1- name: DOC_GET
2 severity: medium
3 confidence: moderate
4 type: pattern
5 values:
6 - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!e[dns]|ing|ion|age)|pswd|\bpwd?\b|token(?!ize)|secret|key(?!word|board|pad)|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+|[\"'\\]*(\\*([\"']|&(quot|apos|#3[49]);)){0,4}(\w*(?i:(?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,64})|\bpwd?\b|token|secret|key|cred)\w*))(\\*([\"']|&(quot|apos|#3[49]);)){0,4})\s*(,(\s*default\s*=)?|\)\s*or)\s*([brufl@]{1,2}(?=\\*[\"'&]))?(?P<lq>(\\*([\"']|&(quot|apos|#3[49]);)){1,4})(?P<value>(.(?!(?P=lq))){4,8000}.?)
7 filter_type:
8 - ValueAllowlistCheck
9 - ValueBlocklistCheck
10 - LineGitBinaryCheck
11 - LineUUEPartCheck
12 - ValueFilePathCheck
13 - ValuePatternCheck(5)
14 min_line_len: 8
15 required_substrings:
16 - pass
17 - pswd
18 - pw
19 - token
20 - secret
21 - key
22 - cred
23 - 비밀번호
24 - 비번
25 - 패스워드
26 - 암호
27 - 키
28 - 토큰
29 use_ml: true
30 target:
31 - doc
32
33- name: DOC_CREDENTIALS
34 severity: medium
35 confidence: moderate
36 type: pattern
37 values:
38 - (?P<wrap>[\"'`(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!e[dns]|ing|ion|age)|pswd|pwd?\b|\bp/w\b|token(?!ize)|secret|key(?!word|board|pad)|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[\"'`]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])\s*)(?P<quote>[\"'`]{1,6})?(?P<value>(?(quote)(?(wrap)[^\"'`)]{4,8000}|[^\"'`]{4,8000})|(?(wrap)[^\"'`)]{4,8000}|\S{4,8000})))
39 filter_type:
40 - ValueAllowlistCheck
41 - ValueBlocklistCheck
42 - LineGitBinaryCheck
43 - LineUUEPartCheck
44 - ValueFilePathCheck
45 - ValuePatternCheck(5)
46 - ValueSealedSecretCheck
47 min_line_len: 8
48 required_substrings:
49 - pass
50 - sword
51 - pswd
52 - pw
53 - p/w
54 - paasw
55 - 비밀번호
56 - 비번
57 - 패스워드
58 - 암호
59 - token
60 - secret
61 - key
62 - credential
63 - 키
64 - 토큰
65 use_ml: true
66 target:
67 - doc
68
69- name: SECRET_PAIR
70 severity: medium
71 confidence: moderate
72 type: pattern
73 values:
74 - (?P<variable>[\"'`]?(?i:token|secret|key|키|암호화?|토큰)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
75 filter_type:
76 - ValueAllowlistCheck
77 - ValuePatternCheck(4)
78 - ValueEntropyBase64Check
79 - ValueMorphemesCheck
80 - ValueSealedSecretCheck
81 min_line_len: 16
82 required_substrings:
83 - token
84 - secret
85 - key
86 - 키
87 - 암호
88 - 토큰
89 use_ml: true
90 target:
91 - doc
92
93- name: PASSWD_PAIR
94 severity: medium
95 confidence: moderate
96 type: pattern
97 values:
98 - (?P<variable>[\"'`]?(?i:(?<!id[ :/])pa[as]swo?r?ds?|pswd|pwd?|p/w|비밀번호|비번|패스워드|암호)[\"'`]?)((\s)*(?P<separator>설정은|:=|:(?!:)|=(>|>|(\\\\*u00|%)26gt;)|!==|!=|===|==|=~|=|(%|\\u00)3[dD])(\s)*)(?P<quote>[\"'`(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,64}(?(a)(?(b)(?(c)((?(quote)[^)\"'`]{1,8000}|([0-9A-Za-z/_+=~!@#$%^&*;:?-]{1,8000}|\b))|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)\"'`])
99 filter_type:
100 - ValueAllowlistCheck
101 - ValuePatternCheck(4)
102 - ValueDictionaryKeywordCheck
103 - LineGitBinaryCheck
104 - LineUUEPartCheck
105 - ValueFilePathCheck
106 - ValueHexNumberCheck
107 - ValueSealedSecretCheck
108 min_line_len: 10
109 required_substrings:
110 - pass
111 - sword
112 - pswd
113 - pw
114 - p/w
115 - paasw
116 - 비밀번호
117 - 비번
118 - 패스워드
119 - 암호
120 use_ml: true
121 target:
122 - doc
123
124- name: IP_ID_PASSWORD_TRIPLE
125 severity: medium
126 confidence: moderate
127 type: pattern
128 values:
129 - (^|\s|(?P<variable>(?i:\bip[\s/]{1,80}id[\s/]{1,80}pw[\s/:]{0,80}))|(?P<url>://))(?P<ip>(?<![0-9.])[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}\.[0-2]?[0-9]{1,2}(?![0-9.]))((\s*[(])?|(?(variable)[\s,/]{1,80}|(?(url)[,]|[,/])))\s*\w[\w.-]{3,80}[\s,/]{1,80}(?P<value>(?(url)(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_+=~!@#$%^&*;?-])){7,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)|(?-i:(?P<e>[A-Z])|(?P<f>[a-z])|(?P<g>[0-9/_+=~!@#$%^&*;?-])){7,64}(?(e)(?(f)(?(g)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x)))(?:\s|[^/]|$)
130 filter_type:
131 - ValueAllowlistCheck
132 - ValuePatternCheck(4)
133 - ValueDictionaryKeywordCheck
134 min_line_len: 10
135 required_substrings:
136 - "."
137 use_ml: true
138 target:
139 - doc
140
141- name: ID_PAIR_PASSWD_PAIR
142 severity: medium
143 confidence: moderate
144 type: pattern
145 values:
146 - (?P<ddash>--)?(?P<variable>\w*(?i:pa[as]swords?|passwd?|pswd|pwd|\bp/w|\bpw|비밀번호|비번|패스워드|암호))\s*?(?(ddash)[ =]|[:=/>-]{1,2})\s*(?P<quote>[\"'`]{1,8})?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)(?P=quote)|(\s|$))
147 - (?P<ddash>--)?(?P<variable>(?i:user\s*)?(?i:id|login|account|root|admin|user|name|wifi|role|host|default|계정|아이디))\s*?(?(ddash)[ =]|[ :=])\s*?(?P<value>\S+)
148 filter_type:
149 - ValueAllowlistCheck
150 - ValuePatternCheck(4)
151 min_line_len: 10
152 required_substrings:
153 - pass
154 - sword
155 - pswd
156 - p/w
157 - pw
158 - 비밀번호
159 - 비번
160 - 패스워드
161 - 암호
162 use_ml: true
163 target:
164 - doc
165
166- name: ID_PASSWD_PAIR
167 severity: medium
168 confidence: moderate
169 type: pattern
170 values:
171 - (?P<variable>[\w.-]{0,80}(?i:(?P<id>\bid\b)|id\b|user|name|계정|아이디)[\w.-]{0,80}(?(id)[ :(/]{1,80}|[:(/]{1,80})(?i:pa[as]swo?r?ds?|pswd|pwd?|비밀번호|비번|패스워드|암호))\)?(\s*->\s*|[ =:)(/]{1,80}|\s+is\s+|\s+are\s+|\s*는\s*|\s*은\s*|\s*설정은\s*)\(?(?P<id_value>[\w.-]{2,64})[ :\(/\"',]{1,80}(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){4,64}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))
172 filter_type:
173 - ValueAllowlistCheck
174 - ValuePatternCheck(4)
175 - ValueDictionaryKeywordCheck
176 min_line_len: 10
177 required_substrings:
178 - pw
179 - pswd
180 - pass
181 - sword
182 - 비밀번호
183 - 비번
184 - 패스워드
185 - 암호
186 use_ml: true
187 target:
188 - doc
189
190- name: UUID
191 severity: info
192 confidence: strong
193 type: pattern
194 values:
195 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-F]{8}(-[0-9A-F]{4}){3}-[0-9A-F]{12}|[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})(?![0-9A-Za-z_+-])
196 filter_type:
197 - ValuePatternCheck(4)
198 min_line_len: 36
199 required_substrings:
200 - "-"
201 required_regex: "[0-9A-Za-z_-]{15}"
202 use_ml: false
203 target:
204 - code
205 - doc
206
207- name: Product Activation Key
208 severity: info
209 confidence: weak
210 type: pattern
211 values:
212 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Z]{5}(-[0-9A-Z]{5}){4})(?![0-9A-Za-z_+-])
213 filter_type:
214 - ValuePatternCheck(5)
215 min_line_len: 29
216 required_substrings:
217 - "-"
218 required_regex: "[0-9A-Za-z_-]{15}"
219 use_ml: false
220 target:
221 - code
222 - doc
223
224- name: Akamai Credentials
225 severity: high
226 confidence: strong
227 type: pattern
228 values:
229 - (?P<value>akab-[0-9a-z]{16}-[0-9a-z]{16})(?!\.[0-9a-z-]{1,80}\.akamaiapis\.net)
230 filter_type: GeneralPattern
231 min_line_len: 38
232 required_substrings:
233 - akab-
234 target:
235 - code
236 - doc
237
238- name: Amazon Bedrock API Key
239 severity: high
240 confidence: moderate
