Rules ConfigurationΒΆ

  1- name: Credit card number
  2  severity: info
  3  type: pattern
  4  values:
  5    - (?<!([0-9]\.|[=*+\/\-] |.[=*+\/\-]))((?<![0-9A-Za-z_=*+\-\/.])(?P<value>[0-9]{16})(?![0-9A-Za-z_=*+\-\/.]))(?!(\.[0-9]| [=*+\/\-]|.[=*+\/\-]))
  6  filter_type:
  7    - CreditCardNumberCheck
  8  min_line_len: 16
  9  usage_list:
 10    - src
 11
 12- name: API
 13  severity: medium
 14  type: keyword
 15  values:
 16    - api
 17  filter_type: GeneralKeyword
 18  use_ml: true
 19  min_line_len: 11
 20  required_substrings:
 21    - api
 22  usage_list:
 23    - src
 24
 25- name: AWS Client ID
 26  severity: high
 27  type: pattern
 28  values:
 29    - (^|[^0-9A-Za-z])(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})([^0-9A-Za-z]|$)
 30  filter_type: GeneralPattern
 31  use_ml: true
 32  required_substrings:
 33    - A
 34  min_line_len: 20
 35  usage_list:
 36    - src
 37    - doc
 38
 39- name: AWS Multi
 40  severity: high
 41  type: pattern
 42  values:
 43    - (^|[^0-9A-Za-z])(?P<value>(AKIA|ASIA)[0-9A-Z]{16,17})([^0-9A-Za-z]|$)
 44    - (?P<value>[0-9a-zA-Z/+]{40})
 45  filter_type: GeneralPattern
 46  use_ml: true
 47  required_substrings:
 48    - AKIA
 49    - ASIA
 50  min_line_len: 20
 51  usage_list:
 52    - src
 53    - doc
 54
 55- name: AWS MWS Key
 56  severity: high
 57  type: pattern
 58  values:
 59    - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})
 60  filter_type: GeneralPattern
 61  use_ml: true
 62  required_substrings:
 63    - amzn
 64  min_line_len: 30
 65  usage_list:
 66    - src
 67    - doc
 68
 69- name: Credential
 70  severity: medium
 71  type: keyword
 72  values:
 73    - credential
 74  filter_type: GeneralKeyword
 75  use_ml: true
 76  min_line_len: 18
 77  required_substrings:
 78    - credential
 79  usage_list:
 80    - src
 81
 82- name: Dynatrace API Token
 83  severity: high
 84  type: pattern
 85  values:
 86    - (?P<value>dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64})
 87  filter_type: GeneralPattern
 88  use_ml: true
 89  required_substrings:
 90    - dt0
 91  min_line_len: 90
 92  usage_list:
 93    - src
 94    - doc
 95
 96- name: Facebook Access Token
 97  severity: high
 98  type: pattern
 99  values:
100    - (?P<value>EAACEdEose0cBA[0-9A-Za-z]+)
101  filter_type: GeneralPattern
102  use_ml: true
103  required_substrings:
104    - EAACEdEose0cBA
105  min_line_len: 15
106  usage_list:
107    - src
108    - doc
109
110- name: Github Old Token
111  severity: high
112  type: pattern
113  values:
114    - (?i)((git)[\w\-]*(token|key|api)[\w\-]*(\s)*(=|:|:=)(\s)*(["']?)(?P<value>[a-z|\d]{40})(["']?))
115  filter_type: GeneralPattern
116  use_ml: true
117  validations:
118    - GithubTokenValidation
119  required_substrings:
120    - git
121  min_line_len: 47
122  usage_list:
123    - src
124    - doc
125
126- name: Google API Key
127  severity: high
128  type: pattern
129  values:
130    - (^|[^0-9A-Za-z])(?P<value>AIza[0-9A-Za-z\-_]{35})([^0-9A-Za-z]|$)
131  filter_type: GeneralPattern
132  use_ml: false
133  validations:
134    - GoogleApiKeyValidation
135  required_substrings:
136    - AIza
137  min_line_len: 39
138  usage_list:
139    - src
140    - doc
141
142- name: Google Multi
143  severity: high
144  type: pattern
145  values:
146    - (?P<value>[0-9]+\-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com)
147    - (?<![0-9a-zA-Z_-])(?P<value>[0-9a-zA-Z_-]{24})([^0-9A-Za-z]|$)
148  filter_type: GeneralPattern
149  use_ml: false
150  validations:
151    - GoogleMultiValidation
152  required_substrings:
153    - .apps.googleusercontent.com
154  min_line_len: 40
155  usage_list:
156    - src
157    - doc
158
159- name: Google OAuth Access Token
160  severity: high
161  type: pattern
162  values:
163    - (^|[^0-9A-Za-z])(?P<value>ya29\.[0-9A-Za-z\-_]+)
164  filter_type: GeneralPattern
165  use_ml: true
166  required_substrings:
167    - ya29.
