@akasecurity/cli 0.8.1 → 0.9.0-rc1

package/web-ui/rules/core-pii/national-id.json

@@ -0,0 +1,27 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/national-id",
+  "name": "National ID number (multi-country)",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Z]{2}\\d{6}[A-D]\\b|\\b[2-9]\\d{11}\\b|(?:national\\s*id|aadhaar|\\bSIN\\b).{0,10}?\\d{3}[\\s-]?\\d{3}[\\s-]?\\d{3}\\b",
+    "flags": "gi"
+  },
+  "requiresNearby": {
+    "labels": [
+      "national id",
+      "national identity",
+      "national insurance",
+      "nino",
+      "ni",
+      "aadhaar",
+      "sin",
+      "identity number",
+      "id number"
+    ],
+    "windowChars": 160
+  },
+  "examples": ["Aadhaar: 234567890123", "NI: AB123456C", "SIN: 123-456-789"]
+}

package/web-ui/rules/core-pii/passport-us.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/passport-us",
+  "name": "US passport number",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Z]\\d{8}\\b",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["passport"],
+    "windowChars": 160
+  },
+  "examples": ["Passport: A12345678"]
+}

package/web-ui/rules/core-pii/phone-intl.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/phone-intl",
+  "name": "International phone number",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\+\\d{1,3}(?:[-.\\s]\\d{1,14}){1,5}\\b",
+    "flags": "g"
+  },
+  "examples": ["+44 20 7946 0958", "+86 138 0013 8000"]
+}

package/web-ui/rules/core-pii/phone-us.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/phone-us",
+  "name": "US phone number",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<!\\d)(?:\\+?1[-.\\s]?)?(?:\\([2-9]\\d{2}\\)[-.\\s]?|[2-9]\\d{2}[-.\\s])\\d{3}[-.\\s]\\d{4}(?!\\d)",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "labels": ["phone", "call", "mobile", "cell", "tel", "telephone", "contact", "fax", "dial"],
+    "windowChars": 160
+  },
+  "examples": ["(555) 123-4567", "+1-555-123-4567"]
+}

package/web-ui/rules/core-pii/ssn.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/ssn",
+  "name": "US Social Security Number",
+  "category": "pii",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?!000|666|9\\d{2})\\d{3}[\\s\\-](?!00)\\d{2}[\\s\\-](?!0000)\\d{4}\\b",
+    "flags": "g"
+  },
+  "examples": ["123-45-6789"]
+}

package/web-ui/rules/core-pii/vin.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/vin",
+  "name": "Vehicle Identification Number",
+  "category": "pii",
+  "severity": "medium",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-HJ-NPR-Z0-9]{17}\\b",
+    "flags": "g"
+  },
+  "examples": ["1HGCM82633A004352"]
+}

package/web-ui/rules/core-pii/zip.json

@@ -0,0 +1,30 @@
+{
+  "specVersion": 1,
+  "id": "core-pii/zip",
+  "name": "US ZIP / ZIP+4 postal code",
+  "category": "pii",
+  "severity": "low",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b\\d{5}(?:-\\d{4})?\\b",
+    "flags": "g"
+  },
+  "requiresNearby": {
+    "ruleIds": ["core-pii/home-address"],
+    "labels": [
+      "address",
+      "street",
+      "avenue",
+      "boulevard",
+      "mailing",
+      "shipping",
+      "billing",
+      "suite",
+      "p.o. box",
+      "po box",
+      "postal"
+    ],
+    "windowChars": 120
+  },
+  "examples": ["Shipping address: 123 Main Street, Springfield, IL 94107-1234"]
+}

package/web-ui/rules/secrets/anthropic-api-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/anthropic-api-key",
+  "name": "Anthropic API key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bsk-ant-[A-Za-z0-9_-]{40,}",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["sk-ant-AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]
+}

package/web-ui/rules/secrets/aws-access-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/aws-access-key",
+  "name": "AWS Access Key ID",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(AKIA|ASIA|AROA|AIDA|ANPA|ANVA|APKA)[A-Z0-9]{16}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["AKIAIOSFODNN7EXAMPLE"]
+}

