@link-foundation/sensitive-data-sanitizer 0.0.0-stage → 0.11.31

package/src/vendor/gitleaks/rules-2.json

@@ -0,0 +1,292 @@
+[
+  {
+    "id": "github-oauth",
+    "description": "Discovered a GitHub OAuth Access Token, posing a risk of compromised GitHub account integrations and data leaks.",
+    "regex": "gho_[0-9a-zA-Z]{36}",
+    "entropy": 3,
+    "keywords": ["gho_"]
+  },
+  {
+    "id": "github-pat",
+    "description": "Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.",
+    "regex": "ghp_[0-9a-zA-Z]{36}",
+    "entropy": 3,
+    "keywords": ["ghp_"],
+    "allowlists": [
+      {
+        "paths": ["(?:^|/)@octokit/auth-token/README\\.md$"]
+      }
+    ]
+  },
+  {
+    "id": "github-refresh-token",
+    "description": "Detected a GitHub Refresh Token, which could allow prolonged unauthorized access to GitHub services.",
+    "regex": "ghr_[0-9a-zA-Z]{36}",
+    "entropy": 3,
+    "keywords": ["ghr_"]
+  },
+  {
+    "id": "gitlab-cicd-job-token",
+    "description": "Identified a GitLab CI/CD Job Token, potential access to projects and some APIs on behalf of a user while the CI job is running.",
+    "regex": "glcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}",
+    "entropy": 3,
+    "keywords": ["glcbt-"]
+  },
+  {
+    "id": "gitlab-deploy-token",
+    "description": "Identified a GitLab Deploy Token, risking access to repositories, packages and containers with write access.",
+    "regex": "gldt-[0-9a-zA-Z_\\-]{20}",
+    "entropy": 3,
+    "keywords": ["gldt-"]
+  },
+  {
+    "id": "gitlab-feature-flag-client-token",
+    "description": "Identified a GitLab feature flag client token, risks exposing user lists and features flags used by an application.",
+    "regex": "glffct-[0-9a-zA-Z_\\-]{20}",
+    "entropy": 3,
+    "keywords": ["glffct-"]
+  },
+  {
+    "id": "gitlab-feed-token",
+    "description": "Identified a GitLab feed token, risking exposure of user data.",
+    "regex": "glft-[0-9a-zA-Z_\\-]{20}",
+    "entropy": 3,
+    "keywords": ["glft-"]
+  },
+  {
+    "id": "gitlab-incoming-mail-token",
+    "description": "Identified a GitLab incoming mail token, risking manipulation of data sent by mail.",
+    "regex": "glimt-[0-9a-zA-Z_\\-]{25}",
+    "entropy": 3,
+    "keywords": ["glimt-"]
+  },
+  {
+    "id": "gitlab-kubernetes-agent-token",
+    "description": "Identified a GitLab Kubernetes Agent token, risking access to repos and registry of projects connected via agent.",
+    "regex": "glagent-[0-9a-zA-Z_\\-]{50}",
+    "entropy": 3,
+    "keywords": ["glagent-"]
+  },
+  {
+    "id": "gitlab-oauth-app-secret",
+    "description": "Identified a GitLab OIDC Application Secret, risking access to apps using GitLab as authentication provider.",
+    "regex": "gloas-[0-9a-zA-Z_\\-]{64}",
+    "entropy": 3,
+    "keywords": ["gloas-"]
+  },
+  {
+    "id": "gitlab-pat",
+    "description": "Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure.",
+    "regex": "glpat-[\\w-]{20}",
+    "entropy": 3,
+    "keywords": ["glpat-"]
+  },
+  {
+    "id": "gitlab-pat-routable",
+    "description": "Identified a GitLab Personal Access Token (routable), risking unauthorized access to GitLab repositories and codebase exposure.",
+    "regex": "\\bglpat-[0-9a-zA-Z_-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b",
+    "entropy": 4,
+    "keywords": ["glpat-"]
+  },
+  {
+    "id": "gitlab-ptt",
