codeant-cli 0.4.5 → 0.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/rules/secrets.toml +5 -0
package/package.json
CHANGED
package/src/rules/secrets.toml
CHANGED
|
@@ -1173,6 +1173,11 @@ id = "generic-api-key"
|
|
|
1173
1173
|
description = "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."
|
|
1174
1174
|
regex = '''(?i)[\w.-]{0,50}?(?:access|auth|(?-i:[Aa]pi|API)|credential|creds|key|passw(?:or)?d|secret|token)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([\w.=-]{10,150}|[a-z0-9][a-z0-9+/]{11,}={0,3})(?:\\?['"\x60]|[\s;]|\\[nr]|$)'''
|
|
1175
1175
|
entropy = 3.5
|
|
1176
|
+
# secretGroup = 1: the regex captures the actual secret value in group 1.
|
|
1177
|
+
# Without this, the full match (including variable names, commas, spaces) is
|
|
1178
|
+
# treated as the "secret", causing allowlist checks like ^[a-zA-Z_.-]+$ to fail
|
|
1179
|
+
# on import/destructuring lines (e.g. "from config import STRIPE_API_KEY, SECRET").
|
|
1180
|
+
secretGroup = 1
|
|
1176
1181
|
keywords = [
|
|
1177
1182
|
"access",
|
|
1178
1183
|
"api",
|