credsweeper 1.11.2__py3-none-any.whl → 1.11.3__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of credsweeper might be problematic. Click here for more details.

Files changed (55) hide show
  1. credsweeper/__init__.py +1 -1
  2. credsweeper/__main__.py +6 -4
  3. credsweeper/app.py +7 -3
  4. credsweeper/common/keyword_pattern.py +15 -9
  5. credsweeper/common/morpheme_checklist.txt +4 -2
  6. credsweeper/credentials/line_data.py +14 -10
  7. credsweeper/deep_scanner/abstract_scanner.py +10 -1
  8. credsweeper/deep_scanner/deep_scanner.py +19 -8
  9. credsweeper/deep_scanner/docx_scanner.py +1 -1
  10. credsweeper/deep_scanner/encoder_scanner.py +2 -2
  11. credsweeper/deep_scanner/html_scanner.py +3 -3
  12. credsweeper/deep_scanner/jks_scanner.py +2 -4
  13. credsweeper/deep_scanner/lang_scanner.py +2 -2
  14. credsweeper/deep_scanner/lzma_scanner.py +40 -0
  15. credsweeper/deep_scanner/pkcs12_scanner.py +3 -5
  16. credsweeper/deep_scanner/xml_scanner.py +2 -2
  17. credsweeper/file_handler/data_content_provider.py +21 -12
  18. credsweeper/filters/value_array_dictionary_check.py +3 -1
  19. credsweeper/filters/value_azure_token_check.py +1 -2
  20. credsweeper/filters/value_base64_part_check.py +30 -21
  21. credsweeper/filters/value_discord_bot_check.py +1 -2
  22. credsweeper/filters/value_entropy_base32_check.py +11 -31
  23. credsweeper/filters/value_entropy_base36_check.py +11 -34
  24. credsweeper/filters/value_entropy_base64_check.py +19 -48
  25. credsweeper/filters/value_entropy_base_check.py +37 -0
  26. credsweeper/filters/value_file_path_check.py +1 -1
  27. credsweeper/filters/value_hex_number_check.py +3 -3
  28. credsweeper/filters/value_json_web_token_check.py +4 -5
  29. credsweeper/filters/value_string_type_check.py +11 -3
  30. credsweeper/filters/value_token_base32_check.py +0 -4
  31. credsweeper/filters/value_token_base36_check.py +0 -4
  32. credsweeper/filters/value_token_base64_check.py +0 -4
  33. credsweeper/filters/value_token_check.py +1 -1
  34. credsweeper/ml_model/features/file_extension.py +1 -1
  35. credsweeper/ml_model/features/morpheme_dense.py +0 -4
  36. credsweeper/ml_model/features/rule_name.py +1 -1
  37. credsweeper/ml_model/features/word_in_path.py +0 -9
  38. credsweeper/ml_model/features/word_in_postamble.py +0 -11
  39. credsweeper/ml_model/features/word_in_preamble.py +0 -11
  40. credsweeper/ml_model/features/word_in_transition.py +0 -11
  41. credsweeper/ml_model/features/word_in_value.py +0 -11
  42. credsweeper/ml_model/features/word_in_variable.py +0 -11
  43. credsweeper/ml_model/ml_validator.py +4 -3
  44. credsweeper/rules/config.yaml +238 -208
  45. credsweeper/scanner/scan_type/scan_type.py +2 -3
  46. credsweeper/scanner/scanner.py +7 -1
  47. credsweeper/secret/config.json +16 -5
  48. credsweeper/utils/pem_key_detector.py +4 -5
  49. credsweeper/utils/util.py +67 -144
  50. {credsweeper-1.11.2.dist-info → credsweeper-1.11.3.dist-info}/METADATA +1 -1
  51. {credsweeper-1.11.2.dist-info → credsweeper-1.11.3.dist-info}/RECORD +54 -53
  52. credsweeper/utils/entropy_validator.py +0 -72
  53. {credsweeper-1.11.2.dist-info → credsweeper-1.11.3.dist-info}/WHEEL +0 -0
  54. {credsweeper-1.11.2.dist-info → credsweeper-1.11.3.dist-info}/entry_points.txt +0 -0
  55. {credsweeper-1.11.2.dist-info → credsweeper-1.11.3.dist-info}/licenses/LICENSE +0 -0
credsweeper/rules/config.yaml CHANGED
@@ -1,9 +1,40 @@
1
+ - name: DOC_GET
2
+ severity: medium
3
+ confidence: weak
4
+ type: pattern
5
+ values:
6
+ - (?P<variable>(\w*(?i:비밀번호|비번|패스워드|키|암호화?|토큰|(?<!by)pass(?!ed|ing|es|age)|\bpwd?\b|token|secret|key|cred)\w*)\s*(설정은|[=:!]{1,3}))?\s*([._0-9A-Za-z\[\]]*get(env)?\s*\(\s*(?(variable)[^,]+)|[\"'\\]*(\\*(['\"]|&(quot|apos);)){0,4}(\w*(?i:(?<!by)pass(?!ed|ing|es|age|\s+[a-z]{3,80})|\bpwd?\b|token|secret|key|cred)\w*)(\\*(['\"]|&(quot|apos);)){0,4})\s*,\s*(default\s*=\s*)?([brufl@]{1,2}(?=\\*['\"&]))?(?P<lq>(\\*(['\"]|&(quot|apos);)){1,4})(?P<value>(.(?!(?P=lq))){4,80}.?)
