1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 use_ml: true
30 target:
31 - doc
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 use_ml: true
66 target:
67 - doc
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 use_ml: true
90 target:
91 - doc
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|%3[Dd])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 use_ml: true
121 target:
122 - doc
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 use_ml: true
138 target:
139 - doc
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 use_ml: true
163 target:
164 - doc
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 use_ml: true
187 target:
188 - doc
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 filter_type:
197 - ValuePatternCheck(4)
198 min_line_len: 36
199 required_substrings:
200 - "-"
201 required_regex: "[0-9A-Za-z_-]{15}"
202 use_ml: false
203 target:
204 - code
205 - doc
206
207- name: Product Activation Key
208 severity: info
209 confidence: weak
210 type: pattern
211 values:
212 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Z]{5}(-[0-9A-Z]{5}){4})(?![0-9A-Za-z_+-])
213 filter_type:
214 - ValuePatternCheck(5)
215 min_line_len: 29
216 required_substrings:
217 - "-"
218 required_regex: "[0-9A-Za-z_-]{15}"
219 use_ml: false
220 target:
221 - code
222 - doc
223
224- name: Akamai Credentials
225 severity: high
226 confidence: strong
227 type: pattern
228 values:
229 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
230 filter_type: GeneralPattern
231 min_line_len: 38
232 required_substrings:
233 - akab-
234 target:
235 - code
236 - doc
237
238- name: Amazon Bedrock API Key
239 severity: high
240 confidence: moderate
241 type: pattern
242 values:
243 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
244 filter_type: GeneralPattern
245 min_line_len: 44
246 required_substrings:
247 - ABSK
248 - bedrock-api-key-
249 target:
250 - code
251 - doc
252
253- name: AWS AppSync GraphQL API Key
254 severity: high
255 confidence: moderate
256 type: pattern
257 values:
258 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>da2-[a-z0-9]{26})(?![0-9A-Za-z/+])
259 filter_type: GeneralPattern
260 min_line_len: 40
261 required_substrings:
262 - da2-
263 target:
264 - code
265 - doc
266
267- name: AWS Client ID
268 severity: medium
269 confidence: moderate
270 type: pattern
271 values:
272 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
273 filter_type: GeneralPattern
274 min_line_len: 20
275 required_substrings:
276 - A3T
277 - ABIA
278 - ACCA
279 - AGPA
280 - AIDA
281 - AIPA
282 - AKIA
283 - ANPA
284 - ANVA
285 - AROA
286 - APKA
287 - ASCA
288 - ASIA
289 target:
290 - code
291 - doc
292
293- name: AWS Multi
294 severity: high
295 confidence: moderate
296 type: multi
297 values:
298 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
299 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
300 filter_type:
301 - LineSpecificKeyCheck
302 - ValuePatternCheck
303 - ValueBase64PartCheck
304 - ValueMorphemesCheck
305 min_line_len: 20
306 required_substrings:
307 - AKIA
308 - ASIA
309 target:
310 - code
311 - doc
312
313- name: Alibaba Access Key ID
314 severity: medium
315 confidence: moderate
316 type: pattern
317 values:
318 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
319 filter_type: GeneralPattern
320 min_line_len: 16
321 required_substrings:
322 - LTAI
323 target:
324 - code
325 - doc
326
327- name: Alibaba Multi
328 severity: high
329 confidence: moderate
330 type: multi
331 values:
332 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
333 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){30}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
334 filter_type:
335 - LineSpecificKeyCheck
336 - ValuePatternCheck
337 - ValueBase64PartCheck
338 - ValueMorphemesCheck
339 min_line_len: 20
340 required_substrings:
341 - LTAI
342 target:
343 - code
344 - doc
345
346- name: AWS MWS Key
347 severity: high
348 confidence: strong
349 type: pattern
350 values:
351 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
352 filter_type: GeneralPattern
353 min_line_len: 30
354 required_substrings:
355 - amzn.mws.
356 target:
357 - code
358 - doc
359
360- name: Defined Networking API Key
361 severity: high
362 confidence: strong
363 type: pattern
364 values:
365 - (?P<value>dnkey-[A-Z2-7]{26}-[A-Z2-7]{52})
366 filter_type: GeneralPattern
367 min_line_len: 85
368 required_substrings:
369 - dnkey-
370 target:
371 - code
372 - doc
373
374- name: Dynatrace API Token
375 severity: high
376 confidence: moderate
377 type: pattern
378 values:
379 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[a-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
380 filter_type: TokenPattern
381 min_line_len: 90
382 required_substrings:
383 - dt0
384 target:
385 - code
386 - doc
387
388- name: Doppler API Key
389 severity: high
390 confidence: strong
391 type: pattern
392 values:
393 - (?P<value>dp\.pt\.[0-9A-Za-z]{43})
394 filter_type: GeneralPattern
395 min_line_len: 49
396 required_substrings:
397 - dp.pt.
398 target:
399 - code
400 - doc
401
402- name: Facebook Access Token
403 severity: high
404 confidence: moderate
405 type: pattern
406 values:
407 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
408 filter_type:
409 - ValuePatternCheck
410 - ValueBase64PartCheck
411 - ValueNotPartEncodedCheck
412 min_line_len: 80
413 required_substrings:
414 - EAA
415 target:
416 - code
417 - doc
418
419- name: Facebook App Token
420 severity: high
421 confidence: moderate
422 type: pattern
423 values:
424 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
425 filter_type: TokenPattern
426 min_line_len: 33
427 required_substrings:
428 - "|"
429 required_regex: "[0-9A-Za-z_-]{15}"
430 target:
431 - code
432 - doc
433
434- name: Google API Key
435 severity: high
436 confidence: moderate
437 type: pattern
438 values:
439 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
440 filter_type: TokenPattern
441 min_line_len: 39
442 required_substrings:
443 - AIza
444 target:
445 - code
446 - doc
447
448- name: Google Multi
449 severity: high
450 confidence: moderate
451 type: multi
452 values:
453 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
454 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
455 filter_type: GeneralPattern
456 min_line_len: 40
457 required_substrings:
458 - .apps.googleusercontent.com
459 target:
460 - code
461 - doc
462
463- name: Google OAuth Secret
464 severity: high
465 confidence: strong
466 type: pattern
467 values:
468 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
469 filter_type: TokenPattern
470 min_line_len: 40
471 required_substrings:
472 - GOCSPX-
473 target:
474 - code
475 - doc
476
477- name: Google OAuth Access Token
478 severity: high
479 confidence: moderate
480 type: pattern
481 values:
482 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
483 filter_type: TokenPattern
484 min_line_len: 27
485 required_substrings:
486 - ya29.