168  min_line_len: 6
169  usage_list:
170    - src
171    - doc
172
173- name: Heroku API Key
174  severity: high
175  type: pattern
176  values:
177    - (?P<value>(?i)heroku(.{0,20})?[0-9a-f]{8}(-[0-9a-f]{4})+-[0-9a-f]{12})
178  filter_type: GeneralPattern
179  use_ml: true
180  required_substrings:
181    - heroku
182  min_line_len: 24
183  usage_list:
184    - src
185    - doc
186
187- name: Instagram Access Token
188  severity: high
189  type: pattern
190  values:
191    - (^|[^0-9A-Za-z])(?P<value>IGQVJ[\w]{100,})
192  filter_type: GeneralPattern
193  use_ml: true
194  required_substrings:
195    - IGQVJ
196  min_line_len: 105
197  usage_list:
198    - src
199    - doc
200
201- name: JSON Web Token
202  severity: medium
203  type: pattern
204  values:
205    - (^|[^0-9A-Za-z])(?P<value>eyJ[A-Za-z0-9-_=]+(\.[A-Za-z0-9-_.+\/=]+)?)
206  filter_type: GeneralPattern
207  use_ml: true
208  required_substrings:
209    - eyJ
210  min_line_len: 9
211  usage_list:
212    - src
213    - doc
214
215- name: MailChimp API Key
216  severity: high
217  type: pattern
218  values:
219    - (^|[^0-9A-Za-z])(?P<value>[0-9a-zA-Z]{32}-us[0-9]{1,2})
220  filter_type: GeneralPattern
221  use_ml: false
222  validations:
223    - MailChimpKeyValidation
224  required_substrings:
225    - -us
226  min_line_len: 35
227  usage_list:
228    - src
229    - doc
230
231- name: MailGun API Key
232  severity: high
233  type: pattern
234  values:
235    - (^|[^0-9A-Za-z])(?P<value>key-[0-9a-zA-Z]{32})([^0-9A-Za-z]|$)
236  filter_type: GeneralPattern
237  use_ml: true
238  required_substrings:
239    - key-
240  min_line_len: 36
241  usage_list:
242    - src
243    - doc
244
245- name: Password
246  severity: medium
247  type: keyword
248  values:
249    - pass|pwd
250  filter_type: PasswordKeyword
251  use_ml: true
252  min_line_len: 10
253  required_substrings:
254    - pass
255    - pwd
256  usage_list:
257    - src
258
259- name: PayPal Braintree Access Token
260  severity: high
261  type: pattern
262  values:
263    - (?P<value>access_token\$production\$[0-9a-z]{16}\$[0-9a-z]{32})
264  filter_type: GeneralPattern
265  use_ml: false
266  required_substrings:
267    - access_token$production$
268  min_line_len: 72
269  usage_list:
270    - src
271    - doc
272
273- name: PEM Certificate
274  severity: high
275  type: pem_key
276  values:
277    - (?P<value>-----BEGIN\s(?!ENCRYPTED|EC).*PRIVATE)
278  filter_type:
279    - LineSpecificKeyCheck
280  min_line_len: 20
281  usage_list:
282    - src
283
284- name: Picatic API Key
285  severity: high
286  type: pattern
287  values:
288    - (?P<value>sk_live_[0-9a-z]{32})
289  filter_type: GeneralPattern
290  use_ml: false
291  required_substrings:
292    - sk_live_
293  min_line_len: 40
294  usage_list:
295    - src
296    - doc
297
298- name: Secret
299  severity: medium
300  type: keyword
301  values:
302    - secret
303  filter_type: GeneralKeyword
304  use_ml: true
305  min_line_len: 14
306  required_substrings:
307    - secret
308  usage_list:
309    - src
310
311- name: SendGrid API Key
312  severity: high
313  type: pattern
314  values:
315    - (?P<value>SG\.[\w_]{16,32}\.[\w_]{16,64})
316  filter_type: GeneralPattern
317  use_ml: false
318  required_substrings:
319    - SG.