package/web-ui/rules/secrets/aws-secret-key.json

@@ -0,0 +1,15 @@
+{
+  "specVersion": 1,
+  "id": "secrets/aws-secret-key",
+  "name": "AWS Secret Access Key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "aws[_.-]?secret[_.-]?(?:access[_.-]?)?key[\"'\\s:=]{1,5}([A-Za-z0-9/+]{40})",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": ["AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"]
+}

package/web-ui/rules/secrets/azure-connection-string.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets/azure-connection-string",
+  "name": "Azure connection string",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<![A-Za-z0-9])(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\x3B\\r\\n]{1,400}\\x3B(?:[A-Za-z][A-Za-z0-9_]{0,39}=[^\\x3B\\r\\n]{1,400}\\x3B){0,10}(?:DefaultEndpointsProtocol|AccountEndpoint|AccountName|AccountKey|SharedAccessSignature|SharedAccessKeyName|SharedAccessKey|EndpointSuffix|BlobEndpoint|QueueEndpoint|TableEndpoint|FileEndpoint|HostName|Endpoint)=(?![{<($])[^\\x3B\\r\\n]{1,400}(?:\\x3B[A-Za-z][A-Za-z0-9_]{0,39}=[^\\x3B\\r\\n]{1,400}){0,10}",
+    "flags": "g"
+  },
+  "examples": ["AccountName=mystorage;AccountKey=abc123=="]
+}

package/web-ui/rules/secrets/cloudflare-api-key.json

@@ -0,0 +1,15 @@
+{
+  "specVersion": 1,
+  "id": "secrets/cloudflare-api-key",
+  "name": "Cloudflare API token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "cloudflare.{0,40}?[\"'\\s:=]([A-Za-z0-9_-]{40})",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": ["CLOUDFLARE_API_TOKEN=kQ9fL2mP7xR4tY6wB1nC8vD3jH5sZ0aG2eU4iO7p"]
+}

package/web-ui/rules/secrets/datadog-key.json

@@ -0,0 +1,15 @@
+{
+  "specVersion": 1,
+  "id": "secrets/datadog-key",
+  "name": "Datadog API/Application key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:DD_API_KEY|DD_APP_KEY|DATADOG_API_KEY|DATADOG_APP_KEY)[\\s:=]+([A-Za-z0-9]{32,40})\\b",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": ["DD_API_KEY=a3F5g8H1j4K7m2N0p9Q6r1S4t7U0v3W8"]
+}

package/web-ui/rules/secrets/digitalocean-token.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets/digitalocean-token",
+  "name": "DigitalOcean Personal Access Token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bdop_v1_[A-Za-z0-9]{64}\\b",
+    "flags": "g"
+  },
+  "examples": ["dop_v1_1234567890123456789012345678901234567890123456789012345678901234"]
+}

package/web-ui/rules/secrets/discord-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/discord-token",
+  "name": "Discord bot token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Za-z0-9]{24}\\.[A-Za-z0-9]{6}\\.[A-Za-z0-9_\\-]{27}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["AbCdEfGhIjKlMnOpQrStUvWx.YzAbCd.ABCdEfGhIjKlMnOpQrStUvWxYzAbCdEf"]
+}

package/web-ui/rules/secrets/gcp-service-account.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "secrets/gcp-service-account",
+  "name": "GCP service account key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[a-z0-9][a-z0-9-]{2,60}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
+    "flags": "g"
+  },
+  "examples": [
+    "deploy-bot@sample-project.iam.gserviceaccount.com",
+    "12345678-1234-1234-1234-123456789012@my-project.iam.gserviceaccount.com"
+  ]
+}

package/web-ui/rules/secrets/github-pat.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "secrets/github-pat",
+  "name": "GitHub Personal Access Token (classic and fine-grained)",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:gh[psou]_[A-Za-z0-9]{36}|github_pat_[0-9A-Za-z_]{82})\\b",
+    "flags": "g"
+  },
+  "examples": [
+    "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",
+    "ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"
+  ]
+}

package/web-ui/rules/secrets/gitlab-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/gitlab-token",
+  "name": "GitLab Personal/Project Access Token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bglpat-[A-Za-z0-9\\-_]{20,40}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["glpat-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]
+}

