern
1001 values:
1002 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1003 filter_type:
1004 - ValueAtlassianTokenCheck
1005 min_line_len: 160
1006 required_substrings:
1007 - ATATT3xFfGF0
1008 target:
1009 - code
1010 - doc
1011
1012- name: Digital Ocean Token
1013 severity: high
1014 confidence: strong
1015 type: pattern
1016 values:
1017 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1018 filter_type: TokenPattern
1019 min_line_len: 71
1020 required_substrings:
1021 - doo_v1_
1022 - dop_v1_
1023 - dor_v1_
1024 target:
1025 - code
1026 - doc
1027
1028- name: Dropbox OAuth2 API Access Token
1029 severity: high
1030 confidence: moderate
1031 type: pattern
1032 values:
1033 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1034 filter_type: TokenPattern
1035 min_line_len: 80
1036 required_substrings:
1037 - sl.
1038 target:
1039 - code
1040 - doc
1041
1042- name: NuGet API key
1043 severity: high
1044 confidence: moderate
1045 type: pattern
1046 values:
1047 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1048 filter_type: TokenPattern
1049 min_line_len: 46
1050 required_substrings:
1051 - oy2
1052 target:
1053 - code
1054 - doc
1055
1056- name: Gitlab Prefix Token
1057 severity: high
1058 confidence: strong
1059 type: pattern
1060 values:
1061 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1062 filter_type:
1063 - ValuePatternCheck
1064 min_line_len: 25
1065 required_substrings:
1066 - _gitlab_session=
1067 - GR1348941
1068 - glagent-
1069 - glsoat-
1070 - glffct-
1071 - glpat-
1072 - gloas-
1073 - glptt-
1074 - glcbt-
1075 - glimt-
1076 - gldt-
1077 - glft-
1078 - glrt-
1079 - glrtr-
1080 - glwt-
1081 target:
1082 - code
1083 - doc
1084
1085- name: Grafana Provisioned API Key
1086 severity: high
1087 confidence: strong
1088 type: pattern
1089 values:
1090 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1091 filter_type:
1092 - ValueGrafanaCheck
1093 min_line_len: 67
1094 required_substrings:
1095 - eyJ
1096 target:
1097 - code
1098 - doc
1099
1100- name: Grafana Access Policy Token
1101 severity: high
1102 confidence: strong
1103 type: pattern
1104 values:
1105 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1106 filter_type:
1107 - ValueGrafanaCheck
1108 min_line_len: 87
1109 required_substrings:
1110 - glc_eyJ
1111 target:
1112 - code
1113 - doc
1114
1115- name: Grafana Service Account Token
1116 severity: high
1117 confidence: strong
1118 type: pattern
1119 values:
1120 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1121 min_line_len: 46
1122 filter_type:
1123 - ValueGrafanaServiceCheck
1124 required_substrings:
1125 - glsa_
1126 target:
1127 - code
1128 - doc
1129
1130- name: Dropbox API secret (long term)
1131 severity: high
1132 confidence: weak
1133 type: pattern
1134 values:
1135 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1136 filter_type: [ ]
1137 min_line_len: 43
1138 required_substrings:
1139 - AAAAAAAAAA
1140 target:
1141 - code
1142 - doc
1143
1144- name: X App-Only Authentication Bearer Token
1145 severity: high
1146 confidence: moderate
1147 type: pattern
1148 values:
1149 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AAAAAAAAAAAAAAAAAAAAA[0-9A-Za-z%]{40,42}%3D[0-9A-Za-z]{50})(?![=0-9A-Za-z_/+-])
1150 filter_type: [ ]
1151 min_line_len: 100
1152 required_substrings:
1153 - AAAAAAAAAAAAAAAAAAAAA
1154 target:
1155 - code
1156 - doc
1157
1158- name: NewRelic Credentials
1159 severity: high
1160 confidence: moderate
1161 type: pattern
1162 values:
1163 - (?P<value>NRAK-[0-9A-Z]{27}|NRBR-[0-9a-f]{19,20}|NRII-[0-9A-Za-z_-]{25}|NRJS-[0-9a-z]{19}|[0-9a-z]{5}[0-9a-f]{31}NRAL)
1164 min_line_len: 24
1165 filter_type:
1166 - ValuePatternCheck
1167 - ValueMorphemesCheck
1168 required_substrings:
1169 - NRAK-
1170 - NRBR-
1171 - NRII-
1172 - NRJS-