487 target:
488 - code
489 - doc
490
491- name: Google OAuth Refresh Token
492 severity: medium
493 confidence: weak
494 type: pattern
495 values:
496 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
497 filter_type: TokenPattern
498 min_line_len: 84
499 required_substrings:
500 - 1//0
501 target:
502 - code
503 - doc
504
505- name: Heroku Credentials
506 severity: high
507 confidence: strong
508 type: pattern
509 values:
510 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
511 filter_type: TokenPattern
512 min_line_len: 41
513 required_substrings:
514 - HRKU-
515 target:
516 - code
517 - doc
518
519- name: Instagram Access Token
520 severity: high
521 confidence: strong
522 type: pattern
523 values:
524 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
525 filter_type: TokenPattern
526 min_line_len: 105
527 required_substrings:
528 - IGQVJ
529 target:
530 - code
531 - doc
532
533- name: PASETO Token
534 severity: medium
535 confidence: moderate
536 type: pattern
537 values:
538 - (?P<value>v[1-4]\.(public|local)\.[0-9A-Za-z_-]{15,8000}(\.[0-9A-Za-z_-]{0,8000})?)
539 filter_type:
540 - ValuePatternCheck
541 min_line_len: 64
542 required_substrings:
543 - .public.
544 - .local.
545 target:
546 - code
547 - doc
548
549- name: PASERK Keys
550 severity: high
551 confidence: strong
552 type: pattern
553 values:
554 - (?P<value>k[1-4]\.(local|secret)(-pw)?\.[0-9A-Za-z_-]{15,8000})
555 filter_type:
556 - ValuePatternCheck
557 min_line_len: 64
558 required_substrings:
559 - local
560 - secret
561 target:
562 - code
563 - doc
564
565- name: JSON Web Token
566 severity: medium
567 confidence: strong
568 type: pattern
569 values:
570 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
571 filter_type:
572 - ValueJsonWebTokenCheck
573 min_line_len: 64
574 required_substrings:
575 - eyJ
576 target:
577 - code
578 - doc
579
580- name: JSON Web Key
581 severity: medium
582 confidence: strong
583 type: pattern
584 values:
585 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
586 filter_type:
587 - ValueJsonWebKeyCheck
588 min_line_len: 64
589 required_substrings:
590 - eyJ
591 - eyAi
592 - ewoi
593 - ewog
594 - ew0K
595 - WyJ
596 - W3si
597 - Wwp7
598 - Wwog
599 - Ww0K
600 - W3sK
601 target:
602 - code
603 - doc
604
605- name: JWK
606 severity: medium
607 confidence: moderate
608 type: multi
609 values:
610 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
611 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
612 filter_type:
613 - ValuePatternCheck
614 - ValueMorphemesCheck
615 min_line_len: 8
616 required_substrings:
617 - kty
618 target:
619 - code
620 - doc
621
622- name: MailChimp API Key
623 severity: high
624 confidence: moderate
625 type: pattern
626 values:
627 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
628 filter_type: TokenPattern
629 min_line_len: 35
630 required_substrings:
631 - -us
632 target:
633 - code
634 - doc
635
636- name: MailGun API Key
637 severity: high
638 confidence: moderate
639 type: pattern
640 values:
641 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
642 filter_type: TokenPattern
643 min_line_len: 36
644 required_substrings:
645 - "-"
646 - key-
647 required_regex: "[0-9A-Za-z_-]{15}"
648 target:
649 - code
650 - doc
651
652- name: PayPal Braintree Access Token
653 severity: high
654 confidence: strong
655 type: pattern
656 values:
657 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
658 filter_type: GeneralPattern
659 min_line_len: 72
660 required_substrings:
661 - access_token$production$
662 target:
663 - code
664 - doc
665
666- name: PEM Private Key
667 severity: high
668 confidence: strong
669 type: pem_key
670 values:
671 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
672 min_line_len: 27
673 target:
674 - code
675 - doc
676
677- name: BASE64 encoded PEM Private Key
678 severity: high
679 confidence: strong
680 type: pattern
681 values:
682 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
683 filter_type:
684 - ValueBase64EncodedPem
685 min_line_len: 300
686 required_substrings:
687 - UFJJVkFURSBLRVkt
688 - QUklWQVRFIEtFWS0t
689 - FBSSVZBVEUgS0VZ
690 target:
691 - code
692 - doc
693
694- name: BASE64 Private Key
695 severity: high
696 confidence: strong
697 type: pattern
698 values:
699 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
700 filter_type:
701 - ValueBase64KeyCheck
702 min_line_len: 160
703 required_substrings:
704 - MII
705 target:
706 - code
707 - doc
708
709- name: Picatic API Key
710 severity: high
711 confidence: strong
712 type: pattern
713 values:
714 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
715 filter_type: GeneralPattern
716 min_line_len: 40
717 required_substrings:
718 - sk_live_
719 target:
720 - code
721 - doc
722
723- name: SendGrid API Key
724 severity: high
725 confidence: moderate
726 type: pattern
727 values:
728 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
729 filter_type: TokenPattern
730 min_line_len: 34
731 required_substrings:
732 - SG.