241 type: pattern
242 values:
243 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABSK|bedrock-api-key-)[0-9A-Za-z/+]{28,800})(?![0-9A-Za-z/+])
244 filter_type: GeneralPattern
245 min_line_len: 44
246 required_substrings:
247 - ABSK
248 - bedrock-api-key-
249 target:
250 - code
251 - doc
252
253- name: AWS AppSync GraphQL API Key
254 severity: high
255 confidence: moderate
256 type: pattern
257 values:
258 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>da2-[a-z0-9]{26})(?![0-9A-Za-z/+])
259 filter_type: GeneralPattern
260 min_line_len: 40
261 required_substrings:
262 - da2-
263 target:
264 - code
265 - doc
266
267- name: AWS Client ID
268 severity: medium
269 confidence: moderate
270 type: pattern
271 values:
272 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(A3T[0-9A-Z]|ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
273 filter_type: GeneralPattern
274 min_line_len: 20
275 required_substrings:
276 - A3T
277 - ABIA
278 - ACCA
279 - AGPA
280 - AIDA
281 - AIPA
282 - AKIA
283 - ANPA
284 - ANVA
285 - AROA
286 - APKA
287 - ASCA
288 - ASIA
289 target:
290 - code
291 - doc
292
293- name: AWS Multi
294 severity: high
295 confidence: moderate
296 type: multi
297 values:
298 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>A(KIA|SIA)[0-9A-Z]{16})(?![0-9A-Za-z_])
299 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){40,44}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
300 filter_type:
301 - LineSpecificKeyCheck
302 - ValuePatternCheck
303 - ValueBase64PartCheck
304 - ValueMorphemesCheck
305 min_line_len: 20
306 required_substrings:
307 - AKIA
308 - ASIA
309 target:
310 - code
311 - doc
312
313- name: Alibaba Access Key ID
314 severity: medium
315 confidence: moderate
316 type: pattern
317 values:
318 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
319 filter_type: GeneralPattern
320 min_line_len: 16
321 required_substrings:
322 - LTAI
323 target:
324 - code
325 - doc
326
327- name: Alibaba Multi
328 severity: high
329 confidence: moderate
330 type: multi
331 values:
332 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>LTAI[0-9A-Za-z]{12,20})(?![0-9A-Za-z_+-])
333 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/+])){30}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))(?![0-9A-Za-z/+])
334 filter_type:
335 - LineSpecificKeyCheck
336 - ValuePatternCheck
337 - ValueBase64PartCheck
338 - ValueMorphemesCheck
339 min_line_len: 20
340 required_substrings:
341 - LTAI
342 target:
343 - code
344 - doc
345
346- name: AWS MWS Key
347 severity: high
348 confidence: strong
349 type: pattern
350 values:
351 - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
352 filter_type: GeneralPattern
353 min_line_len: 30
354 required_substrings:
355 - amzn.mws.
356 target:
357 - code
358 - doc
359
360- name: Defined Networking API Key
361 severity: high
362 confidence: strong
363 type: pattern
364 values:
365 - (?P<value>dnkey-[A-Z2-7]{26}-[A-Z2-7]{52})
366 filter_type: GeneralPattern
367 min_line_len: 85
368 required_substrings:
369 - dnkey-
370 target:
371 - code
372 - doc
373
374- name: Dynatrace API Token
375 severity: high
376 confidence: moderate
377 type: pattern
378 values:
379 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[a-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
380 filter_type: TokenPattern
381 min_line_len: 90
382 required_substrings:
383 - dt0
384 target:
385 - code
386 - doc
387
388- name: Doppler API Key
389 severity: high
390 confidence: strong
391 type: pattern
392 values:
393 - (?P<value>dp\.(pt|st|ct|sa|scim|audit)\.[0-9A-Za-z]{43})
394 filter_type: GeneralPattern
395 min_line_len: 49
396 required_substrings:
397 - dp.
398 target:
399 - code
400 - doc
401
402- name: Facebook Access Token
403 severity: high
404 confidence: moderate
405 type: pattern
406 values:
407 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
408 filter_type:
409 - ValuePatternCheck
410 - ValueBase64PartCheck
411 - ValueNotPartEncodedCheck
412 min_line_len: 80
413 required_substrings:
414 - EAA
415 target:
416 - code
417 - doc
418
419- name: Facebook App Token
420 severity: high
421 confidence: moderate
422 type: pattern
423 values:
424 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
425 filter_type: TokenPattern
426 min_line_len: 33
427 required_substrings:
428 - "|"
429 required_regex: "[0-9A-Za-z_-]{15}"
430 target:
431 - code
432 - doc
433
434- name: Google API Key
435 severity: high
436 confidence: moderate
437 type: pattern
438 values:
439 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
440 filter_type: TokenPattern
441 min_line_len: 39
442 required_substrings:
443 - AIza
444 target:
445 - code
446 - doc
447
448- name: Google Multi
449 severity: high
450 confidence: moderate
451 type: multi
452 values:
453 - (?P<value>[0-9]{3,80}-[0-9a-z_]{32}\.apps\.googleusercontent\.com)
454 - \b(?P<value>GOCSPX-[0-9A-Za-z_-]{28}|((?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9_-])){24,80}(?(a)(?(b)(?(c)\b|(?!x)x)|(?!x)x)|(?!x)x))
455 filter_type: GeneralPattern
456 min_line_len: 40
457 required_substrings:
458 - .apps.googleusercontent.com
459 target:
460 - code
461 - doc
462
463- name: Google OAuth Secret
464 severity: high
465 confidence: strong
466 type: pattern
467 values:
468 - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
469 filter_type: TokenPattern
470 min_line_len: 40
471 required_substrings:
472 - GOCSPX-
473 target:
474 - code
475 - doc
476
477- name: Google OAuth Access Token
478 severity: high
479 confidence: moderate
480 type: pattern
481 values:
482 - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
483 filter_type: TokenPattern
484 min_line_len: 27
485 required_substrings:
486 - ya29.
487 target:
488 - code
489 - doc
490
491- name: Google OAuth Refresh Token
492 severity: medium
493 confidence: weak
494 type: pattern
495 values:
496 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>1//0[0-9A-Za-z_-]{80,8000})
497 filter_type: TokenPattern
498 min_line_len: 84
499 required_substrings:
500 - 1//0
501 target:
502 - code
503 - doc
504
505- name: Heroku Credentials
506 severity: high
507 confidence: strong
508 type: pattern
509 values:
510 - (?P<value>HRKU-([0-9A-Za-z_-]{60}|[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12}))
511 filter_type: TokenPattern
512 min_line_len: 41
513 required_substrings:
514 - HRKU-
515 target:
516 - code
517 - doc
518
519- name: Instagram Access Token
520 severity: high
521 confidence: strong
522 type: pattern
523 values:
524 - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
525 filter_type: TokenPattern
526 min_line_len: 105
527 required_substrings:
528 - IGQVJ
529 target:
530 - code
531 - doc
532
533- name: PASETO Token
534 severity: medium
535 confidence: moderate
536 type: pattern
537 values:
538 - (?P<value>v[1-4]\.(public|local)\.[0-9A-Za-z_-]{15,8000}(\.[0-9A-Za-z_-]{0,8000})?)
539 filter_type:
540 - ValuePatternCheck
541 min_line_len: 64
542 required_substrings:
543 - .public.
544 - .local.