package/web-ui/rules/secrets/heroku-api-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/heroku-api-key",
+  "name": "Heroku API key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "heroku.{0,40}?([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["HEROKU_API_KEY=3f8a1c2e-9b4d-4e6f-a1b2-c3d4e5f6a7b8"]
+}

package/web-ui/rules/secrets/npm-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/npm-token",
+  "name": "npm access token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bnpm_[A-Za-z0-9]{36,60}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["npm_AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjKlMnO"]
+}

package/web-ui/rules/secrets/openai-api-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/openai-api-key",
+  "name": "OpenAI API key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bsk-proj-[A-Za-z0-9]{20,60}\\b|\\bsk-[A-Za-z0-9]{40,55}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["sk-proj-AbCdEfGhIjKlMnOpQrStUvWxYz1234567890AbCdEfGhIjK"]
+}

package/web-ui/rules/secrets/pulumi-access-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/pulumi-access-token",
+  "name": "Pulumi access token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bpul-[A-Za-z0-9]{20,60}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["pul-ABCdEfGhIjKlMnOpQrStUvWxYz1234567890"]
+}

package/web-ui/rules/secrets/sendgrid-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/sendgrid-key",
+  "name": "SendGrid API key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bSG\\.[A-Za-z0-9_\\-]{20,60}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["SG.AbCdEfGhIjKlMnOpQrStUvWxYzAbCdEfGhIjKlMnOpQrStUvWxYz"]
+}

package/web-ui/rules/secrets/slack-token.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets/slack-token",
+  "name": "Slack API token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:xox[baprs]-[A-Za-z0-9]{10,60}|xapp-[A-Za-z0-9-]{10,60})\\b",
+    "flags": "g"
+  },
+  "examples": ["xoxb-123456789012-123456789012-ABCdEfGhIjKlMnOpQrStUvWx"]
+}

package/web-ui/rules/secrets/stripe-live-key.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/stripe-live-key",
+  "name": "Stripe live API key",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:sk|pk|rk)_live_[A-Za-z0-9]{24,40}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["sk_live_aBcDeFgHiJkLmNoPqRsTuVwXyZ"]
+}

package/web-ui/rules/secrets/terraform-cloud-token.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "secrets/terraform-cloud-token",
+  "name": "Terraform Cloud / TFE user token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Za-z0-9]{14}\\.atlasv1\\.[A-Za-z0-9_\\-]{60,80}\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": [
+    "AbCdEfGhIjKlMnOp.atlasv1.XyZ1234567890123456789012345678901234567890123456789012345678901234567890"
+  ]
+}

package/web-ui/rules/secrets/twilio-key.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets/twilio-key",
+  "name": "Twilio Account SID",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\bAC[A-Za-z0-9]{32}\\b",
+    "flags": "g"
+  },
+  "examples": ["AC12345678901234567890123456789012"]
+}

package/web-ui/rules/secrets/vault-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets/vault-token",
+  "name": "HashiCorp Vault token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:hvs\\.[A-Za-z0-9\\-_]{20,50}|s\\.[A-Za-z0-9\\-_]{20,50})\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": ["hvs.AbCdEfGhIjKlMnOpQrStUvWxYz1234567890"]
+}

package/web-ui/rules/secrets-infra/api-key-header.json

@@ -0,0 +1,15 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/api-key-header",
+  "name": "API key in a custom HTTP header",
+  "category": "secret",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "[\"']?\\bapi-?key\\b[\"']?\\s*:\\s*[\"']?([A-Za-z0-9+/_\\-.]{16,500})[\"']?",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": ["X-Api-Key: aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"]
+}

package/web-ui/rules/secrets-infra/basic-auth-header.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/basic-auth-header",
+  "name": "HTTP Basic auth Authorization header",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "authorization\\s*:\\s*basic\\s+[A-Za-z0-9+/=]{16,}",
+    "flags": "gi"
+  },
+  "examples": ["Authorization: Basic dXNlcjpwYXNzd29yZDEyMzQ="]
+}

package/web-ui/rules/secrets-infra/basic-auth-url.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/basic-auth-url",
+  "name": "URL with embedded basic auth credentials",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "https?://[A-Za-z0-9_%\\-]+:[A-Za-z0-9_%\\-]+@[A-Za-z0-9.\\-]+",
+    "flags": "g"
+  },
+  "examples": ["https://user:password@example.com/path"]
+}

