gitlab-secret_detection 0.27.1 → 0.28.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d445466199d72be0341ca4bc333c65e37bbb93c3c07f150e3657a5cf0f98e187
-  data.tar.gz: d2beac0571169164e6ec3601da2687c9d605ab1cb340ef584634391786066387
+  metadata.gz: 99479e23cc29472b104146c3f33950d876e553d78e59a0018decfa01ef25eb7d
+  data.tar.gz: 043fbb440175574c7c337e04e45b6a8817b1686ba1b5386a379367f9d337773a
 SHA512:
-  metadata.gz: 765c2bcea9ba1e34c0121b0eb8634d5ad3de995af0b83bbe119eaf671ffc13f4be371f7ddbc59a7c60f3cb19cf157d937afd47cda2be305a5c67b5a35201ad31
-  data.tar.gz: fa5f3646fdecd75564a07908a847ea9eccbc3c6c69902bb049b31507e3f2705885ab4895a4763bfa60830e5bc268698e3043d693bbdb868144a5f87390faf6a6
+  metadata.gz: 8d72b4896199b9505c7c8ab72a193d9d7e4dc1e391dd88406c7bc4dee75806fe5bb69bdf9a102c19b7394f2e40fead4ae6723f7fd64c9d88c10f262808103881
+  data.tar.gz: bf3438f14f8f73c6bebbb78c44a739d25544cca4933ee2b5869187b73ffcd4ac05f9bc79d90c2ed4b52e464e61af54d3d3c1b2e66f788d8c1ab3ff608947ec21

data/lib/gitlab/secret_detection/core/secret_push_protection_rules.toml

@@ -1,4 +1,4 @@
-# rule-set version: 0.10.0
+# rule-set version: 0.11.0
 # Rules are auto-generated. See https://gitlab.com/gitlab-org/security-products/secret-detection/secret-detection-rules for instructions on updating the rules.
 [[rules]]
 id = 'Adobe Client Secret'
@@ -162,6 +162,15 @@ remediation = "For general guidance on handling security incidents with regards
 tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
 keywords = ['glrt']
 
+[[rules]]
+id = 'gitlab_runner_auth_token_routable'
+regex = '\bglrt-[0-9a-zA-Z_-]{27,300}\.[0-9a-z]{2}\.[0-9a-z]{2}[0-9a-z]{7}\b'
+description = "A routable GitLab runner authentication token was identified. These tokens allow users to register or authenticate as a runner\nwith the selected project. A malicious actor with access to this token can add a custom runner to the pipeline and\npossibly compromise the repository if the runner was used."
+title = 'GitLab runner authentication token (routable)'
+remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke a runner authentication token, the runner needs to be removed and re-created\n\n- Sign in to your GitLab account and visit the project that created the runner registration token\n- In the left-hand menu, select \"Settings\"\n- Under the \"Settings\" options, select \"CI/CD\"\n- Under the \"Runners\" section, find the runner with the identified token, (you can check the runner `config.toml` if you\n  are unsure)\n- Select \"Remove runner\"\n- When prompted, select \"Remove\"\n\nFor more information, please see [GitLabs documentation on registering runners](https://docs.gitlab.com/runner/register/)."
+tags = ['gitlab', 'gitlab_blocking', 'client_side_sd']
+keywords = ['glrt-']
+
 [[rules]]
 id = 'gitlab_oauth_app_secret'
 regex = '\b(gloas-[0-9a-zA-Z_\-]{64})(?:[[:punct:]]|[[:space:]]|[[:blank:]]|$)'
@@ -200,7 +209,7 @@ keywords = ['glimt']
 
 [[rules]]
 id = 'Grafana API token'
-regex = "['\\\"]eyJrIjoi(?i)[a-z0-9-_=]{72,92}['\\\"]"
+regex = "['\\\"]eyJrIjoi[a-zA-Z0-9-_=]{72,92}['\\\"]"
 description = 'Grafana API token'
 title = 'Grafana API token'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."
@@ -209,7 +218,7 @@ keywords = ['eyJrIjoi']
 
 [[rules]]
 id = 'Hashicorp Terraform user/org API token'
-regex = "['\\\"](?i)[a-z0-9]{14}\\.atlasv1\\.[a-z0-9-_=]{60,70}['\\\"]"
+regex = "['\\\"][a-zA-Z0-9]{14}\\.atlasv1\\.[a-zA-Z0-9-_=]{60,70}['\\\"]"
 description = "A HashiCorp Terraform API token was identified. API tokens can be used to access the HCP Terraform API. A malicious\nactor with access to this token can perform all actions the user account is entitled to."
 title = 'HashiCorp Terraform API token'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an API token:\n\n- Sign in to the Terraform HCP console and access <https://app.terraform.io/app/settings/tokens>\n- Find the token that was identified\n- Select the trash icon on the right hand side of the token\n- When prompted, select \"Confirm\" in the \"Deleting token ...\" dialog\n\nFor more information, please see [Terraform's documentation on API tokens](https://app.terraform.io/app/settings/tokens)."
@@ -236,7 +245,7 @@ keywords = ['lin_api_']
 
 [[rules]]
 id = 'Mailchimp API key'
-regex = "(?i)mailchimp[a-z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-f0-9]{32}-us20)['\\\"]"
+regex = "(?i:mailchimp)[a-zA-Z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-f0-9]{32}-us20)['\\\"]"
 description = "A Mailchimp API key was identified. API keys can be used send emails, create and send marketing campaigns, access\ncustomer lists and email addresses. A malicious actor with access to this key can perform any API request to Mailchimp\nwithout restriction."
 title = 'Mailchimp API key'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an API key:\n\n- Sign in to your Mailchimp account at <https://login.mailchimp.com/>\n- Select your profile icon then select Profile\n- Select the Extras dropdown list then choose \"API keys\"\n- Find the identified key and select \"Revoke\"\n- When prompted, type \"REVOKE\" to confirm and select \"Revoke\" in the \"Revoke API Key\" dialog\n\nFor more information, please see [Mailchimp's documentation on API key security](https://mailchimp.com/help/about-api-keys/#api+key+security)."
@@ -245,7 +254,7 @@ keywords = ['mailchimp']
 