545 target:
546 - code
547 - doc
548
549- name: PASERK Keys
550 severity: high
551 confidence: strong
552 type: pattern
553 values:
554 - (?P<value>k[1-4]\.(local|secret)(-pw)?\.[0-9A-Za-z_-]{15,8000})
555 filter_type:
556 - ValuePatternCheck
557 min_line_len: 64
558 required_substrings:
559 - local
560 - secret
561 target:
562 - code
563 - doc
564
565- name: JSON Web Token
566 severity: medium
567 confidence: strong
568 type: pattern
569 values:
570 - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
571 filter_type:
572 - ValueJsonWebTokenCheck
573 min_line_len: 64
574 required_substrings:
575 - eyJ
576 target:
577 - code
578 - doc
579
580- name: JSON Web Key
581 severity: medium
582 confidence: strong
583 type: pattern
584 values:
585 - (?P<value>\b(e(yJ|yAi|woi|wog|w0K)|W(yJ|3si|wp7|wog|w0K|3sK))[0-9A-Za-z_+/-]{60,8000})
586 filter_type:
587 - ValueJsonWebKeyCheck
588 min_line_len: 64
589 required_substrings:
590 - eyJ
591 - eyAi
592 - ewoi
593 - ewog
594 - ew0K
595 - WyJ
596 - W3si
597 - Wwp7
598 - Wwog
599 - Ww0K
600 - W3sK
601 target:
602 - code
603 - doc
604
605- name: JWK
606 severity: medium
607 confidence: moderate
608 type: multi
609 values:
610 - (?P<value>['"]?\b(?P<variable>kty)[^0-9A-Za-z_-]{1,8}(RSA|EC|oct)\b['"]?)
611 - (?P<variable>\b[dk])[^0-9A-Za-z_-]{1,8}(?P<value>[0-9A-Za-z_-]{22,8000})(?![=0-9A-Za-z_-])
612 filter_type:
613 - ValuePatternCheck
614 - ValueMorphemesCheck
615 min_line_len: 8
616 required_substrings:
617 - kty
618 target:
619 - code
620 - doc
621
622- name: MailChimp API Key
623 severity: high
624 confidence: moderate
625 type: pattern
626 values:
627 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
628 filter_type: TokenPattern
629 min_line_len: 35
630 required_substrings:
631 - -us
632 target:
633 - code
634 - doc
635
636- name: MailGun API Key
637 severity: high
638 confidence: moderate
639 type: pattern
640 values:
641 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9a-z]{32}|[0-9a-f]{32}-[0-9a-f]{8}-[0-9a-f]{8})(?![0-9A-Za-z_-])
642 filter_type: TokenPattern
643 min_line_len: 36
644 required_substrings:
645 - "-"
646 - key-
647 required_regex: "[0-9A-Za-z_-]{15}"
648 target:
649 - code
650 - doc
651
652- name: PayPal Braintree Access Token
653 severity: high
654 confidence: strong
655 type: pattern
656 values:
657 - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})(?![0-9A-Za-z_-])
658 filter_type: GeneralPattern
659 min_line_len: 72
660 required_substrings:
661 - access_token$production$
662 target:
663 - code
664 - doc
665
666- name: PEM Private Key
667 severity: high
668 confidence: strong
669 type: pem_key
670 values:
671 - (?P<value>-----BEGIN(?![^-]*ENCRYPTED)[^-]*PRIVATE[^-]*KEY[^-]*-----)
672 min_line_len: 27
673 target:
674 - code
675 - doc
676
677- name: BASE64 encoded PEM Private Key
678 severity: high
679 confidence: strong
680 type: pattern
681 values:
682 - (?P<value>[0-9A-Za-z_/+-]{0,8000}LS0t(LS1CRUdJTiB|LUJFR0lOI|QkVHSU4g)[0-9A-Za-z_/+-]{0,11}(UFJJVkFURSBLRVkt|QUklWQVRFIEtFWS0t|FBSSVZBVEUgS0VZ)[0-9A-Za-z_/+-]{1,8000}LS0t[0-9A-Za-z_/+-]{1,8000})
683 filter_type:
684 - ValueBase64EncodedPem
685 min_line_len: 300
686 required_substrings:
687 - UFJJVkFURSBLRVkt
688 - QUklWQVRFIEtFWS0t
689 - FBSSVZBVEUgS0VZ
690 target:
691 - code
692 - doc
693
694- name: BASE64 Private Key
695 severity: high
696 confidence: strong
697 type: pattern
698 values:
699 - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
700 filter_type:
701 - ValueBase64KeyCheck
702 min_line_len: 160
703 required_substrings:
704 - MII
705 target:
706 - code
707 - doc
708
709- name: Picatic API Key
710 severity: high
711 confidence: strong
712 type: pattern
713 values:
714 - (?P<value>sk_live_[0-9a-z]{32})(?![0-9A-Za-z_-])
715 filter_type: GeneralPattern
716 min_line_len: 40
717 required_substrings:
718 - sk_live_
719 target:
720 - code
721 - doc
722
723- name: SendGrid API Key
724 severity: high
725 confidence: moderate
726 type: pattern
727 values:
728 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
729 filter_type: TokenPattern
730 min_line_len: 34
731 required_substrings:
732 - SG.
733 target:
734 - code
735 - doc
736
737- name: Clojars Deploy Token
738 severity: high
739 confidence: strong
740 type: pattern
741 values:
742 - (?P<value>CLOJARS_[0-9a-f]{60})(?![0-9A-Za-z_-])
743 filter_type: TokenPattern
744 min_line_len: 68
745 required_substrings:
746 - CLOJARS_
747 target:
748 - code
749 - doc
750
751- name: Shopify Token
752 severity: high
753 confidence: strong
754 type: pattern
755 values:
756 - (?P<value>shp(at|ca|pa|ss|tka)_[0-9A-Fa-f]{32})(?![0-9A-Za-z_-])
757 filter_type: TokenPattern
758 min_line_len: 38
759 required_substrings:
760 - shp
761 target:
762 - code
763 - doc
764
765- name: Slack Token
766 severity: high
767 confidence: strong
768 type: pattern
769 values:
770 - (?P<value>(xapp|xox[a-z])\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
771 filter_type: TokenPattern
772 min_line_len: 15
773 required_substrings:
774 - xox
775 - xapp
776 target:
777 - code
778 - doc
779
780- name: Slack Webhook
781 severity: medium
782 confidence: strong
783 type: pattern
784 values:
785 - (?P<variable>hooks\.slack\.com/services)(?P<value>/T[0-9A-Z]{8,16}/B[0-9A-Z]{8,16}/[0-9A-Za-z_]{24})
786 filter_type: GeneralPattern
787 min_line_len: 61
788 required_substrings:
789 - hooks.slack.com/services/T
790 target:
791 - code
792 - doc
793
794- name: Stripe Credentials
795 severity: high
796 confidence: strong
797 type: pattern
798 values:
799 - (?P<value>(whsec|[prs]k_(test|live))_[0-9A-Za-z]{24,160})
800 filter_type: GeneralPattern
801 min_line_len: 32
802 required_substrings:
803 - k_live_
804 - k_test_
805 - whsec_
806 target:
807 - code
808 - doc
809
810- name: Square Access Token
811 severity: high
812 confidence: moderate
813 type: pattern
814 values:
815 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
816 filter_type:
817 - ValuePatternCheck
818 - ValueBase64PartCheck
819 min_line_len: 64
820 required_substrings:
821 - EAAA
822 target:
823 - code
824 - doc
825
826- name: Square Credentials
827 severity: medium
828 confidence: strong
829 type: pattern
830 values:
831 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
832 filter_type: TokenPattern
833 min_line_len: 29
834 required_substrings:
835 - sq0
836 target:
837 - code
838 - doc
839
840- name: Twilio Credentials
841 severity: high
842 confidence: moderate
843 type: pattern
844 values:
845 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
846 filter_type: TokenPattern
847 min_line_len: 34
848 required_substrings:
849 - AC
850 - AD
851 - AL
852 - CA
853 - CF
854 - CL
855 - CN
856 - CR
857 - FW
858 - IP
859 - KS
860 - MM
861 - "NO"
862 - PK
863 - PN
864 - QU
865 - RE
866 - SC
867 - SD
868 - SK
869 - SM
870 - TR
871 - UT
872 - XE
873 - XR
874 required_regex: "[0-9A-Za-z_-]{15}"
875 target:
876 - code
877 - doc
878
879- name: Twilio Multi
880 severity: critical
881 confidence: moderate
882 type: multi