320  min_line_len: 34
321  usage_list:
322    - src
323    - doc
324
325- name: Shopify Token
326  severity: high
327  type: pattern
328  values:
329    - (?P<value>shp(at|ca|pa|ss)_[a-fA-F0-9]{32})
330  filter_type: TokenPattern
331  required_substrings:
332    - shp
333  min_line_len: 38
334  usage_list:
335    - src
336    - doc
337
338- name: Slack Token
339  severity: high
340  type: pattern
341  values:
342    - (^|[^0-9A-Za-z])(?P<value>xox[a|b|p|r|o|s]\-[-a-zA-Z0-9]{10,250})
343  filter_type: GeneralPattern
344  use_ml: true
345  validations:
346    - SlackTokenValidation
347  required_substrings:
348    - xox
349  min_line_len: 15
350  usage_list:
351    - src
352    - doc
353
354- name: Slack Webhook
355  severity: high
356  type: pattern
357  values:
358    - (?P<value>hooks\.slack\.com/services/T\w{8}/B\w{8}/\w{24})
359  filter_type: GeneralPattern
360  use_ml: true
361  required_substrings:
362    - hooks.slack.com/services/T
363  min_line_len: 61
364  usage_list:
365    - src
366    - doc
367
368- name: Stripe Standard API Key
369  severity: high
370  type: pattern
371  values:
372    - (?P<value>sk_live_[0-9a-zA-Z]{24})
373  filter_type: GeneralPattern
374  use_ml: true
375  validations:
376    - StripeApiKeyValidation
377  required_substrings:
378    - sk_live_
379  min_line_len: 32
380  usage_list:
381    - src
382    - doc
383
384- name: Stripe Restricted API Key
385  severity: high
386  type: pattern
387  values:
388    - (?P<value>rk_live_[0-9a-zA-Z]{24})
389  filter_type: GeneralPattern
390  use_ml: true
391  required_substrings:
392    - rk_live_
393  min_line_len: 32
394  usage_list:
395    - src
396    - doc
397
398- name: Square Access Token
399  severity: high
400  type: pattern
401  values:
402    - (^|[^0-9A-Za-z])(?P<value>EAAA[0-9A-Za-z\-_]{60})([^0-9A-Za-z]|$)
403  filter_type: GeneralPattern
404  use_ml: true
405  validations:
406    - SquareAccessTokenValidation
407  required_substrings:
408    - EAAA
409  min_line_len: 64
410  usage_list:
411    - src
412    - doc
413
414- name: Square Client ID
415  severity: medium
416  type: pattern
417  values:
418    - (^|[^0-9A-Za-z])(?P<value>sq0[a-z]{3}-[0-9A-Za-z\-_]{22})([^0-9A-Za-z]|$)
419  filter_type: GeneralPattern
420  use_ml: true
421  validations:
422    - SquareClientIdValidation
423  required_substrings:
424    - sq0
425  min_line_len: 29
426  usage_list:
427    - src
428    - doc
429
430- name: Square OAuth Secret
431  severity: high
432  type: pattern
433  values:
434    - (?P<value>sq0csp-[0-9A-Za-z\-_]{43})
435  filter_type: GeneralPattern
436  use_ml: false
437  required_substrings:
438    - sq0csp
439  min_line_len: 50
440  usage_list:
441    - src
442    - doc
443
444- name: Token
445  severity: medium
446  type: keyword
447  values:
448    - token
449  filter_type: GeneralKeyword
450  use_ml: true
451  min_line_len: 13
452  required_substrings:
453    - token
454  usage_list:
455    - src
456
457- name: Twilio API Key
458  severity: high
459  type: pattern
460  values:
461    - (^|[^0-9A-Za-z])(?P<value>SK[0-9a-fA-F]{32})([^0-9A-Za-z]|$)
462  filter_type: GeneralPattern
463  use_ml: true
464  required_substrings:
465    - SK
466  min_line_len: 34
467  usage_list:
468    - src
469    - doc
470
471- name: URL Credentials
472  severity: high
473  type: pattern
474  values:
475    - //[^:]+(?P<separator>:)(?P<value>[^@]+)@