 [[rules]]
 id = 'Mailgun private API token'
-regex = "(?i)mailgun[a-z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"](key-[a-f0-9]{32})['\\\"]"
+regex = "(?i:mailgun)[a-zA-Z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"](key-[a-f0-9]{32})['\\\"]"
 description = "A Mailgun private API token was identified. This key allows you to perform read, write, and delete operations through\nvarious API endpoints and for any of your sending domains. A malicious actor with access to this key can perform any API\nrequest to Mailgun without restriction."
 title = 'Mailgun private API token'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate a private API token:\n\n- Sign in to your Mailgun account and access the dashboard at <https://app.mailgun.com/>\n- On the top right-hand side, select your account profile and then select \"API Security\"\n- Find the identified key and select the trash icon\n  - If you cannot select the trash icon, you must first generate a new key by selecting \"Add new key\"\n- When prompted, select \"Delete\" in the \"Delete API Key\" dialog\n\nFor more information, please see [Mailgun's documentation on API keys](https://documentation.mailgun.com/docs/mailgun/user-manual/get-started/#primary-account-api-key)."
@@ -254,7 +263,7 @@ keywords = ['mailgun']
 
 [[rules]]
 id = 'Mailgun webhook signing key'
-regex = "(?i)mailgun[a-z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})['\\\"]"
+regex = "(?i:mailgun)[a-zA-Z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})['\\\"]"
 description = "A Mailgun webhook signing key was identified. This key is used by Mailgun to sign all incoming webhook message payloads.\nA malicious actor with access to this key can potentially sign fake webhook events and send it to your service to pass\nvalidation and be processed."
 title = 'Mailgun webhook signing key'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo rotate your HTTP webhook signing key:\n\n- Sign in to your Mailgun account and access the dashboard at <https://app.mailgun.com/>\n- On the top right-hand side, select your account profile and select \"API Security\"\n- In the \"HTTP webhook signing key\" section, select the rotate arrow icon in the right hand side\n- When prompted, select \"Reset Key\" in the \"Reset HTTP webhook signing key\" dialog\n\nFor more information, please see [Mailgun's documentation on webhooks](https://documentation.mailgun.com/docs/mailgun/user-manual/tracking-messages/#securing-webhooks)."
@@ -281,7 +290,7 @@ keywords = ['NRAK']
 
 [[rules]]
 id = 'New Relic user API ID'
-regex = "(?i)newrelic[a-z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([A-Z0-9]{64})['\\\"]"
+regex = "(?i:newrelic)[a-zA-Z0-9_ .\\-,]{0,25}(?:=|>|:=|\\|\\|:|<=|=>|:).{0,5}['\\\"]([a-zA-Z0-9]{64})['\\\"]"
 description = 'New Relic user API ID'
 title = 'New Relic user API ID'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nFor more information, please see [New Relic's documentation on rotating API keys](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/#rotate-keys)."
@@ -290,7 +299,7 @@ keywords = ['newrelic']
 
 [[rules]]
 id = 'npm access token'
-regex = "['\\\"](npm_(?i)[a-z0-9]{36})['\\\"]"
+regex = "['\\\"](npm_[a-zA-Z0-9]{36})['\\\"]"
 description = "An npm access token was identified. Access tokens can either be classic or granular, both of which allow customization\nof permissions. Depending on the permissions, a malicious actor with access to this token can read packages and package\ninformation, or create new packages and publish them under the account that created them."
 title = 'npm access token'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet).\n\nTo revoke an access token from the UI:\n\n- Sign in to your npm account at <https://www.npmjs.com/login>\n- In the top right corner, select your profile picture and then select \"Access Tokens\"\n- Find the token that was identified and select \"x\" in the \"Delete\" column\n- When prompted, select \"OK\" in the dialog\n\nFor more information, please see [npm's documentation on revoking access tokens](https://docs.npmjs.com/revoking-access-tokens)."
@@ -353,7 +362,7 @@ keywords = ['sgp_']
 
 [[rules]]
 id = 'Sendgrid API token'
-regex = 'SG\.(?i)[a-z0-9_\-\.]{66}'
+regex = 'SG\.[a-zA-Z0-9_\-\.]{66}'
 description = 'SendGrid API token'
 title = 'SendGrid API token'
 remediation = "For general guidance on handling security incidents with regards to leaked keys, please see the GitLab documentation on\n[Credential exposure to the internet](https://docs.gitlab.com/ee/security/responding_to_security_incidents.html#credential-exposure-to-public-internet)."

data/lib/gitlab/secret_detection/version.rb

@@ -5,7 +5,7 @@ module Gitlab
     class Gem
       # Ensure to maintain the same version in CHANGELOG file.
       # More details available under 'Release Process' section in the README.md file.
-      VERSION = "0.27.1"
+      VERSION = "0.28.0"
 
       # SD_ENV env var is used to determine which environment the
       # server is running. This var is defined in `.runway/env-<env>.yml` files.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-secret_detection
 version: !ruby/object:Gem::Version
-  version: 0.27.1
+  version: 0.28.0
 platform: ruby
 authors:
 - group::secret detection
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-05-14 00:00:00.000000000 Z
+date: 2025-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: grpc