+    "description": "Found a GitLab Pipeline Trigger Token, potentially compromising continuous integration workflows and project security.",
+    "regex": "glptt-[0-9a-f]{40}",
+    "entropy": 3,
+    "keywords": ["glptt-"]
+  },
+  {
+    "id": "gitlab-rrt",
+    "description": "Discovered a GitLab Runner Registration Token, posing a risk to CI/CD pipeline integrity and unauthorized access.",
+    "regex": "GR1348941[\\w-]{20}",
+    "entropy": 3,
+    "keywords": ["gr1348941"]
+  },
+  {
+    "id": "gitlab-runner-authentication-token",
+    "description": "Discovered a GitLab Runner Authentication Token, posing a risk to CI/CD pipeline integrity and unauthorized access.",
+    "regex": "glrt-[0-9a-zA-Z_\\-]{20}",
+    "entropy": 3,
+    "keywords": ["glrt-"]
+  },
+  {
+    "id": "gitlab-runner-authentication-token-routable",
+    "description": "Discovered a GitLab Runner Authentication Token (Routable), posing a risk to CI/CD pipeline integrity and unauthorized access.",
+    "regex": "\\bglrt-t\\d_[0-9a-zA-Z_\\-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b",
+    "entropy": 4,
+    "keywords": ["glrt-"]
+  },
+  {
+    "id": "gitlab-scim-token",
+    "description": "Discovered a GitLab SCIM Token, posing a risk to unauthorized access for a organization or instance.",
+    "regex": "glsoat-[0-9a-zA-Z_\\-]{20}",
+    "entropy": 3,
+    "keywords": ["glsoat-"]
+  },
+  {
+    "id": "gitlab-session-cookie",
+    "description": "Discovered a GitLab Session Cookie, posing a risk to unauthorized access to a user account.",
+    "regex": "_gitlab_session=[0-9a-z]{32}",
+    "entropy": 3,
+    "keywords": ["_gitlab_session="]
+  },
+  {
+    "id": "gitter-access-token",
+    "description": "Uncovered a Gitter Access Token, which may lead to unauthorized access to chat and communication services.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:gitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["gitter"]
+  },
+  {
+    "id": "gocardless-api-token",
+    "description": "Detected a GoCardless API token, potentially risking unauthorized direct debit payment operations and financial data exposure.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:gocardless)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(live_(?i)[a-z0-9\\-_=]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["live_", "gocardless"]
+  },
+  {
+    "id": "grafana-api-key",
+    "description": "Identified a Grafana API key, which could compromise monitoring dashboards and sensitive data analytics.",
+    "regex": "(?i)\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["eyjrijoi"]
+  },
+  {
+    "id": "grafana-cloud-api-token",
+    "description": "Found a Grafana cloud API token, risking unauthorized access to cloud-based monitoring services and data exposure.",
+    "regex": "(?i)\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["glc_"]
+  },
+  {
+    "id": "grafana-service-account-token",
+    "description": "Discovered a Grafana service account token, posing a risk of compromised monitoring services and data integrity.",
+    "regex": "(?i)\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["glsa_"]
+  },
+  {
+    "id": "harness-api-key",
+    "description": "Identified a Harness Access Token (PAT or SAT), risking unauthorized access to a Harness account.",
+    "regex": "(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}",
+    "keywords": ["pat.", "sat."]