883 values:
884 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|SK)([0-9A-F]{32}|[0-9a-f]{32}))(?![0-9A-Za-z_+-])
885 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9a-f]{32})(?![0-9A-Za-z_+-])
886 filter_type:
887 - ValuePatternCheck
888 - ValueMorphemesCheck
889 min_line_len: 34
890 required_substrings:
891 - AC
892 - SK
893 required_regex: "[0-9A-Za-z_-]{15}"
894 target:
895 - code
896 - doc
897
898- name: Telegram Bot API Token
899 severity: high
900 confidence: moderate
901 type: pattern
902 values:
903 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
904 filter_type: TokenPattern
905 min_line_len: 45
906 required_substrings:
907 - :AA
908 target:
909 - code
910 - doc
911
912- name: PyPi API Token
913 severity: high
914 confidence: strong
915 type: pattern
916 values:
917 - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
918 filter_type: TokenPattern
919 min_line_len: 155
920 required_substrings:
921 - pypi-
922 target:
923 - code
924 - doc
925
926- name: NPM Token
927 severity: high
928 confidence: strong
929 type: pattern
930 values:
931 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>npm_[0-9A-Za-z_-]{36,255})
932 filter_type:
933 - ValueGitHubCheck
934 min_line_len: 40
935 required_substrings:
936 - npm_
937 target:
938 - code
939 - doc
940
941- name: Github App Installation Token
942 severity: high
943 confidence: strong
944 type: pattern
945 values:
946 - (?P<value>ghs_[0-9]{1,20}_eyJ[0-9A-Za-z_-]{15,800}(\.[0-9A-Za-z_-]{0,800}){2,8})
947 filter_type:
948 - ValuePatternCheck
949 min_line_len: 40
950 required_substrings:
951 - ghs_
952 target:
953 - code
954 - doc
955
956- name: Github Classic Token
957 severity: high
958 confidence: strong
959 type: pattern
960 values:
961 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
962 filter_type:
963 - ValueGitHubCheck
964 min_line_len: 40
965 required_substrings:
966 - ghp_
967 - gho_
968 - ghu_
969 - ghs_
970 - ghr_
971 target:
972 - code
973 - doc
974
975- name: Github Fine-granted Token
976 severity: high
977 confidence: strong
978 type: pattern
979 values:
980 - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
981 filter_type: GeneralPattern
982 min_line_len: 90
983 required_substrings:
984 - github_pat_
985 target:
986 - code
987 - doc
988
989- name: Firebase Domain
990 severity: info
991 confidence: moderate
992 type: pattern
993 values:
994 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
995 filter_type: GeneralPattern
996 min_line_len: 16
997 required_substrings:
998 - .firebase
999 target:
1000 - code
1001 - doc
1002
1003- name: AWS S3 Bucket
1004 severity: info
1005 confidence: moderate
1006 type: pattern
1007 values:
1008 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
1009 filter_type: GeneralPattern
1010 min_line_len: 14
1011 required_substrings:
1012 - .s3-website
1013 - .s3.amazonaws.com
1014 target:
1015 - code
1016 - doc
1017
1018- name: Jfrog Token
1019 severity: high
1020 confidence: strong
1021 type: pattern
1022 values:
1023 - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
1024 filter_type:
1025 - ValueJfrogTokenCheck
1026 min_line_len: 64
1027 required_substrings:
1028 - cmVmdGtuO
1029 - AKCp
1030 target:
1031 - code
1032 - doc
1033
1034- name: Azure Access Token
1035 severity: high
1036 confidence: strong
1037 type: pattern
1038 values:
1039 - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
1040 filter_type:
1041 - ValueAzureTokenCheck
1042 min_line_len: 148
1043 required_substrings:
1044 - eyJ
1045 target:
1046 - code
1047 - doc
1048
1049- name: Azure Secret Value
1050 severity: high
1051 confidence: moderate
1052 type: pattern
1053 values:
1054 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
1055 filter_type: TokenPattern
1056 min_line_len: 40
1057 required_substrings:
1058 - 8Q~
1059 target:
1060 - code
1061 - doc
1062
1063- name: Azure Storage Account Key
1064 severity: high
1065 confidence: moderate
1066 type: pattern
1067 values:
1068 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
1069 filter_type:
1070 - ValuePatternCheck(17)
1071 min_line_len: 80
1072 required_substrings:
1073 - JQQJ99
1074 - JQQJ9D
1075 - JQQJ9H
1076 target:
1077 - code
1078 - doc
1079
1080- name: Bitbucket App Password
1081 severity: high
1082 confidence: strong
1083 type: pattern
1084 values:
1085 - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
1086 filter_type:
1087 - ValueAtlassianTokenCheck
1088 min_line_len: 28
1089 required_substrings:
1090 - ATBB
1091 target:
1092 - code
1093 - doc
1094
1095- name: Bitbucket Repository Access Token
1096 severity: high
1097 confidence: strong
1098 type: pattern
1099 values:
1100 - (?P<value>ATCTT3xFfGN0[0-9A-Za-z_-]{80,800}(\\?=|(%|\\u00)3[dD])[A-F0-9]{8})
1101 filter_type:
1102 - ValueAtlassianTokenCheck
1103 min_line_len: 160
1104 required_substrings:
1105 - ATCTT3xFfGN0
1106 target:
1107 - code
1108 - doc
1109
1110- name: Bitbucket HTTP Access Token
1111 severity: high
1112 confidence: strong
1113 type: pattern
1114 values:
1115 - (?P<value>BBDC-[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})
1116 filter_type:
1117 - ValueAtlassianTokenCheck
1118 min_line_len: 49
1119 required_substrings:
1120 - BBDC-
1121 target:
1122 - code
1123 - doc
1124
1125- name: Jira / Confluence PAT token
1126 severity: high
1127 confidence: strong
1128 type: pattern
1129 values:
1130 - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1131 filter_type:
1132 - ValueAtlassianTokenCheck
1133 min_line_len: 44
1134 required_substrings:
1135 - M
1136 - N
1137 - O
1138 required_regex: "[0-9A-Za-z_-]{15}"
1139 target:
1140 - code
1141 - doc
1142
1143- name: Atlassian PAT token
1144 severity: high
1145 confidence: strong
1146 type: pattern
1147 values:
1148 - (?P<value>ATATT3xFfGF0[0-9A-Za-z_-]{80,800}(\\?=|(%|\\u00)3[dD])[A-F0-9]{8})
1149 filter_type:
1150 - ValueAtlassianTokenCheck
1151 min_line_len: 160
1152 required_substrings:
1153 - ATATT3xFfGF0
1154 target:
1155 - code
1156 - doc
1157
1158- name: CircleCI Personal API Token
1159 severity: high
1160 confidence: strong
1161 type: pattern
1162 values:
1163 - (?P<value>CCIPAT_[0-9A-Za-z]{22}_[0-9a-f]{40})
1164 filter_type: TokenPattern
1165 min_line_len: 70
1166 required_substrings:
1167 - CCIPAT_
1168 target:
1169 - code
1170 - doc
1171
1172- name: Digital Ocean Token
1173 severity: high
1174 confidence: strong
1175 type: pattern
1176 values:
1177 - (?P<value>do[oprs]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1178 filter_type: TokenPattern
1179 min_line_len: 71
1180 required_substrings:
1181 - doo_v1_
1182 - dop_v1_
1183 - dor_v1_
1184 - dos_v1_
1185 target:
1186 - code
1187 - doc
1188
1189- name: Dropbox OAuth2 API Access Token
1190 severity: high
1191 confidence: moderate
1192 type: pattern
1193 values:
1194 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl\.(u\.)?[0-9A-Za-z_-]{77,177})(?![0-9A-Za-z_-])
1195 filter_type: TokenPattern
1196 min_line_len: 80
1197 required_substrings:
1198 - sl.