733 target:
734 - code
735 - doc
736
737- name: Clojars Deploy Token
738 severity: high
739 confidence: strong
740 type: pattern
741 values:
742 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
743 filter_type: TokenPattern
744 min_line_len: 68
745 required_substrings:
746 - CLOJARS_
747 target:
748 - code
749 - doc
750
751- name: Shopify Token
752 severity: high
753 confidence: strong
754 type: pattern
755 values:
756 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
757 filter_type: TokenPattern
758 min_line_len: 38
759 required_substrings:
760 - shp
761 target:
762 - code
763 - doc
764
765- name: Slack Token
766 severity: high
767 confidence: strong
768 type: pattern
769 values:
770 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
771 filter_type: TokenPattern
772 min_line_len: 15
773 required_substrings:
774 - xox
775 - xapp
776 target:
777 - code
778 - doc
779
780- name: Slack Webhook
781 severity: medium
782 confidence: strong
783 type: pattern
784 values:
785 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
786 filter_type: GeneralPattern
787 min_line_len: 61
788 required_substrings:
789 - hooks.slack.com/services/T
790 target:
791 - code
792 - doc
793
794- name: Stripe Credentials
795 severity: high
796 confidence: strong
797 type: pattern
798 values:
799 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
800 filter_type: GeneralPattern
801 min_line_len: 32
802 required_substrings:
803 - k_live_
804 - k_test_
805 - whsec_
806 target:
807 - code
808 - doc
809
810- name: Square Access Token
811 severity: high
812 confidence: moderate
813 type: pattern
814 values:
815 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
816 filter_type:
817 - ValuePatternCheck
818 - ValueBase64PartCheck
819 min_line_len: 64
820 required_substrings:
821 - EAAA
822 target:
823 - code
824 - doc
825
826- name: Square Credentials
827 severity: medium
828 confidence: strong
829 type: pattern
830 values:
831 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
832 filter_type: TokenPattern
833 min_line_len: 29
834 required_substrings:
835 - sq0
836 target:
837 - code
838 - doc
839
840- name: Twilio Credentials
841 severity: high
842 confidence: moderate
843 type: pattern
844 values:
845 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
846 filter_type: TokenPattern
847 min_line_len: 34
848 required_substrings:
849 - AC
850 - AD
851 - AL
852 - CA
853 - CF
854 - CL
855 - CN
856 - CR
857 - FW
858 - IP
859 - KS
860 - MM
861 - "NO"
862 - PK
863 - PN
864 - QU
865 - RE
866 - SC
867 - SD
868 - SK
869 - SM
870 - TR
871 - UT
872 - XE
873 - XR
874 required_regex: "[0-9A-Za-z_-]{15}"
875 target:
876 - code
877 - doc
878
879- name: Twilio Multi
880 severity: critical
881 confidence: moderate
882 type: multi
883 values:
884 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|SK)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
885 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9a-f]{32})(?![0-9A-Za-z_+-])
886 filter_type:
887 - ValuePatternCheck
888 - ValueMorphemesCheck
889 min_line_len: 34
890 required_substrings:
891 - AC
892 - SK
893 required_regex: "[0-9A-Za-z_-]{15}"
894 target:
895 - code
896 - doc
897
898- name: Telegram Bot API Token
899 severity: high
900 confidence: moderate
901 type: pattern
902 values:
903 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
904 filter_type: TokenPattern
905 min_line_len: 45
906 required_substrings:
907 - :AA
908 target:
909 - code
910 - doc
911
912- name: PyPi API Token
913 severity: high
914 confidence: strong
915 type: pattern
916 values:
917 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
918 filter_type: TokenPattern
919 min_line_len: 155
920 required_substrings:
921 - pypi-
922 target:
923 - code
924 - doc
925
926- name: NPM Token
927 severity: high
928 confidence: strong
929 type: pattern
930 values:
931 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
932 filter_type:
933 - ValueGitHubCheck
934 min_line_len: 40
935 required_substrings:
936 - npm_
937 target:
938 - code
939 - doc
940
941- name: Github App Installation Token
942 severity: high
943 confidence: strong
944 type: pattern
945 values:
946 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
947 filter_type:
948 - ValuePatternCheck
949 min_line_len: 40
950 required_substrings:
951 - ghs_
952 target:
953 - code
954 - doc
955
956- name: Github Classic Token
957 severity: high
958 confidence: strong
959 type: pattern
960 values:
961 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
962 filter_type:
963 - ValueGitHubCheck
964 min_line_len: 40
965 required_substrings:
966 - ghp_
967 - gho_
968 - ghu_
969 - ghs_
970 - ghr_
971 target:
972 - code
973 - doc
974
975- name: Github Fine-granted Token
976 severity: high
977 confidence: strong
978 type: pattern
979 values:
980 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
981 filter_type: GeneralPattern
982 min_line_len: 90
983 required_substrings:
984 - github_pat_
985 target:
986 - code
987 - doc
988
989- name: Firebase Domain
990 severity: info
991 confidence: moderate
992 type: pattern
993 values:
994 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
995 filter_type: GeneralPattern
996 min_line_len: 16
997 required_substrings:
998 - .firebase
999 target:
1000 - code
1001 - doc
1002
1003- name: AWS S3 Bucket
1004 severity: info
1005 confidence: moderate
1006 type: pattern
1007 values:
1008 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
1009 filter_type: GeneralPattern
1010 min_line_len: 14
1011 required_substrings:
1012 - .s3-website
1013 - .s3.amazonaws.com
1014 target:
1015 - code
1016 - doc
1017
1018- name: Jfrog Token
1019 severity: high
1020 confidence: strong
1021 type: pattern
1022 values:
1023 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
1024 filter_type:
1025 - ValueJfrogTokenCheck
1026 min_line_len: 64
1027 required_substrings:
1028 - cmVmdGtuO
1029 - AKCp
1030 target:
1031 - code
1032 - doc
1033
1034- name: Azure Access Token
1035 severity: high
1036 confidence: strong
1037 type: pattern
1038 values:
1039 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
1040 filter_type:
1041 - ValueAzureTokenCheck
1042 min_line_len: 148
1043 required_substrings:
1044 - eyJ
1045 target:
1046 - code
1047 - doc
1048
1049- name: Azure Secret Value
1050 severity: high
1051 confidence: moderate
1052 type: pattern
1053 values:
1054 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
1055 filter_type: TokenPattern
1056 min_line_len: 40
1057 required_substrings:
1058 - 8Q~
1059 target:
1060 - code
1061 - doc
1062
1063- name: Azure Storage Account Key
1064 severity: high
1065 confidence: moderate
1066 type: pattern
1067 values:
1068 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
1069 filter_type:
1070 - ValuePatternCheck(17)
1071 min_line_len: 80
1072 required_substrings:
1073 - JQQJ99
1074 - JQQJ9D
1075 - JQQJ9H
1076 target:
1077 - code
1078 - doc
1079
1080- name: Bitbucket App Password
1081 severity: high
1082 confidence: strong
1083 type: pattern
1084 values:
1085 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
1086 filter_type:
1087 - ValueAtlassianTokenCheck
1088 min_line_len: 28
1089 required_substrings:
1090 - ATBB
1091 target:
1092 - code
1093 - doc