+  },
+  {
+    "id": "hashicorp-tf-api-token",
+    "description": "Uncovered a HashiCorp Terraform user/org API token, which may lead to unauthorized infrastructure management and security breaches.",
+    "regex": "(?i)[a-z0-9]{14}\\.(?-i:atlasv1)\\.[a-z0-9\\-_=]{60,70}",
+    "entropy": 3.5,
+    "keywords": ["atlasv1"]
+  },
+  {
+    "id": "hashicorp-tf-password",
+    "description": "Identified a HashiCorp Terraform password field, risking unauthorized infrastructure configuration and security breaches.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:administrator_login_password|password)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(\"[a-z0-9=_\\-]{8,20}\")(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "path": "(?i)\\.(?:tf|hcl)$",
+    "entropy": 2,
+    "keywords": ["administrator_login_password", "password"]
+  },
+  {
+    "id": "heroku-api-key",
+    "description": "Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:heroku)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["heroku"]
+  },
+  {
+    "id": "heroku-api-key-v2",
+    "description": "Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.",
+    "regex": "\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 4,
+    "keywords": ["hrku-aa"]
+  },
+  {
+    "id": "hubspot-api-key",
+    "description": "Found a HubSpot API Token, posing a risk to CRM data integrity and unauthorized marketing operations.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:hubspot)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["hubspot"]
+  },
+  {
+    "id": "huggingface-access-token",
+    "description": "Discovered a Hugging Face Access token, which could lead to unauthorized access to AI models and sensitive data.",
+    "regex": "\\b(hf_(?i:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["hf_"]
+  },
+  {
+    "id": "huggingface-organization-api-token",
+    "description": "Uncovered a Hugging Face Organization API token, potentially compromising AI organization accounts and associated data.",
+    "regex": "\\b(api_org_(?i:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["api_org_"]
+  },
+  {
+    "id": "infracost-api-token",
+    "description": "Detected an Infracost API Token, risking unauthorized access to cloud cost estimation tools and financial data.",
+    "regex": "\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["ico-"]
+  },
+  {
+    "id": "intercom-api-key",
+    "description": "Identified an Intercom API Token, which could compromise customer communication channels and data privacy.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:intercom)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{60})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["intercom"]
+  },
+  {
+    "id": "intra42-client-secret",
+    "description": "Found a Intra42 client secret, which could lead to unauthorized access to the 42School API and sensitive data.",
+    "regex": "\\b(s-s4t2(?:ud|af)-(?i)[abcdef0123456789]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["intra", "s-s4t2ud-", "s-s4t2af-"]
+  },
+  {
+    "id": "jfrog-api-key",
+    "description": "Found a JFrog API Key, posing a risk of unauthorized access to software artifact repositories and build pipelines.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{73})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["jfrog", "artifactory", "bintray", "xray"]
+  },
+  {
+    "id": "jfrog-identity-token",
+    "description": "Discovered a JFrog Identity Token, potentially compromising access to JFrog services and sensitive software artifacts.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["jfrog", "artifactory", "bintray", "xray"]
+  },
+  {
+    "id": "jwt",
+    "description": "Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.",
+    "regex": "\\b(ey[a-zA-Z0-9]{17,}\\.ey[a-zA-Z0-9\\/\\\\_-]{17,}\\.(?:[a-zA-Z0-9\\/\\\\_-]{10,}={0,2})?)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["ey"]
+  },
+  {
+    "id": "jwt-base64",
+    "description": "Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information.",
+    "regex": "\\bZXlK(?:(?P<alg>aGJHY2lPaU)|(?P<apu>aGNIVWlPaU)|(?P<apv>aGNIWWlPaU)|(?P<aud>aGRXUWlPaU)|(?P<b64>aU5qUWlP)|(?P<crit>amNtbDBJanBi)|(?P<cty>amRIa2lPaU)|(?P<epk>bGNHc2lPbn)|(?P<enc>bGJtTWlPaU)|(?P<jku>cWEzVWlPaU)|(?P<jwk>cWQyc2lPb)|(?P<iss>cGMzTWlPaU)|(?P<iv>cGRpSTZJ)|(?P<kid>cmFXUWlP)|(?P<key_ops>clpYbGZiM0J6SWpwY)|(?P<kty>cmRIa2lPaUp)|(?P<nonce>dWIyNWpaU0k2)|(?P<p2c>d01tTWlP)|(?P<p2s>d01uTWlPaU)|(?P<ppt>d2NIUWlPaU)|(?P<sub>emRXSWlPaU)|(?P<svt>emRuUWlP)|(?P<tag>MFlXY2lPaU)|(?P<typ>MGVYQWlPaUp)|(?P<url>MWNtd2l)|(?P<use>MWMyVWlPaUp)|(?P<ver>MlpYSWlPaU)|(?P<version>MlpYSnphVzl1SWpv)|(?P<x>NElqb2)|(?P<x5c>NE5XTWlP)|(?P<x5t>NE5YUWlPaU)|(?P<x5ts256>NE5YUWpVekkxTmlJNkl)|(?P<x5u>NE5YVWlPaU)|(?P<zip>NmFYQWlPaU))[a-zA-Z0-9\\/\\\\_+\\-\\r\\n]{40,}={0,2}",