package/web-ui/rules/secrets-infra/bearer-token.json

@@ -0,0 +1,17 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/bearer-token",
+  "name": "Generic Authorization Bearer token",
+  "category": "secret",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:Bearer|bearer)\\s+([A-Za-z0-9_\\-.]{20,500})",
+    "flags": "g",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": [
+    "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+  ]
+}

package/web-ui/rules/secrets-infra/db-connection-string.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/db-connection-string",
+  "name": "Database connection string with credentials",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis|rediss)://[A-Za-z0-9_%\\-]+:[A-Za-z0-9_%\\-]+@[A-Za-z0-9.\\-]+(?:\\:\\d+)?",
+    "flags": "g"
+  },
+  "examples": ["postgresql://user:password@localhost:5432/mydb"]
+}

package/web-ui/rules/secrets-infra/docker-config-auth.json

@@ -0,0 +1,13 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/docker-config-auth",
+  "name": "Docker config.json auth (base64-encoded)",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\"auth\"\\s*:\\s*\"[A-Za-z0-9+/]{12,}={0,2}\"",
+    "flags": "g"
+  },
+  "examples": ["\"auths\": {\"https://index.docker.io/v1/\": {\"auth\": \"dXNlcjpwYXNzd29yZA==\"}}"]
+}

package/web-ui/rules/secrets-infra/env-key-value.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/env-key-value",
+  "name": "Environment variable assignment with sensitive key",
+  "category": "secret",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b[A-Za-z0-9_]*(?:API_KEY|API_SECRET|SECRET_KEY|SECRET|TOKEN|PASSWORD|PASS|CREDENTIALS|PRIVATE_KEY|ENCRYPTION_KEY|SIGNING_KEY)\\s*=\\s*[\"']?([^\\s\"']{4,})",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "examples": ["API_KEY=aBcDeFgHiJkLmNoPqRsTuVwXyZ1234567890"]
+}

package/web-ui/rules/secrets-infra/generic-high-entropy-secret.json

@@ -0,0 +1,18 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/generic-high-entropy-secret",
+  "name": "Generic high-entropy secret assigned to a credential-shaped field",
+  "category": "secret",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "(?<![A-Za-z0-9_-])[A-Za-z0-9_]{0,34}(?:(?:secret|token|passw(?:or)?d|credentials?|(?<!api[_-]?)key)(?:[\"']?\\s*:|\\s+=)|(?:passwd|credential|(?<!api[_-]?)(?<!secret_)(?<!private_)(?<!encryption_)(?<!signing_)key)=)\\s*[\"']?((?!eyJ)[A-Za-z0-9+/_\\-]{20,200})",
+    "flags": "gi",
+    "captureGroup": 1
+  },
+  "postValidators": ["entropy"],
+  "examples": [
+    "authToken: \"aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890\"",
+    "MASTER_KEY=aBc123XyZ789kLmNoPqRsTuVwXyZ1234567890"
+  ]
+}

package/web-ui/rules/secrets-infra/jwt-token.json

@@ -0,0 +1,16 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/jwt-token",
+  "name": "JSON Web Token (JWT)",
+  "category": "secret",
+  "severity": "high",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\beyJ[A-Za-z0-9_\\-+/]+\\.[A-Za-z0-9_\\-+/]+\\.[A-Za-z0-9_\\-+/]+\\b",
+    "flags": "g"
+  },
+  "postValidators": ["entropy"],
+  "examples": [
+    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U"
+  ]
+}

package/web-ui/rules/secrets-infra/kubeconfig-token.json

@@ -0,0 +1,14 @@
+{
+  "specVersion": 1,
+  "id": "secrets-infra/kubeconfig-token",
+  "name": "Kubernetes kubeconfig embedded token",
+  "category": "secret",
+  "severity": "critical",
+  "matcher": {
+    "type": "regex",
+    "pattern": "\\b(?:client-(?:certificate|key)-data|token):\\s+([A-Za-z0-9+/=_.-]{20,})",
+    "flags": "g",
+    "captureGroup": 1
+  },
+  "examples": ["token: eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9..."]
+}