7
+ filter_type:
8
+ - ValueAllowlistCheck
9
+ - LineGitBinaryCheck
10
+ - LineUUEPartCheck
11
+ - ValueFilePathCheck
12
+ - ValuePatternCheck(5)
13
+ - ValueDictionaryValueLengthCheck(4,80)
14
+ min_line_len: 8
15
+ required_substrings:
16
+ - pass
17
+ - pw
18
+ - token
19
+ - secret
20
+ - key
21
+ - cred
22
+ - 비밀번호
23
+ - 비번
24
+ - 패스워드
25
+ - 암호
26
+ - 키
27
+ - 토큰
28
+ target:
29
+ - doc
30
+ use_ml: true
31
+
1
32
  - name: DOC_CREDENTIALS
2
33
  severity: medium
3
34
  confidence: weak
4
35
  type: pattern
5
36
  values:
6
- - (?P<wrap>[`'\"(])?\s*(?P<variable>(\w*(?i:passw?o?r?d?s?|pwd?\b|\bp/w\b|token|secret|key)\w*|비밀번호|비번|패스워드|암호|키|암호|암호화|토큰))[`'\"]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(설정은|[=:]{1,3})\s*)(?P<quote>[`'\"]{1,6})?(?P<value>(?(quote)(?(wrap)[^`'\")]{4,80}|[^`'\"]{4,80})|(?(wrap)[^`'\")]{4,80}|\S{4,80})))
37
+ - (?P<wrap>[`'\"(])?\s*(?P<variable>(\w*(?i:(?<!by)passw?o?r?d?s?(?!ed|ing|es|age)|pwd?\b|\bp/w\b|token|secret|key|credential)\w*|비밀번호|비번|패스워드|키|암호화?|토큰))[`'\"]*(\s+(?i:is|are|was|were)(\s*[:-])?\s+|\s*(설정은|[=:!]{1,3})\s*)(?P<quote>[`'\"]{1,6})?(?P<value>(?(quote)(?(wrap)[^`'\")]{4,80}|[^`'\"]{4,80})|(?(wrap)[^`'\")]{4,80}|\S{4,80})))
7
38
  filter_type:
8
39
  - ValueAllowlistCheck
9
40
  - LineGitBinaryCheck
@@ -25,8 +56,8 @@
25
56
  - token
26
57
  - secret
27
58
  - key
59
+ - credential
28
60
  - 키
29
- - 암호화
30
61
  - 토큰
31
62
  target:
32
63
  - doc
@@ -37,7 +68,7 @@
37
68
  confidence: moderate
38
69
  type: pattern
39
70
  values:
40
- - (?P<variable>[`'\"]?(?i:token|secret|key|키|암호|암호화|토큰)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
71
+ - (?P<variable>[`'\"]?(?i:token|secret|key|키|암호화?|토큰)[`'\"]?)((\s)*[=:](\s)*)(?P<quote>[`'\"(])?(?P<value>(?-i:(?P<a>[A-Z])|(?P<b>[a-z])|(?P<c>[0-9/_+=~!@#$%^&*;:?-])){8,80}(?(a)(?(b)(?(c)(\S|$)|(?!x)x)|(?!x)x)|(?!x)x))(?(quote)[)`'\"])
41
72
  filter_type:
42
73
  - ValueAllowlistCheck
43
74
  - ValuePatternCheck
@@ -50,7 +81,6 @@
50
81
  - key
51
82
  - 키
52
83
  - 암호
53
- - 암호화
54
84
  - 토큰
55
85
  target:
56
86
  - doc
@@ -162,26 +192,12 @@
162
192
  - code
163
193
  use_ml: true
164
194
 
165
- - name: API
166
- severity: medium
167
- confidence: moderate
168
- type: keyword
169
- values:
170
- - api(?!tal)
171
- filter_type: GeneralKeyword
172
- use_ml: true
173
- min_line_len: 11
174
- required_substrings:
175
- - api
176
- target:
177
- - code
178
-
179
195
  - name: UUID
180
196
  severity: info
181
197
  confidence: strong
182
198
  type: pattern
183
199
  values:
184
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12})(?![0-9A-Za-z_+-])
200
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Fa-f]{8}(-[0-9A-Fa-f]{4}){3}-[0-9A-Fa-f]{12})(?![0-9A-Za-z_+-])
185
201
  min_line_len: 36
186
202
  required_substrings:
187
203
  - "-"
@@ -198,7 +214,7 @@
198
214
  confidence: moderate
199
215
  type: pattern
200
216
  values:
201
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
217
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
202
218
  filter_type: GeneralPattern
203
219
  required_substrings:
204
220
  - A
@@ -213,11 +229,12 @@
213
229
  confidence: moderate
214
230
  type: multi
215
231
  values:
216
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
217