476  filter_type: UrlCredentialsGroup
477  use_ml: true
478  required_substrings:
479    - //
480  min_line_len: 6
481  usage_list:
482    - src
483    - doc
484
485- name: Auth
486  severity: medium
487  type: keyword
488  values:
489    - auth(?!or)
490  filter_type: GeneralKeyword
491  use_ml: true
492  min_line_len: 12
493  required_substrings:
494    - auth
495  usage_list:
496    - src
497
498- name: Key
499  severity: medium
500  type: keyword
501  values:
502    - key(?!word)
503  filter_type: GeneralKeyword
504  use_ml: true
505  min_line_len: 11
506  required_substrings:
507    - key
508  usage_list:
509    - src
510
511- name: Telegram Bot API Token
512  severity: high
513  type: pattern
514  values:
515    - (?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})
516  filter_type: GeneralPattern
517  required_substrings:
518    - :AA
519  min_line_len: 45
520  usage_list:
521    - src
522    - doc
523
524- name: PyPi API Token
525  severity: high
526  type: pattern
527  values:
528    - (?P<value>pypi-[\w_\-]{150,})
529  filter_type: GeneralPattern
530  required_substrings:
531    - pypi-
532  min_line_len: 155
533  usage_list:
534    - src
535    - doc
536
537- name: Github Token
538  severity: high
539  type: pattern
540  values:
541    - (^|[^0-9A-Za-z])(?P<value>(ghr|gho|ghu|ghs)_[\w]{36,255})
542  filter_type: GeneralPattern
543  required_substrings:
544    - gh
545  min_line_len: 40
546  usage_list:
547    - src
548    - doc
549
550- name: Github Personal Access Token
551  severity: high
552  type: pattern
553  values:
554    - (^|[^0-9A-Za-z])(?P<value>ghp_[\w]{36,255})
555  filter_type: GeneralPattern
556  validations:
557    - GithubTokenValidation
558  required_substrings:
559    - ghp_
560  min_line_len: 40
561  usage_list:
562    - src
563    - doc
564
565- name: Github Fine-granted Token
566  severity: high
567  type: pattern
568  values:
569    - (^|[^0-9A-Za-z])(?P<value>github_pat_[0-9A-Za-z_]{80,255})
570  filter_type: GeneralPattern
571  validations:
572    - GithubTokenValidation
573  required_substrings:
574    - github_pat_
575  min_line_len: 90
576  usage_list:
577    - src
578    - doc
579
580- name: Firebase Domain
581  severity: info
582  type: pattern
583  values:
584    - (?P<value>[a-z0-9.-]+\.firebaseio\.com|[a-z0-9.-]+\.firebaseapp\.com)
585  filter_type: GeneralPattern
586  required_substrings:
587    - .firebase
588  min_line_len: 16
589  usage_list:
590    - src
591    - doc
592
593- name: AWS S3 Bucket
594  severity: info
595  type: pattern
596  values:
597    - (?P<value>[a-z0-9.-]+\.s3\.amazonaws\.com|[a-z0-9.-]+\.s3-website[.-](eu|ap|us|ca|sa|cn))
598  filter_type: GeneralPattern
599  required_substrings:
600    - .s3-website
601    - .s3.amazonaws.com
602  min_line_len: 14
603  usage_list:
604    - src
605    - doc
606
607- name: Nonce
608  severity: medium
609  type: keyword
610  values:
611    - nonce
612  filter_type: GeneralKeyword
613  use_ml: true
614  min_line_len: 13
615  required_substrings:
616    - nonce
617  usage_list:
618    - src
619
620- name: Salt
621  severity: medium
622  type: keyword
623  values:
624    - salt
625  filter_type: GeneralKeyword
626  use_ml: true
627  min_line_len: 12
628  required_substrings:
629    - salt
630  usage_list:
631    - src
632
633- name: Certificate
634  severity: medium
635  type: keyword
636  values:
637    - cert
638  filter_type: GeneralKeyword
639  use_ml: true
640  min_line_len: 12
641  required_substrings:
642    - cert
643  usage_list:
644    - src
645
646- name: Azure Access Token
647  severity: high
648  type: pattern
649  values:
650    - (^|[^.0-9A-Za-z_/+-])(?P<value>eyJ[A-Za-z0-9_=-]{50,500}\.eyJ[A-Za-z0-9_=-]+\.[A-Za-z0-9_=-]+)
651  filter_type:
652    - ValueJsonWebTokenCheck
653  required_substrings:
654    - eyJ
655  min_line_len: 148
656  usage_list:
657    - src
658    - doc
659
660- name: Azure Secret Value
661  severity: high
662  type: pattern
663  values:
664    - (^|[^0-9A-Za-z_/+-])(?P<value>[a-zA-Z0-9_~.-]{3}8Q~[a-zA-Z0-9_~.-]{34})([^0-9A-Za-z+/_-]|$)
665  filter_type: TokenPattern
666  min_line_len: 40
667  required_substrings:
668    - 8Q~
669  usage_list:
670    - src
671    - doc
672
673- name: Bitbucket App Password
674  severity: high
675  type: pattern
676  values:
677    - (^|[^0-9A-Za-z])(?P<value>ATBB[A-Za-z0-9]{24}[A-F0-9]{8})([^0-9A-Za-z]|$)
678  filter_type: StructuredToken
679  min_line_len: 28
680  required_substrings:
681    - ATBB
682  usage_list:
683    - src
684    - doc
685
686- name: Bitbucket Repository Access Token
687  severity: high
688  type: pattern
689  values:
690    - (^|[^0-9A-Za-z])(?P<value>ATCTT3xFfGN0[a-zA-Z0-9-_]{171}=[A-F0-9]{8})([^0-9A-Za-z]|$)
691  filter_type: TokenPattern
692  min_line_len: 183
693  required_substrings:
694    - ATCTT3xFfGN0
695  usage_list:
696    - src
697    - doc
698
699- name: Bitbucket HTTP Access Token
700  severity: high
701  type: pattern
702  values:
703    - (^|[^0-9A-Za-z])(?P<value>BBDC-[NMO][ADgjQTwz][A-Za-z0-9+/]{42})([^0-9A-Za-z]|$)
704  filter_type: StructuredToken
705  min_line_len: 49
706  required_substrings:
707    - BBDC-
708  usage_list:
709    - src
710    - doc
711
712- name: Jira / Confluence PAT token
713  severity: high
714  type: pattern
715  values:
716    - (^|[^0-9A-Za-z+/-])(?P<value>[NMO][ADgjQTwz][a-zA-Z0-9+/]{42})([^0-9A-Za-z+/-]|$)
717  filter_type: StructuredToken
718  min_line_len: 44
719  required_substrings:
720    - M
721    - N
722    - O
723  usage_list:
724    - src
725    - doc
726
727- name: Atlassian PAT token
728  severity: high
729  type: pattern
730  values:
731    - (^|[^0-9A-Za-z])(?P<value>ATATT3xFfGF0[a-zA-Z0-9-_]{171}=[A-F0-9]{8})([^0-9A-Za-z]|$)
732  filter_type: TokenPattern
733  min_line_len: 191
734  required_substrings:
735    - ATATT3xFfGF0
736  usage_list:
737    - src
738    - doc
739
740- name: Digital Ocean PAT
741  severity: high
742  type: pattern
743  values:
744    - (^|[^0-9A-Za-z_/+-])(?P<value>dop_v1_[a-f0-9]{64})([^0-9A-Za-z+/_-]|$)
745  filter_type: TokenPattern
746  min_line_len: 71
747  required_substrings:
748    - dop_v1_
749  usage_list:
750    - src
751    - doc
752
753- name: Digital Ocean OAuth Access Token
754  severity: high
755  type: pattern
756  values:
757    - (^|[^0-9A-Za-z_/+-])(?P<value>doo_v1_[a-f0-9]{64})([^0-9A-Za-z+/_-]|$)
758  filter_type: TokenPattern
759  min_line_len: 71
760  required_substrings:
761    - doo_v1_
762  usage_list:
763    - src
764    - doc
765
766- name: Dropbox OAuth2 API Access Token
767  severity: high
768  type: pattern
769  values:
770    - (^|[^0-9A-Za-z])(?P<value>sl.[A-Za-z0-9_-]{135})([^0-9A-Za-z]|$)
771  filter_type: TokenPattern
772  min_line_len: 138
773  required_substrings:
774    - sl.