+    "entropy": 2,
+    "keywords": ["zxlk"]
+  },
+  {
+    "id": "kraken-access-token",
+    "description": "Identified a Kraken Access Token, potentially compromising cryptocurrency trading accounts and financial security.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:kraken)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9\\/=_\\+\\-]{80,90})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["kraken"]
+  },
+  {
+    "id": "kubernetes-secret-yaml",
+    "description": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments",
+    "regex": "(?i)(?:\\bkind:[ \\t]*[\"']?\\bsecret\\b[\"']?(?s:.){0,200}?\\bdata:(?s:.){0,100}?\\s+([\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:[\"']?[a-z0-9+/]{10,}={0,3}[\"']?|\\{\\{[ \\t\\w\"|$:=,.-]+}}|\"\"|''))|\\bdata:(?s:.){0,100}?\\s+([\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:[\"']?[a-z0-9+/]{10,}={0,3}[\"']?|\\{\\{[ \\t\\w\"|$:=,.-]+}}|\"\"|''))(?s:.){0,200}?\\bkind:[ \\t]*[\"']?\\bsecret\\b[\"']?)",
+    "path": "(?i)\\.ya?ml$",
+    "keywords": ["secret"],
+    "allowlists": [
+      {
+        "regexes": [
+          "[\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:\\{\\{[ \\t\\w\"|$:=,.-]+}}|\"\"|'')"
+        ]
+      },
+      {
+        "regexTarget": "match",
+        "regexes": [
+          "(kind:(?s:.)+\\n---\\n(?s:.)+\\bdata:|data:(?s:.)+\\n---\\n(?s:.)+\\bkind:)"
+        ]
+      }
+    ]
+  }
+]

package/src/vendor/gitleaks/rules-3.json

@@ -0,0 +1,263 @@
+[
+  {
+    "id": "kucoin-access-token",
+    "description": "Found a Kucoin Access Token, risking unauthorized access to cryptocurrency exchange services and transactions.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["kucoin"]
+  },
+  {
+    "id": "kucoin-secret-key",
+    "description": "Discovered a Kucoin Secret Key, which could lead to compromised cryptocurrency operations and financial data breaches.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["kucoin"]
+  },
+  {
+    "id": "launchdarkly-access-token",
+    "description": "Uncovered a Launchdarkly Access Token, potentially compromising feature flag management and application functionality.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:launchdarkly)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["launchdarkly"]
+  },
+  {
+    "id": "linear-api-key",
+    "description": "Detected a Linear API Token, posing a risk to project management tools and sensitive task data.",
+    "regex": "lin_api_(?i)[a-z0-9]{40}",
+    "entropy": 2,
+    "keywords": ["lin_api_"]
+  },
+  {
+    "id": "linear-client-secret",
+    "description": "Identified a Linear Client Secret, which may compromise secure integrations and sensitive project management data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:linear)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["linear"]
+  },
+  {
+    "id": "linkedin-client-id",
+    "description": "Found a LinkedIn Client ID, risking unauthorized access to LinkedIn integrations and professional data exposure.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{14})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["linkedin", "linked_in", "linked-in"]
+  },
+  {
+    "id": "linkedin-client-secret",
+    "description": "Discovered a LinkedIn Client secret, potentially compromising LinkedIn application integrations and user data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["linkedin", "linked_in", "linked-in"]
+  },
+  {
+    "id": "lob-api-key",
+    "description": "Uncovered a Lob API Key, which could lead to unauthorized access to mailing and address verification services.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((live|test)_[a-f0-9]{35})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["test_", "live_"]
+  },
+  {
+    "id": "lob-pub-api-key",
+    "description": "Detected a Lob Publishable API Key, posing a risk of exposing mail and print service integrations.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((test|live)_pub_[a-f0-9]{31})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["test_pub", "live_pub", "_pub"]
+  },
+  {
+    "id": "looker-client-id",
+    "description": "Found a Looker Client ID, risking unauthorized access to a Looker account and exposing sensitive data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["looker"]