1173 - NRAL
1174 target:
1175 - code
1176 - doc
1177
1178- name: Linear API Key
1179 severity: high
1180 confidence: moderate
1181 type: pattern
1182 values:
1183 - (?P<value>lin_api_[0-9A-Za-z]{40})
1184 min_line_len: 48
1185 filter_type:
1186 - ValuePatternCheck
1187 required_substrings:
1188 - lin_api_
1189 target:
1190 - code
1191 - doc
1192
1193- name: CloudFlare API Token
1194 severity: high
1195 confidence: moderate
1196 type: pattern
1197 values:
1198 - (?P<value>cf(at|ut|k)_[0-9A-Za-z]{48})
1199 min_line_len: 24
1200 filter_type:
1201 - ValuePatternCheck
1202 - ValueMorphemesCheck
1203 required_substrings:
1204 - cfat_
1205 - cfut_
1206 - cfk_
1207 target:
1208 - code
1209 - doc
1210
1211- name: Age Secret Key
1212 severity: high
1213 confidence: strong
1214 type: pattern
1215 values:
1216 - (?P<value>AGE-SECRET-KEY-1[0-9A-Z]{58})
1217 min_line_len: 74
1218 filter_type:
1219 - ValueBech32Check
1220 required_substrings:
1221 - AGE-SECRET-KEY-1
1222 target:
1223 - code
1224 - doc
1225
1226- name: Dropbox App secret
1227 severity: info
1228 confidence: weak
1229 type: pattern
1230 values:
1231 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1232 filter_type: WeirdBase36Token
1233 min_line_len: 15
1234 required_regex: "[0-9A-Za-z_/+-]{15}"
1235 target:
1236 - code
1237 - doc
1238
1239- name: Hashicorp Vault Token
1240 severity: high
1241 confidence: strong
1242 type: pattern
1243 values:
1244 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1245 filter_type:
1246 - ValuePatternCheck
1247 - ValueEntropyBase64Check
1248 min_line_len: 90
1249 required_substrings:
1250 - hvb.
1251 - hvr.
1252 - hvs.
1253 target:
1254 - code
1255 - doc
1256
1257- name: Hashicorp Terraform Token
1258 severity: high
1259 confidence: strong
1260 type: pattern
1261 values:
1262 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1263 filter_type:
1264 - ValuePatternCheck
1265 - ValueMorphemesCheck
1266 min_line_len: 90
1267 required_substrings:
1268 - .atlasv1.
1269 target:
1270 - code
1271 - doc
1272
1273- name: NKEY Seed
1274 severity: high
1275 confidence: weak
1276 type: pattern
1277 values:
1278 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1279 min_line_len: 42
1280 filter_type:
1281 - ValueMorphemesCheck
1282 - ValuePatternCheck
1283 - ValueEntropyBase32Check
1284 - ValueBase32DataCheck
1285 - ValueTokenBase32Check
1286 required_substrings:
1287 - SA
1288 - SC
1289 - SN
1290 - SO
1291 - SP
1292 - SU
1293 - SX
1294 required_regex: "[0-9A-Za-z_/+-]{15}"
1295 target:
1296 - code
1297 - doc
1298
1299- name: OTP / 2FA Secret
1300 severity: info
1301 confidence: weak
1302 type: pattern
1303 values:
1304 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1305 filter_type:
1306 - ValueMorphemesCheck
1307 - ValuePatternCheck
1308 - ValueEntropyBase32Check
1309 - ValueBase32DataCheck
1310 - ValueTokenBase32Check
1311 - ValueBase64PartCheck
1312 min_line_len: 16
1313 required_regex: "[0-9A-Za-z_/+-]{15}"
1314 target:
1315 - code
1316 - doc
1317
1318- name: OpenAI Token
1319 severity: high
1320 confidence: strong
1321 type: pattern
1322 values:
1323 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1324 min_line_len: 51
1325 filter_type:
1326 - ValuePatternCheck
1327 - ValueMorphemesCheck
1328 required_substrings:
1329 - T3BlbkFJ
1330 - 9wZW5BS
1331 - PcGVuQU
1332 target:
1333 - code
1334 - doc
1335
1336- name: Docker Access Token
1337 severity: high
1338 confidence: strong
1339 type: pattern
1340 values:
1341 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1342 min_line_len: 36
1343 filter_type:
1344 - ValuePatternCheck
1345 - ValueMorphemesCheck
1346 required_substrings:
1347 - dckr_pat_
1348 - dckr_oat_
1349 target:
1350 - code
1351 - doc
1352
1353- name: Docker Swarm Token
1354 severity: high
1355 confidence: strong
