gitlab-secret_detection 0.39.2 → 0.40.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d8718e7ecd73dde6654d0be612f2601528c52ba6d300dada4436628ddbaaa067
|
|
4
|
+
data.tar.gz: 63ccb0506b87da6f3bd1546a5c7b6c2be70fdb6b1b188d78754f743947222d22
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ab6b941f592cb99cf7fda333886f43979dfb51772cccc873ac0f46729932fd3d1f768d3907b494bc62acf73d9fe376509eec63881a364358fcfe0516cf983a4d
|
|
7
|
+
data.tar.gz: 9fe37eef71551f5bf1d8c576a07db9cbbd15d8a18c22c3dfc33cf8fc0191f6122cc0862df08df4348fe1ed45e4a2f61e963e73550e1cf9623ef9cc9a5f595023
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
# rule-set version: 0.
|
|
1
|
+
# rule-set version: 0.23.0
|
|
2
2
|
# Rules are auto-generated. See https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-rules for instructions on updating the rules.
|
|
3
3
|
[[rules]]
|
|
4
4
|
id = 'AdafruitIOKey'
|
|
@@ -77,7 +77,7 @@ id = 'AtlassianApiKey'
|
|
|
77
77
|
regex = '\bATCTT3xFfGN0[0-9A-Za-z_-]{171}=[0-9A-F]{8}\b'
|
|
78
78
|
description = "An Atlassian Admin API Key or Bitbucket Repository Access Token was identified. These API keys allow you to manage your\norganization through the Atlassian Admin APIs.\n\n- For Admin API Keys a malicious actor can take over the entire organization's Atlassian products and services using\n this key.\n- For Bitbucket Repository Access Tokens, a malicious actor can gain the privileges assigned to the repository token\n which could be full access to a repository or just read access to certain aspects of the workspace."
|
|
79
79
|
title = 'Atlassian admin API key / Bitbucket repository access token'
|
|
80
|
-
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an Atlassian Repository Token:\n\n- At <https://bitbucket.org>, go to the repository the access token was created for\n-
|
|
80
|
+
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an Atlassian Repository Token:\n\n- At <https://bitbucket.org>, go to the repository the access token was created for\n- In the sidebar, select \"Repository Settings\"\n- In the sidebar, under Security, select \"Access tokens\"\n- Find the access token and select \"Revoke\", then confirm that you want to revoke the token\n\nFor more information on revoking and creating Atlassian Bitbucket Repository Tokens, please see their [documentation](https://support.atlassian.com/bitbucket-cloud/docs/create-a-repository-access-token/).\n\nTo revoke an Atlassian Admin API key:\n\n- Go to <https://admin.atlassian.com>\n- Select your organization if you have more than one\n- Select \"Settings > API keys\"\n- Select \"Revoke\" next to the API key\n\nFor more information on revoking and creating Atlassian Admin API Keys, please see their [documentation](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/)."
|
|
81
81
|
tags = ['gitlab_blocking']
|
|
82
82
|
keywords = ['ATCTT3xFfGN0']
|
|
83
83
|
|
|
@@ -470,7 +470,7 @@ keywords = ['glimt']
|
|
|
470
470
|
|
|
471
471
|
[[rules]]
|
|
472
472
|
id = 'GrafanaCloudAccessPolicyToken'
|
|
473
|
-
regex =
|
|
473
|
+
regex = "\\b(glc_eyJvIjoi[A-Za-z0-9+\\/]{80,220}={0,2})(?:\\\\['\"rn]|['\"\\x60; \\s]|<\\/|$)"
|
|
474
474
|
description = "A Grafana cloud access policy token was identified. Cloud access policy tokens are used for managing the stacks in\nGrafana. Any tokens defined in the Grafana Administration settings are limited to that Grafana's stack. Depending on the\nassigned scope, a malicious actor with access to this token can read or write metrics, logs, traces, alerts, rules, and\naccess policies."
|
|
475
475
|
title = 'Grafana cloud access policy token'
|
|
476
476
|
remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an access policy token:\n\n- Sign in to your Grafana instance and select \"Administration\" on the left-hand menu\n- Under \"User and access\" select \"Cloud access policies\"\n- Find the token that was identified and select the trash icon.\n\nFor more information, please see [Grafana's documentation on cloud access policies](https://grafana.com/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/)."
|
|
@@ -5,7 +5,7 @@ module Gitlab
|
|
|
5
5
|
class Gem
|
|
6
6
|
# Ensure to maintain the same version in CHANGELOG file.
|
|
7
7
|
# More details available under 'Release Process' section in the README.md file.
|
|
8
|
-
VERSION = "0.
|
|
8
|
+
VERSION = "0.40.0"
|
|
9
9
|
|
|
10
10
|
# SD_ENV env var is used to determine which environment the
|
|
11
11
|
# server is running. This var is defined in `.runway/env-<env>.yml` files.
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: gitlab-secret_detection
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.
|
|
4
|
+
version: 0.40.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- group::secret detection
|
|
@@ -10,7 +10,7 @@ authors:
|
|
|
10
10
|
autorequire:
|
|
11
11
|
bindir: bin
|
|
12
12
|
cert_chain: []
|
|
13
|
-
date: 2026-
|
|
13
|
+
date: 2026-04-01 00:00:00.000000000 Z
|
|
14
14
|
dependencies:
|
|
15
15
|
- !ruby/object:Gem::Dependency
|
|
16
16
|
name: grpc
|