1094
1095- name: Bitbucket Repository Access Token
1096 severity: high
1097 confidence: strong
1098 type: pattern
1099 values:
1100 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1101 filter_type:
1102 - ValueAtlassianTokenCheck
1103 min_line_len: 160
1104 required_substrings:
1105 - ATCTT3xFfGN0
1106 target:
1107 - code
1108 - doc
1109
1110- name: Bitbucket HTTP Access Token
1111 severity: high
1112 confidence: strong
1113 type: pattern
1114 values:
1115 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
1116 filter_type:
1117 - ValueAtlassianTokenCheck
1118 min_line_len: 49
1119 required_substrings:
1120 - BBDC-
1121 target:
1122 - code
1123 - doc
1124
1125- name: Jira / Confluence PAT token
1126 severity: high
1127 confidence: strong
1128 type: pattern
1129 values:
1130 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1131 filter_type:
1132 - ValueAtlassianTokenCheck
1133 min_line_len: 44
1134 required_substrings:
1135 - M
1136 - N
1137 - O
1138 required_regex: "[0-9A-Za-z_-]{15}"
1139 target:
1140 - code
1141 - doc
1142
1143- name: Atlassian PAT token
1144 severity: high
1145 confidence: strong
1146 type: pattern
1147 values:
1148 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|%3[dD])[A-F0-9]{8})
1149 filter_type:
1150 - ValueAtlassianTokenCheck
1151 min_line_len: 160
1152 required_substrings:
1153 - ATATT3xFfGF0
1154 target:
1155 - code
1156 - doc
1157
1158- name: CircleCI Personal API Token
1159 severity: high
1160 confidence: strong
1161 type: pattern
1162 values:
1163 - (?P<value>CCIPAT_[0-9A-Za-z]{22}_[0-9a-f]{40})
1164 filter_type: TokenPattern
1165 min_line_len: 70
1166 required_substrings:
1167 - CCIPAT_
1168 target:
1169 - code
1170 - doc
1171
1172- name: Digital Ocean Token
1173 severity: high
1174 confidence: strong
1175 type: pattern
1176 values:
1177 - (?P<value>do[opr]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1178 filter_type: TokenPattern
1179 min_line_len: 71
1180 required_substrings:
1181 - doo_v1_
1182 - dop_v1_
1183 - dor_v1_
1184 target:
1185 - code
1186 - doc
1187
1188- name: Dropbox OAuth2 API Access Token
1189 severity: high
1190 confidence: moderate
1191 type: pattern
1192 values:
1193 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1194 filter_type: TokenPattern
1195 min_line_len: 80
1196 required_substrings:
1197 - sl.
1198 target:
1199 - code
1200 - doc
1201
1202- name: NuGet API key
1203 severity: high
1204 confidence: moderate
1205 type: pattern
1206 values:
1207 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1208 filter_type: TokenPattern
1209 min_line_len: 46
1210 required_substrings:
1211 - oy2
1212 target:
1213 - code
1214 - doc
1215
1216- name: Gitlab Prefix Token
1217 severity: high
1218 confidence: strong
1219 type: pattern
1220 values:
1221 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1222 filter_type:
1223 - ValuePatternCheck
1224 min_line_len: 25
1225 required_substrings:
1226 - _gitlab_session=
1227 - GR1348941
1228 - glagent-
1229 - glsoat-
1230 - glffct-
1231 - glpat-
1232 - gloas-
1233 - glptt-
1234 - glcbt-
1235 - glimt-
1236 - gldt-
1237 - glft-
1238 - glrt-
1239 - glrtr-
1240 - glwt-
1241 target:
1242 - code
1243 - doc
1244
1245- name: Grafana Provisioned API Key
1246 severity: high
1247 confidence: strong
1248 type: pattern
1249 values:
1250 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1251 filter_type:
1252 - ValueGrafanaCheck
1253 min_line_len: 67
1254 required_substrings:
1255 - eyJ
1256 target:
1257 - code
1258 - doc
1259
1260- name: Grafana Access Policy Token
1261 severity: high
1262 confidence: strong
1263 type: pattern
1264 values:
1265 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1266 filter_type:
1267 - ValueGrafanaCheck
1268 min_line_len: 87
1269 required_substrings:
1270 - glc_eyJ
1271 target:
1272 - code
1273 - doc
1274
1275- name: Grafana Service Account Token
1276 severity: high
1277 confidence: strong
1278 type: pattern
1279 values:
1280 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1281 filter_type:
1282 - ValueGrafanaServiceCheck
1283 min_line_len: 46
1284 required_substrings:
1285 - glsa_
1286 target:
1287 - code
1288 - doc
1289
1290- name: Dropbox API secret (long term)
1291 severity: high
1292 confidence: weak
1293 type: pattern
1294 values:
1295 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1296 filter_type: [ ]
1297 min_line_len: 43
1298 required_substrings:
1299 - AAAAAAAAAA
1300 target:
1301 - code
1302 - doc
1303
1304- name: X App-Only Authentication Bearer Token
1305 severity: high
1306 confidence: moderate
1307 type: pattern
1308 values:
1309 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AAAAAAAAAAAAAAAAAAAAA[0-9A-Za-z%]{40,42}%3D[0-9A-Za-z]{50})(?![=0-9A-Za-z_/+-])
1310 filter_type: [ ]
1311 min_line_len: 100
1312 required_substrings:
1313 - AAAAAAAAAAAAAAAAAAAAA
1314 target:
1315 - code
1316 - doc
1317
1318- name: PlanetScale Credentials
1319 severity: high
1320 confidence: moderate
1321 type: pattern
1322 values:
1323 - (?P<value>pscale_(tkn|oauth|pw)_[.0-9A-Za-z_-]{32,64})
1324 filter_type:
1325 - ValuePatternCheck
1326 min_line_len: 42
1327 required_substrings:
1328 - pscale_
1329 target:
1330 - code
1331 - doc
1332
1333- name: NewRelic Credentials
1334 severity: high
1335 confidence: moderate
1336 type: pattern
1337 values:
1338 - (?P<value>NRAK-[0-9A-Z]{27}|NRBR-[0-9a-f]{19,20}|NRII-[0-9A-Za-z_-]{25}|NRJS-[0-9a-z]{19}|[0-9a-z]{5}[0-9a-f]{31}NRAL)
1339 filter_type:
1340 - ValuePatternCheck
1341 - ValueMorphemesCheck
1342 min_line_len: 24
1343 required_substrings:
1344 - NRAK-
1345 - NRBR-
1346 - NRII-
1347 - NRJS-
1348 - NRAL
1349 target:
1350 - code
1351 - doc
1352
1353- name: Linear API Key
1354 severity: high
1355 confidence: moderate
1356 type: pattern
1357 values:
1358 - (?P<value>lin_api_[0-9A-Za-z]{40})
1359 filter_type:
1360 - ValuePatternCheck
1361 min_line_len: 48
1362 required_substrings:
1363 - lin_api_
1364 target:
1365 - code
1366 - doc
1367
1368- name: CloudFlare API Token
1369 severity: high
1370 confidence: moderate
1371 type: pattern
1372 values:
1373 - (?P<value>cf(at|ut|k)_[0-9A-Za-z]{48})
1374 filter_type:
1375 - ValuePatternCheck
1376 - ValueMorphemesCheck
1377 min_line_len: 24
1378 required_substrings:
1379 - cfat_
1380 - cfut_
1381 - cfk_
1382 target:
1383 - code
1384 - doc
1385
1386- name: Age Secret Key
1387 severity: high
1388 confidence: strong
1389 type: pattern
1390 values:
1391 - (?P<value>AGE-SECRET-KEY-1[0-9A-Z]{58})
1392 filter_type:
1393 - ValueBech32Check
1394 min_line_len: 74
1395 required_substrings:
1396 - AGE-SECRET-KEY-1
1397 target:
1398 - code
1399 - doc
1400
1401- name: Dropbox App secret
1402 severity: info
1403 confidence: weak
1404 type: pattern
1405 values:
1406 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1407 filter_type: WeirdBase36Token
1408 min_line_len: 15
1409 required_regex: "[0-9A-Za-z_-]{15}"
1410 target:
1411 - code
1412 - doc
1413
1414- name: Hashicorp Vault Token
1415 severity: high
1416 confidence: strong
1417 type: pattern
1418 values:
1419 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1420 filter_type:
1421 - ValuePatternCheck
1422 - ValueEntropyBase64Check
1423 min_line_len: 90
1424 required_substrings:
1425 - hvb.