+  },
+  {
+    "id": "looker-client-secret",
+    "description": "Found a Looker Client Secret, risking unauthorized access to a Looker account and exposing sensitive data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["looker"]
+  },
+  {
+    "id": "mailchimp-api-key",
+    "description": "Identified a Mailchimp API key, potentially compromising email marketing campaigns and subscriber data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:MailchimpSDK.initialize|mailchimp)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32}-us\\d\\d)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mailchimp"]
+  },
+  {
+    "id": "mailgun-private-api-token",
+    "description": "Found a Mailgun private API token, risking unauthorized email service operations and data breaches.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(key-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mailgun"]
+  },
+  {
+    "id": "mailgun-pub-key",
+    "description": "Discovered a Mailgun public validation key, which could expose email verification processes and associated data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pubkey-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mailgun"]
+  },
+  {
+    "id": "mailgun-signing-key",
+    "description": "Uncovered a Mailgun webhook signing key, potentially compromising email automation and data integrity.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mailgun"]
+  },
+  {
+    "id": "mapbox-api-token",
+    "description": "Detected a MapBox API token, posing a risk to geospatial services and sensitive location data exposure.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:mapbox)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pk\\.[a-z0-9]{60}\\.[a-z0-9]{22})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mapbox"]
+  },
+  {
+    "id": "mattermost-access-token",
+    "description": "Identified a Mattermost Access Token, which may compromise team communication channels and data privacy.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:mattermost)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["mattermost"]
+  },
+  {
+    "id": "maxmind-license-key",
+    "description": "Discovered a potential MaxMind license key.",
+    "regex": "\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 4,
+    "keywords": ["_mmk"]
+  },
+  {
+    "id": "messagebird-api-token",
+    "description": "Found a MessageBird API token, risking unauthorized access to communication platforms and message data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["messagebird", "message-bird", "message_bird"]
+  },
+  {
+    "id": "messagebird-client-id",
+    "description": "Discovered a MessageBird client ID, potentially compromising API integrations and sensitive communication data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["messagebird", "message-bird", "message_bird"]
+  },
+  {
+    "id": "microsoft-teams-webhook",
+    "description": "Uncovered a Microsoft Teams Webhook, which could lead to unauthorized access to team collaboration tools and data leaks.",
+    "regex": "https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}",
+    "keywords": ["webhook.office.com", "webhookb2", "incomingwebhook"]
+  },
+  {
+    "id": "netlify-access-token",
+    "description": "Detected a Netlify Access Token, potentially compromising web hosting services and site management.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:netlify)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40,46})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["netlify"]
+  },
+  {
+    "id": "new-relic-browser-api-token",
+    "description": "Identified a New Relic ingest browser API token, risking unauthorized access to application performance data and analytics.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRJS-[a-f0-9]{19})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["nrjs-"]
+  },
+  {
+    "id": "new-relic-insert-key",
+    "description": "Discovered a New Relic insight insert key, compromising data injection into the platform.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRII-[a-z0-9-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["nrii-"]
+  },
+  {
+    "id": "new-relic-user-api-id",
+    "description": "Found a New Relic user API ID, posing a risk to application monitoring services and data integrity.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["new-relic", "newrelic", "new_relic"]