775  usage_list:
776    - src
777    - doc
778
779- name: NuGet API key
780  severity: high
781  type: pattern
782  values:
783    - (^|[^0-9A-Za-z_/+-])(?P<value>oy2[a-z0-9]{43})([^0-9A-Za-z+/_-]|$)
784  filter_type: TokenPattern
785  min_line_len: 46
786  required_substrings:
787    - oy2
788  usage_list:
789    - src
790    - doc
791
792- name: Gitlab PAT
793  severity: high
794  type: pattern
795  values:
796    - (^|[^0-9A-Za-z_/+-])(?P<value>glpat-[a-zA-Z0-9_-]{20})([^0-9A-Za-z+/_-]|$)
797  filter_type: TokenPattern
798  min_line_len: 26
799  required_substrings:
800    - glpat-
801  usage_list:
802    - src
803    - doc
804
805- name: Gitlab Pipeline Trigger Token
806  severity: high
807  type: pattern
808  values:
809    - (^|[^0-9A-Za-z_/+-])(?P<value>glptt-[a-f0-9]{40})([^0-9A-Za-z+/_-]|$)
810  filter_type: TokenPattern
811  min_line_len: 46
812  required_substrings:
813    - glptt-
814  usage_list:
815    - src
816    - doc
817
818- name: Gitlab Registration Runner Token
819  severity: high
820  type: pattern
821  values:
822    - (^|[^0-9A-Za-z_/+-])(?P<value>GR1348941[a-zA-Z0-9_-]{20})([^0-9A-Za-z+/_-]|$)
823  filter_type: TokenPattern
824  min_line_len: 29
825  required_substrings:
826    - GR1348941
827  usage_list:
828    - src
829    - doc
830
831- name: Gitlab Registration Runner Token 2023
832  severity: high
833  type: pattern
834  values:
835    - (^|[^0-9A-Za-z_/+-])(?P<value>glrt-[a-zA-Z0-9_-]{20})([^0-9A-Za-z+/_-]|$)
836  filter_type: TokenPattern
837  min_line_len: 25
838  required_substrings:
839    - glrt-
840  usage_list:
841    - src
842    - doc
843
844- name: Grafana Provisioned API Key
845  severity: high
846  type: pattern
847  values:
848    - (^|[^0-9A-Za-z_/+-])(?P<value>eyJ[a-zA-Z0-9=/-]{64,360})([^0-9A-Za-z+/_-]|$)
849  filter_type:
850    - ValueGrafanaCheck
851  min_line_len: 67
852  required_substrings:
853    - eyJ
854  usage_list:
855    - src
856    - doc
857
858- name: Grafana Access Policy Token
859  severity: high
860  type: pattern
861  values:
862    - (^|[^0-9A-Za-z_/+-])(?P<value>glc_eyJ[a-zA-Z0-9=/-]{80,360})([^0-9A-Za-z+/_-]|$)
863  filter_type:
864    - ValueGrafanaCheck
865  min_line_len: 87
866  required_substrings:
867    - glc_eyJ
868  usage_list:
869    - src
870    - doc
871
872- name: Dropbox API secret (long term)
873  severity: high
874  type: pattern
875  values:
876    - (^|[^0-9A-Za-z])(?=[A-Za-z0-9]{64})(?P<value>[A-Za-z0-9]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][A-Za-z0-9]{40,44})([^0-9A-Za-z_/-]|$)
877  filter_type: []
878  min_line_len: 43
879  required_substrings:
880    - AAAAAAAAAA
881  usage_list:
882    - src
883    - doc
884
885- name: Dropbox App secret
886  severity: info
887  type: pattern
888  values:
889    - (^|[^0-9A-Za-z_/+-])(?P<value>[a-z0-9]{15})([^=0-9A-Za-z+/_-]|$)
890  filter_type: WeirdBase36Token
891  min_line_len: 15
892  usage_list:
893    - src
894    - doc
895
896- name: Gitlab Incoming Email Token
897  severity: info
898  type: pattern
899  values:
900    - (^|[^0-9A-Za-z._/+-])(?P<value>[a-z0-9]{24,25})([^=0-9A-Za-z+/_-]|$)
901  filter_type: WeirdBase36Token
902  min_line_len: 24
903  usage_list:
904    - src
905    - doc
906
907- name: Jira 2FA
908  severity: info
909  type: pattern
910  values:
911    - (^|[^0-9A-Za-z_/+-])(?P<value>[A-Z2-7]{16})([^=0-9A-Za-z_/+-]|$)
912  filter_type:
913    - ValueCoupleKeywordCheck
914    - ValuePatternCheck
915    - ValueEntropyBase32Check
916    - ValueBase32DataCheck
917    - ValueTokenBase32Check
918  min_line_len: 16
919  usage_list:
920    - src
921    - doc