1426 - hvr.
1427 - hvs.
1428 target:
1429 - code
1430 - doc
1431
1432- name: Hashicorp Terraform Token
1433 severity: high
1434 confidence: strong
1435 type: pattern
1436 values:
1437 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1438 filter_type:
1439 - ValuePatternCheck
1440 - ValueMorphemesCheck
1441 min_line_len: 90
1442 required_substrings:
1443 - .atlasv1.
1444 target:
1445 - code
1446 - doc
1447
1448- name: Airtable API Key
1449 severity: high
1450 confidence: moderate
1451 type: pattern
1452 values:
1453 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>pat[0-9A-Za-z]{14}\.[0-9a-f]{64})(?![=0-9A-Za-z_+-])
1454 filter_type:
1455 - ValuePatternCheck
1456 - ValueMorphemesCheck
1457 min_line_len: 82
1458 required_substrings:
1459 - pat
1460 target:
1461 - code
1462 - doc
1463
1464- name: NKEY Seed
1465 severity: high
1466 confidence: weak
1467 type: pattern
1468 values:
1469 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1470 filter_type:
1471 - ValueMorphemesCheck
1472 - ValuePatternCheck
1473 - ValueEntropyBase32Check
1474 - ValueBase32DataCheck
1475 - ValueTokenBase32Check
1476 min_line_len: 42
1477 required_substrings:
1478 - SA
1479 - SC
1480 - SN
1481 - SO
1482 - SP
1483 - SU
1484 - SX
1485 required_regex: "[0-9A-Za-z_-]{15}"
1486 target:
1487 - code
1488 - doc
1489
1490- name: OTP / 2FA Secret
1491 severity: info
1492 confidence: weak
1493 type: pattern
1494 values:
1495 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1496 filter_type:
1497 - ValueMorphemesCheck
1498 - ValuePatternCheck
1499 - ValueEntropyBase32Check
1500 - ValueBase32DataCheck
1501 - ValueTokenBase32Check
1502 - ValueBase64PartCheck
1503 min_line_len: 16
1504 required_regex: "[0-9A-Za-z_-]{15}"
1505 target:
1506 - code
1507 - doc
1508
1509- name: OpenAI Token
1510 severity: high
1511 confidence: strong
1512 type: pattern
1513 values:
1514 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1515 filter_type:
1516 - ValuePatternCheck
1517 - ValueMorphemesCheck
1518 min_line_len: 51
1519 required_substrings:
1520 - T3BlbkFJ
1521 - 9wZW5BS
1522 - PcGVuQU
1523 target:
1524 - code
1525 - doc
1526
1527- name: Docker Access Token
1528 severity: high
1529 confidence: strong
1530 type: pattern
1531 values:
1532 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1533 filter_type:
1534 - ValuePatternCheck
1535 - ValueMorphemesCheck
1536 min_line_len: 36
1537 required_substrings:
1538 - dckr_pat_
1539 - dckr_oat_
1540 target:
1541 - code
1542 - doc
1543
1544- name: Docker Swarm Token
1545 severity: high
1546 confidence: strong
1547 type: pattern
1548 values:
1549 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1550 filter_type:
1551 - ValuePatternCheck
1552 - ValueMorphemesCheck
1553 min_line_len: 85
1554 required_substrings:
1555 - SWMTKN-1-
1556 target:
1557 - code
1558 - doc
1559
1560- name: Docker Swarm Key
1561 severity: high
1562 confidence: strong
1563 type: pattern
1564 values:
1565 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1566 filter_type:
1567 - ValuePatternCheck
1568 - ValueMorphemesCheck
1569 min_line_len: 52
1570 required_substrings:
1571 - SWMKEY-1-
1572 target:
1573 - code
1574 - doc
1575
1576- name: Groq API Key
1577 severity: high
1578 confidence: strong
1579 type: pattern
1580 values:
1581 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1582 filter_type:
1583 - ValuePatternCheck
1584 min_line_len: 56
1585 required_substrings:
1586 - WGdyb3FY
1587 - hncm9xW
1588 - YZ3JvcV
1589 target:
1590 - code
1591 - doc
1592
1593- name: X AI API Key
1594 severity: high
1595 confidence: moderate
1596 type: pattern
1597 values:
1598 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1599 filter_type:
1600 - ValuePatternCheck
1601 - ValueEntropyBase64Check
1602 min_line_len: 84
1603 required_substrings:
1604 - xai-
1605 target:
1606 - code
1607 - doc
1608
1609- name: Notion Integration Token
1610 severity: high
1611 confidence: strong
1612 type: pattern
1613 values:
1614 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1615 filter_type:
1616 - ValuePatternCheck
1617 - ValueEntropyBase64Check
1618 min_line_len: 50
1619 required_substrings:
1620 - ntn_
1621 target:
1622 - code
1623 - doc
1624
1625- name: Hugging Face User Access Token
1626 severity: high
1627 confidence: moderate
1628 type: pattern
1629 values:
1630 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1631 filter_type:
1632 - ValuePatternCheck
1633 - ValueEntropyBase64Check
1634 min_line_len: 37
1635 required_substrings:
1636 - hf_
1637 target:
1638 - code
1639 - doc
1640
1641- name: Anthropic API Key
1642 severity: high
1643 confidence: strong
1644 type: pattern
1645 values:
1646 - (?P<value>sk-ant-(api|admin)0[1-4]-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1647 filter_type:
1648 - ValuePatternCheck
1649 min_line_len: 77
1650 required_substrings:
1651 - sk-ant-
1652 target:
1653 - code
1654 - doc
1655
1656- name: Perplexity API Key
1657 severity: high
1658 confidence: strong
1659 type: pattern
1660 values:
1661 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1662 filter_type:
1663 - ValuePatternCheck
1664 min_line_len: 45
1665 required_substrings:
1666 - pplx-
1667 target:
1668 - code
1669 - doc
1670
1671- name: Tailscale Credentials
1672 severity: high
1673 confidence: strong
1674 type: pattern
1675 values:
1676 - (?P<value>tskey-(api|auth|client|scim|webhook)-[0-9A-Za-z]{12,24}-[0-9A-Za-z]{32})
1677 filter_type:
1678 - ValuePatternCheck
1679 min_line_len: 61