1199 target:
1200 - code
1201 - doc
1202
1203- name: NuGet API key
1204 severity: high
1205 confidence: moderate
1206 type: pattern
1207 values:
1208 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1209 filter_type: TokenPattern
1210 min_line_len: 46
1211 required_substrings:
1212 - oy2
1213 target:
1214 - code
1215 - doc
1216
1217- name: Gitlab Prefix Token
1218 severity: high
1219 confidence: strong
1220 type: pattern
1221 values:
1222 - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|rtr|[dfrw]t)-)[0-9A-Za-z_-]{20,64}(\.[0-9A-Za-z_-]{2,16}){0,2})(?![0-9A-Za-z_-])
1223 filter_type:
1224 - ValuePatternCheck
1225 min_line_len: 25
1226 required_substrings:
1227 - _gitlab_session=
1228 - GR1348941
1229 - glagent-
1230 - glsoat-
1231 - glffct-
1232 - glpat-
1233 - gloas-
1234 - glptt-
1235 - glcbt-
1236 - glimt-
1237 - gldt-
1238 - glft-
1239 - glrt-
1240 - glrtr-
1241 - glwt-
1242 target:
1243 - code
1244 - doc
1245
1246- name: Grafana Provisioned API Key
1247 severity: high
1248 confidence: strong
1249 type: pattern
1250 values:
1251 - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1252 filter_type:
1253 - ValueGrafanaCheck
1254 min_line_len: 67
1255 required_substrings:
1256 - eyJ
1257 target:
1258 - code
1259 - doc
1260
1261- name: Grafana Access Policy Token
1262 severity: high
1263 confidence: strong
1264 type: pattern
1265 values:
1266 - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1267 filter_type:
1268 - ValueGrafanaCheck
1269 min_line_len: 87
1270 required_substrings:
1271 - glc_eyJ
1272 target:
1273 - code
1274 - doc
1275
1276- name: Grafana Service Account Token
1277 severity: high
1278 confidence: strong
1279 type: pattern
1280 values:
1281 - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1282 filter_type:
1283 - ValueGrafanaServiceCheck
1284 min_line_len: 46
1285 required_substrings:
1286 - glsa_
1287 target:
1288 - code
1289 - doc
1290
1291- name: Dropbox API secret (long term)
1292 severity: high
1293 confidence: weak
1294 type: pattern
1295 values:
1296 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1297 filter_type: [ ]
1298 min_line_len: 43
1299 required_substrings:
1300 - AAAAAAAAAA
1301 target:
1302 - code
1303 - doc
1304
1305- name: X App-Only Authentication Bearer Token
1306 severity: high
1307 confidence: moderate
1308 type: pattern
1309 values:
1310 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AAAAAAAAAAAAAAAAAAAAA[0-9A-Za-z%]{40,42}(%|\\u00)3[dD][0-9A-Za-z]{50})(?![=0-9A-Za-z_/+-])
1311 filter_type: [ ]
1312 min_line_len: 100
1313 required_substrings:
1314 - AAAAAAAAAAAAAAAAAAAAA
1315 target:
1316 - code
1317 - doc
1318
1319- name: PlanetScale Credentials
1320 severity: high
1321 confidence: moderate
1322 type: pattern
1323 values:
1324 - (?P<value>pscale_(tkn|oauth|pw)_[.0-9A-Za-z_-]{32,64})
1325 filter_type:
1326 - ValuePatternCheck
1327 min_line_len: 42
1328 required_substrings:
1329 - pscale_
1330 target:
1331 - code
1332 - doc
1333
1334- name: NewRelic Credentials
1335 severity: high
1336 confidence: moderate
1337 type: pattern
1338 values:
1339 - (?P<value>NRAK-[0-9A-Z]{27}|NRBR-[0-9a-f]{19,20}|NRII-[0-9A-Za-z_-]{25}|NRJS-[0-9a-z]{19}|[0-9a-z]{5}[0-9a-f]{31}NRAL)
1340 filter_type:
1341 - ValuePatternCheck
1342 - ValueMorphemesCheck
1343 min_line_len: 24
1344 required_substrings:
1345 - NRAK-
1346 - NRBR-
1347 - NRII-
1348 - NRJS-
1349 - NRAL
1350 target:
1351 - code
1352 - doc
1353
1354- name: Linear API Key
1355 severity: high
1356 confidence: moderate
1357 type: pattern
1358 values:
1359 - (?P<value>lin_api_[0-9A-Za-z]{40})
1360 filter_type:
1361 - ValuePatternCheck
1362 min_line_len: 48
1363 required_substrings:
1364 - lin_api_
1365 target:
1366 - code
1367 - doc
1368
1369- name: CloudFlare API Token
1370 severity: high
1371 confidence: strong
1372 type: pattern
1373 values:
1374 - (?P<value>cf(at|ut|k)_[0-9A-Za-z]{40}[0-9a-f]{8})
1375 filter_type:
1376 - ValueCloudFlareCheck
1377 min_line_len: 24
1378 required_substrings:
1379 - cfat_
1380 - cfut_
1381 - cfk_
1382 target:
1383 - code
1384 - doc
1385
1386- name: Age Secret Key
1387 severity: high
1388 confidence: strong
1389 type: pattern
1390 values:
1391 - (?P<value>AGE-SECRET-KEY-1[0-9A-Z]{58})
1392 filter_type:
1393 - ValueBech32Check
1394 min_line_len: 74
1395 required_substrings:
1396 - AGE-SECRET-KEY-1
1397 target:
1398 - code
1399 - doc
1400
1401- name: Dropbox App secret
1402 severity: info
1403 confidence: weak
1404 type: pattern
1405 values:
1406 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1407 filter_type: WeirdBase36Token
1408 min_line_len: 15
1409 required_regex: "[0-9A-Za-z_-]{15}"
1410 target:
1411 - code
1412 - doc
1413
1414- name: Hashicorp Vault Token
1415 severity: high
1416 confidence: strong
1417 type: pattern
1418 values:
1419 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1420 filter_type:
1421 - ValuePatternCheck
1422 - ValueEntropyBase64Check
1423 min_line_len: 90
1424 required_substrings:
1425 - hvb.
1426 - hvr.
1427 - hvs.
1428 target:
1429 - code
1430 - doc
1431
1432- name: Hashicorp Terraform Token
1433 severity: high
1434 confidence: strong
1435 type: pattern
1436 values:
1437 - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1438 filter_type:
1439 - ValuePatternCheck
1440 - ValueMorphemesCheck
1441 min_line_len: 90
1442 required_substrings:
1443 - .atlasv1.
1444 target:
1445 - code
1446 - doc
1447
1448- name: Airtable API Key
1449 severity: high
1450 confidence: moderate
1451 type: pattern
1452 values:
1453 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>pat[0-9A-Za-z]{14}\.[0-9a-f]{64})(?![=0-9A-Za-z_+-])
1454 filter_type:
1455 - ValuePatternCheck
1456 - ValueMorphemesCheck
1457 min_line_len: 82
1458 required_substrings:
1459 - pat
1460 target:
1461 - code
1462 - doc
1463
1464- name: NKEY Seed
1465 severity: high
1466 confidence: weak
1467 type: pattern
1468 values:
1469 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>S[ACNOPUX][A-Z2-7]{40,200})(?![=0-9A-Za-z_+-])
1470 filter_type:
1471 - ValueMorphemesCheck
1472 - ValuePatternCheck
1473 - ValueEntropyBase32Check
1474 - ValueBase32DataCheck
1475 - ValueTokenBase32Check
1476 min_line_len: 42
1477 required_substrings:
1478 - SA
1479 - SC
1480 - SN
1481 - SO
1482 - SP
1483 - SU
1484 - SX
1485 required_regex: "[0-9A-Za-z_-]{15}"
1486 target:
1487 - code
1488 - doc
1489
1490- name: OTP / 2FA Secret
1491 severity: info
1492 confidence: weak
1493 type: pattern
1494 values:
1495 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([A-Z2-7]{16}){1,2})(?![=0-9A-Za-z_+-])
1496 filter_type:
1497 - ValueMorphemesCheck
1498 - ValuePatternCheck
1499 - ValueEntropyBase32Check
1500 - ValueBase32DataCheck
1501 - ValueTokenBase32Check
1502 - ValueBase64PartCheck
1503 min_line_len: 16
1504 required_regex: "[0-9A-Za-z_-]{15}"
1505 target:
1506 - code
1507 - doc
1508
1509- name: OpenAI Token
1510 severity: high