1356 type: pattern
1357 values:
1358 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1359 min_line_len: 85
1360 filter_type:
1361 - ValuePatternCheck
1362 - ValueMorphemesCheck
1363 required_substrings:
1364 - SWMTKN-1-
1365 target:
1366 - code
1367 - doc
1368
1369- name: Docker Swarm Key
1370 severity: high
1371 confidence: strong
1372 type: pattern
1373 values:
1374 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1375 min_line_len: 52
1376 filter_type:
1377 - ValuePatternCheck
1378 - ValueMorphemesCheck
1379 required_substrings:
1380 - SWMKEY-1-
1381 target:
1382 - code
1383 - doc
1384
1385- name: Groq API Key
1386 severity: high
1387 confidence: strong
1388 type: pattern
1389 values:
1390 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1391 min_line_len: 56
1392 filter_type:
1393 - ValuePatternCheck
1394 required_substrings:
1395 - WGdyb3FY
1396 - hncm9xW
1397 - YZ3JvcV
1398 target:
1399 - code
1400 - doc
1401
1402- name: X AI API Key
1403 severity: high
1404 confidence: moderate
1405 type: pattern
1406 values:
1407 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1408 min_line_len: 84
1409 filter_type:
1410 - ValuePatternCheck
1411 - ValueEntropyBase64Check
1412 required_substrings:
1413 - xai-
1414 target:
1415 - code
1416 - doc
1417
1418- name: Notion Integration Token
1419 severity: high
1420 confidence: strong
1421 type: pattern
1422 values:
1423 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1424 filter_type:
1425 - ValuePatternCheck
1426 - ValueEntropyBase64Check
1427 required_substrings:
1428 - ntn_
1429 min_line_len: 50
1430 target:
1431 - code
1432 - doc
1433
1434- name: Hugging Face User Access Token
1435 severity: high
1436 confidence: moderate
1437 type: pattern
1438 values:
1439 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1440 min_line_len: 37
1441 filter_type:
1442 - ValuePatternCheck
1443 - ValueEntropyBase64Check
1444 required_substrings:
1445 - hf_
1446 target:
1447 - code
1448 - doc
1449
1450- name: Anthropic API Key
1451 severity: high
1452 confidence: strong
1453 type: pattern
1454 values:
1455 - (?P<value>sk-ant-api03-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1456 min_line_len: 77
1457 filter_type:
1458 - ValuePatternCheck
1459 required_substrings:
1460 - sk-ant-api03-
1461 target:
1462 - code
1463 - doc
1464
1465- name: Perplexity API Key
1466 severity: high
1467 confidence: strong
1468 type: pattern
1469 values:
1470 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1471 min_line_len: 45
1472 filter_type:
1473 - ValuePatternCheck
1474 required_substrings:
1475 - pplx-
1476 target:
1477 - code
1478 - doc
1479
1480- name: DeepSeek API Key
1481 severity: high
1482 confidence: moderate
1483 type: pattern
1484 values:
1485 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1486 min_line_len: 35
1487 filter_type:
1488 - ValuePatternCheck
1489 required_substrings:
1490 - sk-
1491 target:
1492 - code
1493 - doc
1494
1495- name: Tavily API Key
1496 severity: high
1497 confidence: strong
1498 type: pattern
1499 values:
1500 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1501 min_line_len: 37
1502 filter_type:
1503 - ValuePatternCheck
1504 required_substrings:
1505 - tvly-
1506 target:
1507 - code
1508 - doc
1509
1510- name: Figma Personal Access Token
1511 severity: high
1512 confidence: strong
1513 type: pattern
1514 values:
1515 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1516 min_line_len: 45
1517 filter_type:
1518 - ValuePatternCheck
1519 required_substrings:
1520 - figd_
1521 target:
1522 - code
1523 - doc
1524
1525- name: 1Password Account Token
1526 severity: high
1527 confidence: strong
1528 type: pattern
1529 values:
1530 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1531 min_line_len: 192
1532 filter_type:
1533 - ValuePatternCheck
1534 required_substrings:
1535 - InNlY3JldEtleSI6
1536 - JzZWNyZXRLZXkiO
1537 - ic2VjcmV0S2V5Ij
1538 target:
1539 - code
1540 - doc
1541
1542- name: Brevo API Key
1543 severity: high
1544 confidence: strong
1545 type: pattern
1546 values:
1547 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1548 min_line_len: 89
1549 filter_type:
1550 - ValuePatternCheck
1551 required_substrings:
1552 - xkeysib-
1553 target:
1554 - code
1555 - doc
1556
1557- name: Together AI API Key
1558 severity: high
1559 confidence: strong
1560 type: pattern
1561 values:
1562 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1563 min_line_len: 50
1564 filter_type:
1565 - ValuePatternCheck
1566 required_substrings:
1567 - tgp_v1_
1568 target:
1569 - code
1570 - doc
1571
1572- name: LLAMA API Key
1573 severity: high
1574 confidence: strong
1575 type: pattern
1576 values:
1577 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1578 min_line_len: 52
1579 filter_type:
1580 - ValuePatternCheck
1581 required_substrings:
1582 - llx-
1583 target:
1584 - code
1585 - doc
1586
1587- name: SonarQube Credentials
1588 severity: medium
1589 confidence: moderate
1590 type: pattern
1591 values:
1592 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1593 min_line_len: 44
1594 filter_type:
1595 - ValuePatternCheck
1596 required_substrings:
1597 - sqa_
1598 - sqp_
1599 - squ_
1600 target:
1601 - code
1602 - doc
1603
1604- name: Sentry Organization Auth Token
1605 severity: high
1606 confidence: strong
1607 type: pattern
1608 values:
1609 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1610 min_line_len: 37
1611 filter_type:
1612 - ValuePatternCheck
1613 required_substrings:
1614 - sntrys_eyJ
1615 target:
1616 - code
1617 - doc
1618
1619- name: Sentry User Auth Token
1620 severity: high
1621 confidence: strong
1622 type: pattern
1623 values:
1624 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1625 min_line_len: 37
1626 filter_type:
1627 - ValuePatternCheck
1628 required_substrings:
1629 - sntryu_
1630 target:
1631 - code
1632 - doc
1633
1634- name: Discord Bot Token
1635 severity: high
1636 confidence: strong
1637 type: pattern
1638 values:
1639 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1640 min_line_len: 62
1641 filter_type:
1642 - ValueDiscordBotCheck
1643 required_substrings:
1644 - M
1645 - N
1646 - O
1647 required_regex: "[0-9A-Za-z_/+-]{15}"
1648 target:
1649 - code
1650 - doc
1651
1652- name: Discord Webhook
1653 severity: medium
1654 confidence: strong
1655 type: pattern
1656 values:
1657 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1658 filter_type:
1659 - ValueMorphemesCheck
1660 required_substrings:
1661 - discordapp.com/api/webhooks
1662 - discord.com/api/webhooks
1663 min_line_len: 61
1664 target:
1665 - code
1666 - doc
1667
1668- name: Vercel Token
1669 severity: medium
1670 confidence: weak
1671 type: pattern
1672 values:
1673 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
1674 min_line_len: 60
1675 filter_type: TokenPattern
1676 required_substrings:
1677 - vcp_
1678 target:
1679 - code
1680 - doc
1681
1682- name: Netlify Token
1683 severity: medium
1684 confidence: weak
1685 type: pattern
1686 values:
1687 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
1688 min_line_len: 40
1689 filter_type: TokenPattern
1690 required_substrings:
1691 - nfp_
1692 target:
1693 - code
1694 - doc
1695
1696- name: PostHog Credentials
1697 severity: medium
1698 confidence: weak
1699 type: pattern
1700 values:
1701 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
1702 min_line_len: 44
1703 filter_type: TokenPattern
1704 required_substrings:
1705 - phx_
1706 - phs_
1707 - phr_
1708 - pha_
1709 - phc_
1710 target:
1711 - code
1712 - doc
1713
1714- name: RubyGems API Key