1680 required_substrings:
1681 - tskey-
1682 target:
1683 - code
1684 - doc
1685
1686- name: Contentful Credentials
1687 severity: high
1688 confidence: strong
1689 type: pattern
1690 values:
1691 - (?P<value>CFPAT-[0-9A-Za-z_-]{43})(?![0-9A-Za-z_-])
1692 filter_type:
1693 - ValuePatternCheck
1694 min_line_len: 49
1695 required_substrings:
1696 - CFPAT-
1697 target:
1698 - code
1699 - doc
1700
1701- name: Pulumi Personal Access Token
1702 severity: high
1703 confidence: strong
1704 type: pattern
1705 values:
1706 - (?P<value>pul-[0-9a-f]{40})
1707 filter_type:
1708 - ValuePatternCheck
1709 min_line_len: 44
1710 required_substrings:
1711 - pul-
1712 target:
1713 - code
1714 - doc
1715
1716- name: DeepSeek API Key
1717 severity: high
1718 confidence: moderate
1719 type: pattern
1720 values:
1721 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1722 filter_type:
1723 - ValuePatternCheck
1724 min_line_len: 35
1725 required_substrings:
1726 - sk-
1727 target:
1728 - code
1729 - doc
1730
1731- name: Tavily API Key
1732 severity: high
1733 confidence: strong
1734 type: pattern
1735 values:
1736 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1737 filter_type:
1738 - ValuePatternCheck
1739 min_line_len: 37
1740 required_substrings:
1741 - tvly-
1742 target:
1743 - code
1744 - doc
1745
1746- name: Figma Personal Access Token
1747 severity: high
1748 confidence: strong
1749 type: pattern
1750 values:
1751 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1752 filter_type:
1753 - ValuePatternCheck
1754 min_line_len: 45
1755 required_substrings:
1756 - figd_
1757 target:
1758 - code
1759 - doc
1760
1761- name: 1Password Account Token
1762 severity: high
1763 confidence: strong
1764 type: pattern
1765 values:
1766 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1767 filter_type:
1768 - ValuePatternCheck
1769 min_line_len: 192
1770 required_substrings:
1771 - InNlY3JldEtleSI6
1772 - JzZWNyZXRLZXkiO
1773 - ic2VjcmV0S2V5Ij
1774 target:
1775 - code
1776 - doc
1777
1778- name: Brevo API Key
1779 severity: high
1780 confidence: strong
1781 type: pattern
1782 values:
1783 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1784 filter_type:
1785 - ValuePatternCheck
1786 min_line_len: 89
1787 required_substrings:
1788 - xkeysib-
1789 target:
1790 - code
1791 - doc
1792
1793- name: Together AI API Key
1794 severity: high
1795 confidence: strong
1796 type: pattern
1797 values:
1798 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1799 filter_type:
1800 - ValuePatternCheck
1801 min_line_len: 50
1802 required_substrings:
1803 - tgp_v1_
1804 target:
1805 - code
1806 - doc
1807
1808- name: LLAMA API Key
1809 severity: high
1810 confidence: strong
1811 type: pattern
1812 values:
1813 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1814 filter_type:
1815 - ValuePatternCheck
1816 min_line_len: 52
1817 required_substrings:
1818 - llx-
1819 target:
1820 - code
1821 - doc
1822
1823- name: SonarQube Credentials
1824 severity: medium
1825 confidence: moderate
1826 type: pattern
1827 values:
1828 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1829 filter_type:
1830 - ValuePatternCheck
1831 min_line_len: 44
1832 required_substrings:
1833 - sqa_
1834 - sqp_
1835 - squ_
1836 target:
1837 - code
1838 - doc
1839
1840- name: Sentry Organization Auth Token
1841 severity: high
1842 confidence: strong
1843 type: pattern
1844 values:
1845 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1846 filter_type:
1847 - ValuePatternCheck
1848 min_line_len: 37
1849 required_substrings:
1850 - sntrys_eyJ
1851 target:
1852 - code
1853 - doc
1854
1855- name: Sentry User Auth Token
1856 severity: high
1857 confidence: strong
1858 type: pattern
1859 values:
1860 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1861 filter_type:
1862 - ValuePatternCheck
1863 min_line_len: 37
1864 required_substrings:
1865 - sntryu_
1866 target:
1867 - code
1868 - doc
1869
1870- name: Discord Bot Token
1871 severity: high
1872 confidence: strong
1873 type: pattern
1874 values:
1875 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1876 filter_type:
1877 - ValueDiscordBotCheck
1878 min_line_len: 62
1879 required_substrings:
1880 - M
1881 - N
1882 - O
1883 required_regex: "[0-9A-Za-z_-]{15}"
1884 target:
1885 - code
1886 - doc
1887
1888- name: Discord Webhook
1889 severity: medium
1890 confidence: strong
1891 type: pattern
1892 values:
1893 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1894 filter_type:
1895 - ValueMorphemesCheck
1896 min_line_len: 61
1897 required_substrings:
1898 - discordapp.com/api/webhooks
1899 - discord.com/api/webhooks
1900 target:
1901 - code
1902 - doc
1903
1904- name: Nylas API Key
1905 severity: high
1906 confidence: strong
1907 type: pattern
1908 values:
1909 - (?P<value>nyk_v0_[0-9A-Za-z_-]{64})
1910 filter_type: TokenPattern
1911 min_line_len: 71
1912 required_substrings:
1913 - nyk_v0_
1914 target:
1915 - code
1916 - doc
1917
1918- name: WakaTime API Key
1919 severity: high
1920 confidence: strong
1921 type: pattern
1922 values:
1923 - (?P<value>waka_[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1924 filter_type: TokenPattern
1925 min_line_len: 40
1926 required_substrings:
1927 - waka_
1928 target:
1929 - code
1930 - doc
1931
1932- name: Riot Games API Key
1933 severity: high
1934 confidence: strong
1935 type: pattern
1936 values:
1937 - (?P<value>RGAPI-[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1938 filter_type: TokenPattern
1939 min_line_len: 41