1511 confidence: strong
1512 type: pattern
1513 values:
1514 - (?P<value>sk-[0-9A-Za-z_-]{16,160}(T3BlbkFJ|9wZW5BS|PcGVuQU)[0-9A-Za-z_-]{16,160})
1515 filter_type:
1516 - ValuePatternCheck
1517 - ValueMorphemesCheck
1518 min_line_len: 51
1519 required_substrings:
1520 - T3BlbkFJ
1521 - 9wZW5BS
1522 - PcGVuQU
1523 target:
1524 - code
1525 - doc
1526
1527- name: OpenRouter API Key
1528 severity: high
1529 confidence: strong
1530 type: pattern
1531 values:
1532 - (?P<value>sk-or-v1-[0-9a-f]{64})
1533 filter_type:
1534 - ValuePatternCheck
1535 min_line_len: 73
1536 required_substrings:
1537 - sk-or-v1-
1538 target:
1539 - code
1540 - doc
1541
1542- name: Docker Access Token
1543 severity: high
1544 confidence: strong
1545 type: pattern
1546 values:
1547 - (?P<value>dckr_[op]at_[0-9A-Za-z_-]{27,32})
1548 filter_type:
1549 - ValuePatternCheck
1550 - ValueMorphemesCheck
1551 min_line_len: 36
1552 required_substrings:
1553 - dckr_pat_
1554 - dckr_oat_
1555 target:
1556 - code
1557 - doc
1558
1559- name: Docker Swarm Token
1560 severity: high
1561 confidence: strong
1562 type: pattern
1563 values:
1564 - (?P<value>SWMTKN-1-[0-9a-z]{50}-[0-9a-z]{25})
1565 filter_type:
1566 - ValuePatternCheck
1567 - ValueMorphemesCheck
1568 min_line_len: 85
1569 required_substrings:
1570 - SWMTKN-1-
1571 target:
1572 - code
1573 - doc
1574
1575- name: Docker Swarm Key
1576 severity: high
1577 confidence: strong
1578 type: pattern
1579 values:
1580 - (?P<value>SWMKEY-1-[0-9A-Za-z]{43})
1581 filter_type:
1582 - ValuePatternCheck
1583 - ValueMorphemesCheck
1584 min_line_len: 52
1585 required_substrings:
1586 - SWMKEY-1-
1587 target:
1588 - code
1589 - doc
1590
1591- name: Groq API Key
1592 severity: high
1593 confidence: strong
1594 type: pattern
1595 values:
1596 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{8,40}(WGdyb3FY|hncm9xW|YZ3JvcV)[0-9A-Za-z_-]{8,40})(?![0-9A-Za-z_-])
1597 filter_type:
1598 - ValuePatternCheck
1599 min_line_len: 56
1600 required_substrings:
1601 - WGdyb3FY
1602 - hncm9xW
1603 - YZ3JvcV
1604 target:
1605 - code
1606 - doc
1607
1608- name: X AI API Key
1609 severity: high
1610 confidence: moderate
1611 type: pattern
1612 values:
1613 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xai-[0-9A-Za-z_-]{80})(?![0-9A-Za-z_-])
1614 filter_type:
1615 - ValuePatternCheck
1616 - ValueEntropyBase64Check
1617 min_line_len: 84
1618 required_substrings:
1619 - xai-
1620 target:
1621 - code
1622 - doc
1623
1624- name: Composio Credentials
1625 severity: high
1626 confidence: weak
1627 type: pattern
1628 values:
1629 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(?:[ou]?a|c)k_[0-9A-Za-z_-]{16,80})
1630 filter_type:
1631 - ValueMorphemesCheck(1)
1632 - ValueBase64DataCheck
1633 - ValueTokenBase64Check
1634 - ValueEntropyBase64Check
1635 - ValuePatternCheck
1636 - ValueNotPartEncodedCheck
1637 - ValueBase64PartCheck
1638 min_line_len: 19
1639 required_substrings:
1640 - ak_
1641 - ck_
1642 target:
1643 - code
1644 - doc
1645
1646- name: Notion Integration Token
1647 severity: high
1648 confidence: strong
1649 type: pattern
1650 values:
1651 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ntn_[0-9]{9}[0-9A-Za-z_-]{36,255})
1652 filter_type:
1653 - ValuePatternCheck
1654 - ValueEntropyBase64Check
1655 min_line_len: 50
1656 required_substrings:
1657 - ntn_
1658 target:
1659 - code
1660 - doc
1661
1662- name: Hugging Face User Access Token
1663 severity: high
1664 confidence: moderate
1665 type: pattern
1666 values:
1667 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1668 filter_type:
1669 - ValuePatternCheck
1670 - ValueEntropyBase64Check
1671 min_line_len: 37
1672 required_substrings:
1673 - hf_
1674 target:
1675 - code
1676 - doc
1677
1678- name: Anthropic API Key
1679 severity: high
1680 confidence: strong
1681 type: pattern
1682 values:
1683 - (?P<value>sk-ant-(api|admin)0[1-4]-[0-9A-Za-z_-]{64,128})(?![0-9A-Za-z_-])
1684 filter_type:
1685 - ValuePatternCheck
1686 min_line_len: 77
1687 required_substrings:
1688 - sk-ant-
1689 target:
1690 - code
1691 - doc
1692
1693- name: Perplexity API Key
1694 severity: high
1695 confidence: strong
1696 type: pattern
1697 values:
1698 - (?P<value>pplx-[0-9A-Za-z_-]{40,64})(?![0-9A-Za-z_-])
1699 filter_type:
1700 - ValuePatternCheck
1701 min_line_len: 45
1702 required_substrings:
1703 - pplx-
1704 target:
1705 - code
1706 - doc
1707
1708- name: Tailscale Credentials
1709 severity: high
1710 confidence: strong
1711 type: pattern
1712 values:
1713 - (?P<value>tskey-(api|auth|client|scim|webhook)-[0-9A-Za-z]{12,24}-[0-9A-Za-z]{32})
1714 filter_type:
1715 - ValuePatternCheck
1716 min_line_len: 61
1717 required_substrings:
1718 - tskey-
1719 target:
1720 - code
1721 - doc
1722
1723- name: Contentful Credentials
1724 severity: high
1725 confidence: strong
1726 type: pattern
1727 values:
1728 - (?P<value>CFPAT-[0-9A-Za-z_-]{43})(?![0-9A-Za-z_-])
1729 filter_type:
1730 - ValuePatternCheck
1731 min_line_len: 49
1732 required_substrings:
1733 - CFPAT-
1734 target:
1735 - code
1736 - doc
1737
1738- name: Pulumi Personal Access Token
1739 severity: high
1740 confidence: strong
1741 type: pattern
1742 values:
1743 - (?P<value>pul-[0-9a-f]{40})
1744 filter_type:
1745 - ValuePatternCheck
1746 min_line_len: 44
1747 required_substrings:
1748 - pul-
1749 target:
1750 - code
1751 - doc
1752
1753- name: DeepSeek API Key
1754 severity: high
1755 confidence: moderate
1756 type: pattern
1757 values:
1758 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sk-[0-9a-f]{32,64})(?![0-9A-Za-z_-])
1759 filter_type:
1760 - ValuePatternCheck
1761 min_line_len: 35
1762 required_substrings:
1763 - sk-
1764 target:
1765 - code
1766 - doc
1767
1768- name: Tavily API Key
1769 severity: high
1770 confidence: strong
1771 type: pattern
1772 values:
1773 - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1774 filter_type:
1775 - ValuePatternCheck
1776 min_line_len: 37
1777 required_substrings:
1778 - tvly-
1779 target:
1780 - code
1781 - doc
1782
1783- name: Figma Personal Access Token
1784 severity: high
1785 confidence: strong
1786 type: pattern
1787 values:
1788 - (?P<value>figd_[0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1789 filter_type:
1790 - ValuePatternCheck
1791 min_line_len: 45
1792 required_substrings:
1793 - figd_
1794 target:
1795 - code
1796 - doc
1797
1798- name: 1Password Account Token
1799 severity: high
1800 confidence: strong
1801 type: pattern
1802 values:
1803 - (?P<value>ops_eyJ[0-9A-Za-z_-]{168,8000})
1804 filter_type:
1805 - ValuePatternCheck
1806 min_line_len: 192
1807 required_substrings:
1808 - InNlY3JldEtleSI6
1809 - JzZWNyZXRLZXkiO
1810 - ic2VjcmV0S2V5Ij
1811 target:
1812 - code
1813 - doc
1814
1815- name: Brevo API Key
1816 severity: high
1817 confidence: strong
1818 type: pattern
1819 values:
1820 - (?P<value>xkeysib-[0-9a-f]{64}-[0-9A-Za-z_-]{16})
1821 filter_type:
1822 - ValuePatternCheck
1823 min_line_len: 89
1824 required_substrings:
1825 - xkeysib-
1826 target:
1827 - code
1828 - doc
1829
1830- name: Together AI API Key
1831 severity: high
1832 confidence: strong
1833 type: pattern
1834 values:
1835 - (?P<value>tgp_v1_[0-9A-Za-z_-]{43})
1836 filter_type:
1837 - ValuePatternCheck
1838 min_line_len: 50
1839 required_substrings:
1840 - tgp_v1_
1841 target:
1842 - code
1843 - doc
1844
1845- name: LLAMA API Key
1846 severity: high
1847 confidence: strong
1848 type: pattern
1849 values:
1850 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>llx-[0-9A-Za-z_-]{48})
1851 filter_type:
1852 - ValuePatternCheck
1853 min_line_len: 52
1854 required_substrings:
1855 - llx-
1856 target:
1857 - code
1858 - doc
1859
1860- name: SonarQube Credentials
1861 severity: medium
1862 confidence: moderate
1863 type: pattern
1864 values:
1865 - (?P<value>sq[apu]_[0-9a-f]{40})(?![0-9A-Za-z_-])
1866 filter_type:
1867 - ValuePatternCheck
1868 min_line_len: 44
1869 required_substrings:
1870 - sqa_
1871 - sqp_
1872 - squ_
1873 target:
1874 - code
1875 - doc
1876
1877- name: Sentry Organization Auth Token
1878 severity: high
1879 confidence: strong
1880 type: pattern
1881 values:
1882 - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1883 filter_type:
1884 - ValuePatternCheck
1885 min_line_len: 37
1886 required_substrings:
1887 - sntrys_eyJ
1888 target:
1889 - code
1890 - doc
1891
1892- name: Sentry User Auth Token
1893 severity: high
1894 confidence: strong
1895 type: pattern
1896 values:
1897 - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1898 filter_type:
1899 - ValuePatternCheck
1900 min_line_len: 37
1901 required_substrings:
1902 - sntryu_
1903 target:
1904 - code
1905 - doc
1906
1907- name: Discord Bot Token
1908 severity: high
1909 confidence: strong
1910 type: pattern
1911 values:
1912 - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1913 filter_type:
1914 - ValueDiscordBotCheck
1915 min_line_len: 62
1916 required_substrings:
1917 - M
1918 - N
1919 - O
1920 required_regex: "[0-9A-Za-z_-]{15}"
1921 target:
1922 - code
1923 - doc
1924
1925- name: Discord Webhook
1926 severity: medium
1927 confidence: strong
1928 type: pattern
1929 values:
1930 - (?P<variable>discord(?:app)?\.com/api/webhooks)(?P<value>/[0-9]{16,22}/[0-9A-Za-z_-]{40,100})
1931 filter_type:
1932 - ValueMorphemesCheck
1933 min_line_len: 61
1934 required_substrings:
1935 - discordapp.com/api/webhooks
1936 - discord.com/api/webhooks
1937 target:
1938 - code
1939 - doc
1940
1941- name: Nylas API Key
1942 severity: high
1943 confidence: strong
1944 type: pattern
1945 values:
1946 - (?P<value>nyk_v0_[0-9A-Za-z_-]{64})
1947 filter_type: TokenPattern
1948 min_line_len: 71
1949 required_substrings:
1950 - nyk_v0_
1951 target:
1952 - code
1953 - doc
1954
1955- name: WakaTime API Key
1956 severity: high
1957 confidence: strong
1958 type: pattern
1959 values:
1960 - (?P<value>waka_[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1961 filter_type: TokenPattern
1962 min_line_len: 40
1963 required_substrings:
1964 - waka_
1965 target:
1966 - code
1967 - doc
1968
1969- name: Riot Games API Key
1970 severity: high
1971 confidence: strong
1972 type: pattern
1973 values:
1974 - (?P<value>RGAPI-[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12})
1975 filter_type: TokenPattern
1976 min_line_len: 41
1977 required_substrings:
1978 - RGAPI-
1979 target:
1980 - code
1981 - doc
1982
1983- name: SourceGraph Credentials
1984 severity: medium
1985 confidence: moderate
1986 type: pattern
1987 values:
1988 - (?P<value>sgp_(local_|[0-9a-f]{16}_)?[0-9a-f]{40})
1989 filter_type: TokenPattern
1990 min_line_len: 44
1991 required_substrings:
1992 - sgp_
1993 target:
1994 - code
1995 - doc
1996
1997- name: Typeform API Personal Token
1998 severity: medium
1999 confidence: weak
2000 type: pattern
2001 values:
2002 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>tfp_[0-9A-Za-z_-]{56,60})(?![0-9A-Za-z_-])
2003 filter_type: TokenPattern
2004 min_line_len: 60
2005 required_substrings:
2006 - tfp_
2007 target:
2008 - code
2009 - doc
2010
2011- name: Vercel Token
2012 severity: medium
2013 confidence: weak
2014 type: pattern
2015 values:
2016 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>vcp_[0-9A-Za-z]{56})(?![0-9A-Za-z_-])
2017 filter_type: TokenPattern
2018 min_line_len: 60
2019 required_substrings:
2020 - vcp_
2021 target:
2022 - code
2023 - doc
2024
2025- name: Netlify Token
2026 severity: medium
2027 confidence: weak
2028 type: pattern
2029 values:
2030 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>nfp_[0-9A-Za-z]{36})(?![0-9A-Za-z_-])
2031 filter_type: TokenPattern
2032 min_line_len: 40
2033 required_substrings:
2034 - nfp_
2035 target:
2036 - code
2037 - doc
2038
2039- name: PostHog Credentials
2040 severity: medium
2041 confidence: weak
2042 type: pattern
2043 values:
2044 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>ph[acrsx]_[0-9A-Za-z]{40,60})(?![0-9A-Za-z_-])
2045 filter_type: TokenPattern
2046 min_line_len: 44
2047 required_substrings:
2048 - phx_
2049 - phs_
2050 - phr_
2051 - pha_
2052 - phc_
2053 target:
2054 - code
2055 - doc
2056
2057- name: RubyGems API Key
2058 severity: medium
2059 confidence: strong
2060 type: pattern
2061 values:
2062 - (?P<value>rubygems_[0-9a-f]{48})
2063 filter_type: TokenPattern
2064 min_line_len: 57
2065 required_substrings:
2066 - rubygems_
2067 target:
2068 - code
2069 - doc
2070
2071- name: Databricks Access Token
2072 severity: medium
2073 confidence: strong
2074 type: pattern
2075 values:
2076 - (?P<value>dapi[0-9a-f]{32})
2077 filter_type: TokenPattern
2078 min_line_len: 36
2079 required_substrings:
2080 - dapi
2081 target:
2082 - code
2083 - doc
2084
2085- name: Tencent WeChat API App ID
2086 severity: medium
2087 confidence: weak
2088 type: pattern
2089 values:
2090 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
2091 filter_type: TokenPattern
2092 min_line_len: 18
2093 required_substrings:
2094 - wx
2095 target:
2096 - code
2097 - doc
2098
2099- name: WunderGraph API Key
2100 severity: medium
2101 confidence: strong
2102 type: pattern
2103 values:
2104 - (?P<value>cosmo_[0-9a-f]{32})
2105 filter_type: TokenPattern
2106 min_line_len: 38
2107 required_substrings:
2108 - cosmo_
2109 target:
2110 - code
2111 - doc
2112
2113- name: Supabase Credentials
2114 severity: medium
2115 confidence: strong
2116 type: pattern
2117 values:
2118 - (?P<value>sbp_(v0_)?[0-9a-f]{40})
2119 filter_type: TokenPattern
2120 min_line_len: 44
2121 required_substrings:
2122 - sbp_
2123 target:
2124 - code
2125 - doc
2126
2127- name: Salesforce Credentials
2128 severity: medium
2129 confidence: weak
2130 type: pattern
2131 values:
2132 - (?:^|/|[^\\0-9A-Za-z+_-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(3MVG[0-9A-Za-z_.]{24,200}|00D[0-9A-Za-z]{9,15}(![0-9A-Za-z_.]{24,200})?))(?![0-9A-Za-z_.])