+  },
+  {
+    "id": "new-relic-user-api-key",
+    "description": "Discovered a New Relic user API Key, which could lead to compromised application insights and performance monitoring.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRAK-[a-z0-9]{27})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["nrak"]
+  },
+  {
+    "id": "notion-api-token",
+    "description": "Notion API token",
+    "regex": "\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 4,
+    "keywords": ["ntn_"]
+  },
+  {
+    "id": "npm-access-token",
+    "description": "Uncovered an npm access token, potentially compromising package management and code repository access.",
+    "regex": "(?i)\\b(npm_[a-z0-9]{36})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 2,
+    "keywords": ["npm_"]
+  },
+  {
+    "id": "nuget-config-password",
+    "description": "Identified a password within a Nuget config file, potentially compromising package management access.",
+    "regex": "(?i)<add key=\\\"(?:(?:ClearText)?Password)\\\"\\s*value=\\\"(.{8,})\\\"\\s*/>",
+    "path": "(?i)nuget\\.config$",
+    "entropy": 1,
+    "keywords": ["<add key="],
+    "allowlists": [
+      {
+        "regexes": ["33f!!lloppa", "hal\\+9ooo_da!sY", "^\\%\\S.*\\%$"]
+      }
+    ]
+  },
+  {
+    "id": "nytimes-access-token",
+    "description": "Detected a Nytimes Access Token, risking unauthorized access to New York Times APIs and content services.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:nytimes|new-york-times,|newyorktimes)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["nytimes", "new-york-times", "newyorktimes"]
+  },
+  {
+    "id": "octopus-deploy-api-key",
+    "description": "Discovered a potential Octopus Deploy API key, risking application deployments and operational security.",
+    "regex": "\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["api-"]
+  },
+  {
+    "id": "okta-access-token",
+    "description": "Identified an Okta Access Token, which may compromise identity management services and user authentication data.",
+    "regex": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:(?-i:[Oo]kta|OKTA))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(00[\\w=\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 4,
+    "keywords": ["okta"]
+  },
+  {
+    "id": "openai-api-key",
+    "description": "Found an OpenAI API Key, posing a risk of unauthorized access to AI services and data manipulation.",
+    "regex": "\\b(sk-(?:proj|svcacct|admin)-(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})T3BlbkFJ(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})\\b|sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["t3blbkfj"]
+  },
+  {
+    "id": "openshift-user-token",
+    "description": "Found an OpenShift user token, potentially compromising an OpenShift/Kubernetes cluster.",
+    "regex": "\\b(sha256~[\\w-]{43})(?:[^\\w-]|\\z)",
+    "entropy": 3.5,
+    "keywords": ["sha256~"]
+  },
+  {
+    "id": "perplexity-api-key",
+    "description": "Detected a Perplexity API key, which could lead to unauthorized access to Perplexity AI services and data exposure.",
+    "regex": "\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$|\\b)",
+    "entropy": 4,
+    "keywords": ["pplx-"]
+  },
+  {
+    "id": "pkcs12-file",
+    "description": "Found a PKCS #12 file, which commonly contain bundled private keys.",
+    "path": "(?i)(?:^|\\/)[^\\/]+\\.p(?:12|fx)$"
+  },
+  {
+    "id": "plaid-api-token",
+    "description": "Discovered a Plaid API Token, potentially compromising financial data aggregation and banking services.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "keywords": ["plaid"]
+  },
+  {
+    "id": "plaid-client-id",
+    "description": "Uncovered a Plaid Client ID, which could lead to unauthorized financial service integrations and data breaches.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3.5,
+    "keywords": ["plaid"]
+  },
+  {
+    "id": "plaid-secret-key",
+    "description": "Detected a Plaid Secret key, risking unauthorized access to financial accounts and sensitive transaction data.",
+    "regex": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3.5,
+    "keywords": ["plaid"]
+  },
+  {
+    "id": "planetscale-api-token",
+    "description": "Identified a PlanetScale API token, potentially compromising database management and operations.",
+    "regex": "\\b(pscale_tkn_(?i)[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
+    "entropy": 3,
+    "keywords": ["pscale_tkn_"]
+  }
+]