1940 required_substrings:
1941 - RGAPI-
1942 target:
1943 - code
1944 - doc
1945
1946- name: SourceGraph Credentials
1947 severity: medium
1948 confidence: moderate
1949 type: pattern
1950 values:
1951 - (?P<value>sgp_(local_|[0-9a-f]{16}_)?[0-9a-f]{40})
1952 filter_type: TokenPattern
1953 min_line_len: 44
1954 required_substrings:
1955 - sgp_
1956 target:
1957 - code
1958 - doc
1959
1960- name: Typeform API Personal Token
1961 severity: medium
1962 confidence: weak
1963 type: pattern
1964 values:
1965 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>tfp_[0-9A-Za-z_-]{56,60})(?![0-9A-Za-z_-])
1966 filter_type: TokenPattern
1967 min_line_len: 60
1968 required_substrings:
1969 - tfp_
1970 target:
1971 - code
1972 - doc
1973
1974- name: Vercel Token
1975 severity: medium
1976 confidence: weak
1977 type: pattern
1978 values:
1979 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
1980 filter_type: TokenPattern
1981 min_line_len: 60
1982 required_substrings:
1983 - vcp_
1984 target:
1985 - code
1986 - doc
1987
1988- name: Netlify Token
1989 severity: medium
1990 confidence: weak
1991 type: pattern
1992 values:
1993 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
1994 filter_type: TokenPattern
1995 min_line_len: 40
1996 required_substrings:
1997 - nfp_
1998 target:
1999 - code
2000 - doc
2001
2002- name: PostHog Credentials
2003 severity: medium
2004 confidence: weak
2005 type: pattern
2006 values:
2007 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
2008 filter_type: TokenPattern
2009 min_line_len: 44
2010 required_substrings:
2011 - phx_
2012 - phs_
2013 - phr_
2014 - pha_
2015 - phc_
2016 target:
2017 - code
2018 - doc
2019
2020- name: RubyGems API Key
2021 severity: medium
2022 confidence: strong
2023 type: pattern
2024 values:
2025 - (?P<value>rubygems_[0-9a-f]{48})
2026 filter_type: TokenPattern
2027 min_line_len: 57
2028 required_substrings:
2029 - rubygems_
2030 target:
2031 - code
2032 - doc
2033
2034- name: Databricks Access Token
2035 severity: medium
2036 confidence: strong
2037 type: pattern
2038 values:
2039 - (?P<value>dapi[0-9a-f]{32})
2040 filter_type: TokenPattern
2041 min_line_len: 36
2042 required_substrings:
2043 - dapi
2044 target:
2045 - code
2046 - doc
2047
2048- name: Tencent WeChat API App ID
2049 severity: medium
2050 confidence: weak
2051 type: pattern
2052 values:
2053 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
2054 filter_type: TokenPattern
2055 min_line_len: 18
2056 required_substrings:
2057 - wx
2058 target:
2059 - code
2060 - doc
2061
2062- name: WunderGraph API Key
2063 severity: medium
2064 confidence: strong
2065 type: pattern
2066 values:
2067 - (?P<value>cosmo_[0-9a-f]{32})
2068 filter_type: TokenPattern
2069 min_line_len: 38
2070 required_substrings:
2071 - cosmo_
2072 target:
2073 - code
2074 - doc
2075
2076- name: Supabase Credentials
2077 severity: medium
2078 confidence: strong
2079 type: pattern
2080 values:
2081 - (?P<value>sbp_(v0_)?[0-9a-f]{40})
2082 filter_type: TokenPattern
2083 min_line_len: 44
2084 required_substrings:
2085 - sbp_
2086 target:
2087 - code
2088 - doc
2089
2090- name: Salesforce Credentials
2091 severity: medium
2092 confidence: weak
2093 type: pattern
2094 values:
2095 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
2096 filter_type:
2097 - ValuePatternCheck(9)
2098 - ValueNumberCheck
2099 - ValueBase64PartCheck
2100 min_line_len: 12
2101 required_substrings:
2102 - "3MVG"
2103 - "00D"
2104 target:
2105 - code
2106 - doc
2107
2108- name: Postman Credentials
2109 severity: medium
2110 confidence: moderate
2111 type: pattern
2112 values:
2113 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
2114 filter_type:
2115 - ValuePatternCheck
2116 min_line_len: 29
2117 required_substrings:
2118 - PMAK-
2119 - PMAT-
2120 target:
2121 - code
2122 - doc
2123
2124- name: NTLM Token
2125 severity: medium
2126 confidence: strong
2127 type: pattern
2128 values:
2129 - (?P<value>TlRMTVNTUAA[BCD]AAAA[=0-9A-Za-z_/+-]{28,8000})(?![0-9A-Za-z_/+-])
2130 filter_type:
2131 - ValueMorphemesCheck(2)
2132 - ValuePatternCheck
2133 min_line_len: 44
2134 required_substrings:
2135 - TlRMTVNTUAA
2136 target:
2137 - doc
2138 - code
2139
2140- name: Basic Authorization
2141 severity: medium
2142 confidence: strong
2143 type: pattern
2144 values:
2145 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
2146 filter_type:
2147 - ValueBasicAuthCheck
2148 min_line_len: 14
2149 required_substrings:
2150 - basic
2151 target:
2152 - code
2153 - doc
2154
2155- name: Bearer Authorization
2156 severity: medium
2157 confidence: moderate
2158 type: pattern
2159 values:
2160 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
2161 filter_type: GeneralKeyword
2162 min_line_len: 37
2163 required_substrings:
2164 - bearer
2165 - ntlm
2166 target:
2167 - code
2168 - doc
2169
2170- name: SQL Password
2171 severity: medium
2172 confidence: weak
2173 type: pattern
2174 values:
2175 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
2176 filter_type:
2177 - ValueAllowlistCheck
2178 - ValuePatternCheck
2179 min_line_len: 8
2180 required_substrings:
2181 - password
2182 - identified
2183 use_ml: true
2184 target:
2185 - doc
2186 - code
2187
2188- name: CURL Options
2189 severity: high
2190 confidence: weak
2191 type: pattern
2192 values:
2193 - (?P<variable>CURLOPT_(XOAUTH2_BEARER|(?:PROXY)?PASSWORD|(?:PROXY)?USERPWD)|KEYPASSWD)\s*,\s*(?P<value_leftquote>")(?P<value>[^"]{4,8000})(?P<value_rightquote>")?