2133 filter_type:
2134 - ValuePatternCheck(9)
2135 - ValueNumberCheck
2136 - ValueBase64PartCheck
2137 min_line_len: 12
2138 required_substrings:
2139 - "3MVG"
2140 - "00D"
2141 target:
2142 - code
2143 - doc
2144
2145- name: Postman Credentials
2146 severity: medium
2147 confidence: moderate
2148 type: pattern
2149 values:
2150 - (?P<value>(PMAK-[0-9a-f]{24}-[0-9a-f]{34}|PMAT-[0-9A-Z]{26}))
2151 filter_type:
2152 - ValuePatternCheck
2153 min_line_len: 29
2154 required_substrings:
2155 - PMAK-
2156 - PMAT-
2157 target:
2158 - code
2159 - doc
2160
2161- name: NTLM Token
2162 severity: medium
2163 confidence: strong
2164 type: pattern
2165 values:
2166 - (?P<value>TlRMTVNTUAA[BCD]AAAA[=0-9A-Za-z_/+-]{28,8000})(?![0-9A-Za-z_/+-])
2167 filter_type:
2168 - ValueMorphemesCheck(2)
2169 - ValuePatternCheck
2170 min_line_len: 44
2171 required_substrings:
2172 - TlRMTVNTUAA
2173 target:
2174 - doc
2175 - code
2176
2177- name: Basic Authorization
2178 severity: medium
2179 confidence: strong
2180 type: pattern
2181 values:
2182 - (?P<variable>(?i:basic))(?P<separator>\s+)(?P<value>[=0-9A-Za-z_/+-]{8,8000})(?![0-9A-Za-z_/+-])
2183 filter_type:
2184 - ValueBasicAuthCheck
2185 min_line_len: 14
2186 required_substrings:
2187 - basic
2188 target:
2189 - code
2190 - doc
2191
2192- name: Bearer Authorization
2193 severity: medium
2194 confidence: moderate
2195 type: pattern
2196 values:
2197 - (?P<variable>(?i:bearer|ntlm))(?P<separator>\s+)(?P<value>[.0-9A-Za-z_/+-]{32,8000}=*)(?![0-9A-Za-z_/+-])
2198 filter_type: GeneralKeyword
2199 min_line_len: 37
2200 required_substrings:
2201 - bearer
2202 - ntlm
2203 target:
2204 - code
2205 - doc
2206
2207- name: SQL Password
2208 severity: medium
2209 confidence: weak
2210 type: pattern
2211 values:
2212 - (\\[nrt]|\b)(?i:(?P<variable>(CREATE|ALTER|SET\s{1,8}PASSWORD|INSERT(\s{1,8}IGNORE)?|UPDATE\s{1,8}[^\s;]{1,80})\s{1,8}(LOGIN|USER|ROLE|FOR|INTO|SET)\s{1,8}((?!IDENTIFIED|PASSWORD)[^\s;]{1,80}\s{1,8}|VALUES\s{0,8}\(){1,8}(IDENTIFIED((\s{1,8}WITH\s{1,8}\S{1,80})?\s{1,8}(BY|AS))|(=|WITH)?\s{0,8}PASSWORD\b(\s{0,8}=)?)))\s{0,8}(?P<wrap>[(]\s{0,8})?(?P<value_leftquote>((?P<esq>\\{1,8})?([\"'`]|&(quot|apos|#3[49]);)){1,4})?(?P<value>(?(value_leftquote)((?!(?P=value_leftquote))(?(esq)((?!(?P=esq)([\"'`]|&(quot|apos|#3[49]);)).)|((?!(?P=value_leftquote)).)))|(?!&(quot|apos|#3[49]);)(\\{1,8}([ tnr]|[^\s\"'`])|[^\s\"'`,;\\])){3,80})(?(value_leftquote)(?P<value_rightquote>(?<!\\)(?P=value_leftquote))|(?(wrap)[)]|[\s\"'`,;]))
2213 filter_type:
2214 - ValueAllowlistCheck
2215 - ValuePatternCheck
2216 min_line_len: 8
2217 required_substrings:
2218 - password
2219 - identified
2220 use_ml: true
2221 target:
2222 - doc
2223 - code
2224
2225- name: CURL Options
2226 severity: high
2227 confidence: weak
2228 type: pattern
2229 values:
2230 - (?P<variable>CURLOPT_(XOAUTH2_BEARER|(?:PROXY)?PASSWORD|(?:PROXY)?USERPWD)|KEYPASSWD)\s*,\s*(?P<value_leftquote>")(?P<value>[^"]{4,8000})(?P<value_rightquote>")?
2231 filter_type: GeneralKeyword
2232 min_line_len: 32
2233 required_substrings:
2234 - CURLOPT_XOAUTH2_BEARER
2235 - CURLOPT_PASSWORD
2236 - CURLOPT_USERPWD
2237 - CURLOPT_PROXYPASSWORD
2238 - CURLOPT_PROXYUSERPWD
2239 - CURLOPT_KEYPASSWD
2240 use_ml: true
2241 target:
2242 - doc
2243 - code
2244
2245- name: CURL User Password
2246 severity: high
2247 confidence: moderate
2248 type: pattern
2249 values:
2250 - (?P<variable>curl)\s.*(-[uU]|--(proxy-)?user)\s\s*(?P<value_leftquote>(\\*[\"']){1,3})?(?(value_leftquote)[^\"'\\:]|[^\s\"'\\:]){0,64}:(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,64})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2251 filter_type: GeneralKeyword
2252 min_line_len: 16
2253 required_substrings:
2254 - curl
2255 use_ml: true
2256 target:
2257 - doc
2258 - code
2259
2260- name: CMD ConvertTo-SecureString
2261 severity: high
2262 confidence: moderate
2263 type: pattern
2264 values:
2265 - (?P<variable>ConvertTo-SecureString(\s\s*-(String|AsPlainText|Force))*)\s\s*(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,800})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2266 filter_type: GeneralKeyword
2267 min_line_len: 27
2268 required_substrings:
2269 - convertto-securestring
2270 use_ml: true
2271 target:
2272 - doc
2273 - code
2274
2275- name: CMD Password
2276 severity: high
2277 confidence: moderate
2278 type: pattern
2279 values:
2280 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2281 filter_type: GeneralKeyword
2282 min_line_len: 12
2283 required_substrings:
2284 - pass
2285 use_ml: true
2286 target:
2287 - doc
2288 - code
2289
2290- name: CMD Token
2291 severity: high
2292 confidence: moderate
2293 type: pattern
2294 values:
2295 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token|oauth2-bearer))(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2296 filter_type: GeneralKeyword
2297 min_line_len: 12
2298 required_substrings:
2299 - token
2300 - oauth2-bearer
2301 use_ml: true
2302 target:
2303 - doc
2304 - code
2305
2306- name: CMD Secret
2307 severity: high
2308 confidence: moderate
2309 type: pattern
2310 values:
2311 - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)(\s|\\?[\"'],)\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
2312 filter_type: GeneralKeyword
2313 min_line_len: 12
2314 required_substrings:
2315 - secret
2316 use_ml: true
2317 target:
2318 - doc
2319 - code
2320
2321- name: URL Credentials
2322 severity: high
2323 confidence: moderate
2324 type: pattern
2325 values:
2326 - (?P<value_leftquote>[\"'])?(?P<variable>[+0-9A-Za-z-]{2,80}://)([^\s\'"<>\[\]^~`{|}:/]{0,80}:){1,3}(?P<value>[^\s\'"<>\[\]^~`{|}@:/]{3,80})@[^\s\'"<>\[\]^~`{|}@:/]{1,800}\\{0,8}(?P<value_rightquote>[\"'])?
2327 filter_type: UrlCredentialsGroup
2328 min_line_len: 10
2329 required_substrings:
2330 - ://
2331 use_ml: true
2332 target:
2333 - doc
2334 - code
2335
2336- name: API
2337 severity: low
2338 confidence: moderate
2339 type: keyword
2340 values:
2341 - api(?!tal)
2342 filter_type: GeneralKeyword
2343 min_line_len: 11
2344 required_substrings:
2345 - api
2346 use_ml: true
2347 target:
2348 - code
2349
2350- name: Auth
2351 severity: medium
2352 confidence: moderate
2353 type: keyword
2354 values:
2355 - auth(?!ors?(?!i[tz]))
2356 filter_type: GeneralKeyword
2357 min_line_len: 12
2358 required_substrings:
2359 - auth
2360 use_ml: true
2361 target:
2362 - code
2363
2364- name: Credential
2365 severity: medium
2366 confidence: moderate
2367 type: keyword
2368 values:
2369 - credential
2370 filter_type: GeneralKeyword
2371 min_line_len: 18
2372 required_substrings:
2373 - credential
2374 use_ml: true
2375 target:
2376 - code
2377
2378- name: Key
2379 severity: high
2380 confidence: moderate
2381 type: keyword
2382 values:
2383 - key(?!word|board|pad|name)
2384 filter_type: GeneralKeyword
2385 min_line_len: 11
2386 required_substrings:
2387 - key
2388 use_ml: true
2389 target:
2390 - code
2391
2392- name: Nonce
2393 severity: low
2394 confidence: moderate
2395 type: keyword
2396 values:
2397 - (?<!\\)nonce
2398 filter_type: GeneralKeyword
2399 min_line_len: 13
2400 required_substrings:
2401 - nonce
2402 use_ml: true
2403 target:
2404 - code
2405
2406- name: Password
2407 severity: high
2408 confidence: moderate
2409 type: keyword
2410 values:
2411 - (?<!by)pass(?!e[dns]|ing|ion|age|\s+[a-z]{3,80})|(?<!pro|sto)p(s|ss|as)?w(o?r)?d(?!ump)|pswr?\b|(\b|_)pw(_|\b)
2412 filter_type: PasswordKeyword
2413 min_line_len: 10
2414 required_substrings:
2415 - pass
2416 - pasw
2417 - pssw
2418 - psw
2419 - pw
2420 use_ml: true
2421 target:
2422 - code
2423
2424- name: Salt
2425 severity: low
2426 confidence: moderate
2427 type: keyword
2428 values:
2429 - salt
2430 filter_type: GeneralKeyword
2431 min_line_len: 12
2432 required_substrings:
2433 - salt
2434 use_ml: true
2435 target:
2436 - code
2437
2438- name: Secret
2439 severity: medium
2440 confidence: moderate
2441 type: keyword
2442 values:
2443 - secret
2444 filter_type: GeneralKeyword
2445 min_line_len: 14
2446 required_substrings:
2447 - secret
2448 use_ml: true
2449 target:
2450 - code
2451
2452- name: Token
2453 severity: high
2454 confidence: moderate
2455 type: keyword
2456 values:
2457 - token(?!ize)
2458 filter_type: GeneralKeyword
2459 min_line_len: 13
2460 required_substrings:
2461 - token
2462 use_ml: true
2463 target:
2464 - code