1715 severity: medium
1716 confidence: strong
1717 type: pattern
1718 values:
1719 - (?P<value>rubygems_[0-9a-f]{48})
1720 min_line_len: 57
1721 filter_type: TokenPattern
1722 required_substrings:
1723 - rubygems_
1724 target:
1725 - code
1726 - doc
1727
1728- name: Databricks Access Token
1729 severity: medium
1730 confidence: strong
1731 type: pattern
1732 values:
1733 - (?P<value>dapi[0-9a-f]{32})
1734 min_line_len: 36
1735 filter_type: TokenPattern
1736 required_substrings:
1737 - dapi
1738 target:
1739 - code
1740 - doc
1741
1742- name: Tencent WeChat API App ID
1743 severity: medium
1744 confidence: weak
1745 type: pattern
1746 values:
1747 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1748 min_line_len: 18
1749 filter_type: TokenPattern
1750 required_substrings:
1751 - wx
1752 target:
1753 - code
1754 - doc
1755
1756- name: WunderGraph API Key
1757 severity: medium
1758 confidence: strong
1759 type: pattern
1760 values:
1761 - (?P<value>cosmo_[0-9a-f]{32})
1762 min_line_len: 38
1763 filter_type: TokenPattern
1764 required_substrings:
1765 - cosmo_
1766 target:
1767 - code
1768 - doc
1769
1770- name: Salesforce Credentials
1771 severity: medium
1772 confidence: weak
1773 type: pattern
1774 values:
1775 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
1776 min_line_len: 12
1777 filter_type:
1778 - ValuePatternCheck(9)
1779 - ValueNumberCheck
1780 - ValueBase64PartCheck
1781 required_substrings:
1782 - 00D
1783 - 3MVG
1784 target:
1785 - code
1786 - doc
1787
1788- name: Postman Credentials
1789 severity: medium
1790 confidence: moderate
1791 type: pattern
1792 values:
1793 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
1794 min_line_len: 29
1795 filter_type:
1796 - ValuePatternCheck
1797 required_substrings:
1798 - PMAK-
1799 - PMAT-
1800 target:
1801 - code
1802 - doc
1803
1804- name: NTLM Token
1805 severity: medium
1806 confidence: strong
1807 type: pattern
1808 values:
1809 - (?P<value>TlRMTVNTUAADAAAA[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1810 filter_type:
1811 - ValueMorphemesCheck(2)
1812 - ValuePatternCheck
1813 min_line_len: 160
1814 required_substrings:
1815 - TlRMTVNTUAADAAAA
1816 target:
1817 - doc
1818 - code
1819
1820- name: Basic Authorization
1821 severity: medium
1822 confidence: strong
1823 type: pattern
1824 values:
1825 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
1826 min_line_len: 18
1827 filter_type:
1828 - ValueBasicAuthCheck
1829 required_substrings:
1830 - basic
1831 target:
1832 - code
1833 - doc
1834
1835- name: Bearer Authorization
1836 severity: medium
1837 confidence: moderate
1838 type: pattern
1839 values:
1840 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
1841 min_line_len: 37
1842 filter_type: GeneralKeyword
1843 required_substrings:
1844 - bearer
1845 - ntlm
1846 target:
1847 - code
1848 - doc
1849
1850- name: SQL Password
1851 severity: medium
1852 confidence: weak
1853 type: pattern
1854 values:
1855 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
1856 filter_type:
1857 - ValueAllowlistCheck
1858 - ValuePatternCheck
1859 use_ml: true
1860 min_line_len: 8
1861 required_substrings:
1862 - password
1863 - identified
1864 target:
1865 - doc
1866 - code
1867
1868- name: CURL User Password
1869 severity: high
1870 confidence: moderate
1871 type: pattern
1872 values:
1873 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1874 filter_type: GeneralKeyword
1875 use_ml: true
1876 required_substrings:
1877 - curl
1878 min_line_len: 16
1879 target:
1880 - doc
1881 - code
1882
1883- name: CMD ConvertTo-SecureString
1884 severity: high
1885 confidence: moderate
1886 type: pattern
1887 values:
1888 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1889 filter_type: GeneralKeyword
1890 use_ml: true
1891 required_substrings:
1892 - convertto-securestring
1893 min_line_len: 27
1894 target:
1895 - doc
1896 - code
1897
1898- name: CMD Password
1899 severity: high
1900 confidence: moderate
1901 type: pattern
1902 values:
1903 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1904 filter_type: GeneralKeyword
1905 use_ml: true
1906 required_substrings:
1907 - pass
1908 min_line_len: 12
1909 target:
1910 - doc
1911 - code
1912
1913- name: CMD Token
1914 severity: high
1915 confidence: moderate
1916 type: pattern
1917 values:
1918 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1919 filter_type: GeneralKeyword
1920 use_ml: true
1921 required_substrings:
1922 - token
1923 - oauth2-bearer
1924 min_line_len: 12
1925 target:
1926 - doc
1927 - code
1928
1929- name: CMD Secret
1930 severity: high
1931 confidence: moderate
1932 type: pattern
1933 values:
1934 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
1935 filter_type: GeneralKeyword
1936 use_ml: true
1937 required_substrings:
1938 - secret
1939 min_line_len: 12
1940 target:
1941 - doc
1942 - code
1943
1944- name: URL Credentials
1945 severity: high
1946 confidence: moderate
1947 type: pattern
1948 values:
1949 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
1950 filter_type: UrlCredentialsGroup
1951 use_ml: true
1952 required_substrings:
1953 - ://
1954 min_line_len: 10
1955 target:
1956 - doc
1957 - code
1958
1959- name: API
1960 severity: low
1961 confidence: moderate
1962 type: keyword
1963 values:
1964 - api(?!tal)
1965 filter_type: GeneralKeyword
1966 use_ml: true
1967 min_line_len: 11
1968 required_substrings:
1969 - api
1970 target:
1971 - code
1972
1973- name: Auth
1974 severity: medium
1975 confidence: moderate
1976 type: keyword
1977 values:
1978 - auth(?!ors?(?!i[tz]))
1979 filter_type: GeneralKeyword
1980 use_ml: true
1981 min_line_len: 12
1982 required_substrings:
1983 - auth
1984 target:
1985 - code
1986
1987- name: Credential
1988 severity: medium
1989 confidence: moderate
1990 type: keyword
1991 values:
1992 - credential
1993 filter_type: GeneralKeyword
1994 use_ml: true
1995 min_line_len: 18
1996 required_substrings:
1997 - credential
1998 target:
1999 - code
2000
2001- name: Key
2002 severity: high
2003 confidence: moderate
2004 type: keyword
2005 values:
2006 - key(?!word|board|pad|name)
2007 filter_type: GeneralKeyword
2008 use_ml: true
2009 min_line_len: 11
2010 required_substrings:
2011 - key
2012 target:
2013 - code
2014
2015- name: Nonce
2016 severity: low
2017 confidence: moderate
2018 type: keyword
2019 values:
2020 - (?<!\\)nonce
2021 filter_type: GeneralKeyword
2022 use_ml: true
2023 min_line_len: 13
2024 required_substrings:
2025 - nonce
2026 target:
2027 - code
2028
2029- name: Password
2030 severity: high
2031 confidence: moderate
2032 type: keyword
2033 values:
2034 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
2035 filter_type: PasswordKeyword
2036 use_ml: true
2037 min_line_len: 10
2038 required_substrings:
2039 - pass
2040 - pasw
2041 - pssw
2042 - psw
2043 - pw
2044 target:
2045 - code
2046
2047- name: Salt
2048 severity: low
2049 confidence: moderate
2050 type: keyword
2051 values:
2052 - salt
2053 filter_type: GeneralKeyword
2054 use_ml: true
2055 min_line_len: 12
2056 required_substrings:
2057 - salt
2058 target:
2059 - code
2060
2061- name: Secret
2062 severity: medium
2063 confidence: moderate
2064 type: keyword
2065 values:
2066 - secret
2067 filter_type: GeneralKeyword
2068 use_ml: true
2069 min_line_len: 14
2070 required_substrings:
2071 - secret
2072 target:
2073 - code
2074
2075- name: Token
2076 severity: high
2077 confidence: moderate
2078 type: keyword
2079 values:
2080 - token(?!ize)
2081 filter_type: GeneralKeyword
2082 use_ml: true
2083 min_line_len: 13
2084 required_substrings:
2085 - token
2086 target:
2087 - code