2194 filter_type: GeneralKeyword
2195 min_line_len: 32
2196 required_substrings:
2197 - CURLOPT_XOAUTH2_BEARER
2198 - CURLOPT_PASSWORD
2199 - CURLOPT_USERPWD
2200 - CURLOPT_PROXYPASSWORD
2201 - CURLOPT_PROXYUSERPWD
2202 - CURLOPT_KEYPASSWD
2203 use_ml: true
2204 target:
2205 - doc
2206 - code
2207
2208- name: CURL User Password
2209 severity: high
2210 confidence: moderate
2211 type: pattern
2212 values:
2213 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2214 filter_type: GeneralKeyword
2215 min_line_len: 16
2216 required_substrings:
2217 - curl
2218 use_ml: true
2219 target:
2220 - doc
2221 - code
2222
2223- name: CMD ConvertTo-SecureString
2224 severity: high
2225 confidence: moderate
2226 type: pattern
2227 values:
2228 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2229 filter_type: GeneralKeyword
2230 min_line_len: 27
2231 required_substrings:
2232 - convertto-securestring
2233 use_ml: true
2234 target:
2235 - doc
2236 - code
2237
2238- name: CMD Password
2239 severity: high
2240 confidence: moderate
2241 type: pattern
2242 values:
2243 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2244 filter_type: GeneralKeyword
2245 min_line_len: 12
2246 required_substrings:
2247 - pass
2248 use_ml: true
2249 target:
2250 - doc
2251 - code
2252
2253- name: CMD Token
2254 severity: high
2255 confidence: moderate
2256 type: pattern
2257 values:
2258 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2259 filter_type: GeneralKeyword
2260 min_line_len: 12
2261 required_substrings:
2262 - token
2263 - oauth2-bearer
2264 use_ml: true
2265 target:
2266 - doc
2267 - code
2268
2269- name: CMD Secret
2270 severity: high
2271 confidence: moderate
2272 type: pattern
2273 values:
2274 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2275 filter_type: GeneralKeyword
2276 min_line_len: 12
2277 required_substrings:
2278 - secret
2279 use_ml: true
2280 target:
2281 - doc
2282 - code
2283
2284- name: URL Credentials
2285 severity: high
2286 confidence: moderate
2287 type: pattern
2288 values:
2289 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
2290 filter_type: UrlCredentialsGroup
2291 min_line_len: 10
2292 required_substrings:
2293 - ://
2294 use_ml: true
2295 target:
2296 - doc
2297 - code
2298
2299- name: API
2300 severity: low
2301 confidence: moderate
2302 type: keyword
2303 values:
2304 - api(?!tal)
2305 filter_type: GeneralKeyword
2306 min_line_len: 11
2307 required_substrings:
2308 - api
2309 use_ml: true
2310 target:
2311 - code
2312
2313- name: Auth
2314 severity: medium
2315 confidence: moderate
2316 type: keyword
2317 values:
2318 - auth(?!ors?(?!i[tz]))
2319 filter_type: GeneralKeyword
2320 min_line_len: 12
2321 required_substrings:
2322 - auth
2323 use_ml: true
2324 target:
2325 - code
2326
2327- name: Credential
2328 severity: medium
2329 confidence: moderate
2330 type: keyword
2331 values:
2332 - credential
2333 filter_type: GeneralKeyword
2334 min_line_len: 18
2335 required_substrings:
2336 - credential
2337 use_ml: true
2338 target:
2339 - code
2340
2341- name: Key
2342 severity: high
2343 confidence: moderate
2344 type: keyword
2345 values:
2346 - key(?!word|board|pad|name)
2347 filter_type: GeneralKeyword
2348 min_line_len: 11
2349 required_substrings:
2350 - key
2351 use_ml: true
2352 target:
2353 - code
2354
2355- name: Nonce
2356 severity: low
2357 confidence: moderate
2358 type: keyword
2359 values:
2360 - (?<!\\)nonce
2361 filter_type: GeneralKeyword
2362 min_line_len: 13
2363 required_substrings:
2364 - nonce
2365 use_ml: true
2366 target:
2367 - code
2368
2369- name: Password
2370 severity: high
2371 confidence: moderate
2372 type: keyword
2373 values:
2374 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
2375 filter_type: PasswordKeyword
2376 min_line_len: 10
2377 required_substrings:
2378 - pass
2379 - pasw
2380 - pssw
2381 - psw
2382 - pw
2383 use_ml: true
2384 target:
2385 - code
2386
2387- name: Salt
2388 severity: low
2389 confidence: moderate
2390 type: keyword
2391 values:
2392 - salt
2393 filter_type: GeneralKeyword
2394 min_line_len: 12
2395 required_substrings:
2396 - salt
2397 use_ml: true
2398 target:
2399 - code
2400
2401- name: Secret
2402 severity: medium
2403 confidence: moderate
2404 type: keyword
2405 values:
2406 - secret
2407 filter_type: GeneralKeyword
2408 min_line_len: 14
2409 required_substrings:
2410 - secret
2411 use_ml: true
2412 target:
2413 - code
2414
2415- name: Token
2416 severity: high
2417 confidence: moderate
2418 type: keyword
2419 values:
2420 - token(?!ize)
2421 filter_type: GeneralKeyword
2422 min_line_len: 13
2423 required_substrings:
2424 - token
2425 use_ml: true
2426 target:
2427 - code