- - (?:(?<![0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z/+]{35,80})
232
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(ABIA|ACCA|AGPA|AIDA|AIPA|AKIA|ANPA|ANVA|AROA|APKA|ASCA|ASIA)[0-9A-Z]{16,17})(?![0-9A-Za-z_+-])
233
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z/+]{35,80})
218
234
  filter_type:
219
235
  - LineSpecificKeyCheck
220
236
  - ValuePatternCheck
237
+ - ValueBase64PartCheck
221
238
  - ValueCoupleKeywordCheck(3)
222
239
  required_substrings:
223
240
  - A
@@ -232,35 +249,21 @@
232
249
  confidence: strong
233
250
  type: pattern
234
251
  values:
235
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
252
+ - (?P<value>amzn\.mws\.[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})(?![0-9A-Za-z_-])
236
253
  filter_type: GeneralPattern
237
254
  required_substrings:
238
- - amzn
255
+ - amzn.mws.
239
256
  min_line_len: 30
240
257
  target:
241
258
  - code
242
259
  - doc
243
260
 
244
- - name: Credential
245
- severity: medium
246
- confidence: moderate
247
- type: keyword
248
- values:
249
- - credential
250
- filter_type: GeneralKeyword
251
- use_ml: true
252
- min_line_len: 18
253
- required_substrings:
254
- - credential
255
- target:
256
- - code
257
-
258
261
  - name: Dynatrace API Token
259
262
  severity: high
260
263
  confidence: moderate
261
264
  type: pattern
262
265
  values:
263
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
266
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>dt0[A-Za-z]{1}[0-9]{2}\.[0-9A-Z]{24}\.[0-9A-Z]{64})(?![0-9A-Za-z_-])
264
267
  filter_type: GeneralPattern
265
268
  required_substrings:
266
269
  - dt0
@@ -274,7 +277,7 @@
274
277
  confidence: moderate
275
278
  type: pattern
276
279
  values:
277
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
280
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAA[0-9A-Za-z]{80,800})
278
281
  filter_type:
279
282
  - ValuePatternCheck
280
283
  - ValueBase64PartCheck
@@ -290,7 +293,7 @@
290
293
  confidence: moderate
291
294
  type: pattern
292
295
  values:
293
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
296
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{12,18}\|[0-9A-Za-z_-]{24,28})(?![0-9A-Za-z_+-])
294
297
  filter_type: GeneralPattern
295
298
  required_substrings:
296
299
  - "|"
@@ -320,7 +323,7 @@
320
323
  confidence: moderate
321
324
  type: pattern
322
325
  values:
323
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
326
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>AIza[0-9A-Za-z_-]{35})
324
327
  filter_type: GeneralPattern
325
328
  required_substrings:
326
329
  - AIza
@@ -349,7 +352,7 @@
349
352
  confidence: strong
350
353
  type: pattern
351
354
  values:
352
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
355
+ - (?P<value>GOCSPX-[0-9A-Za-z_-]{28})(?![0-9A-Za-z_-])
353
356
  filter_type: GeneralPattern
354
357
  required_substrings:
355
358
  - GOCSPX-
@@ -363,7 +366,7 @@
363
366
  confidence: moderate
364
367
  type: pattern
365
368
  values:
366
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
369
+ - (?P<value>ya29\.[0-9A-Za-z_-]{22,8000})
367
370
  filter_type: GeneralPattern
368
371
  required_substrings:
369
372
  - ya29.
@@ -391,7 +394,7 @@
391
394
  confidence: strong
392
395
  type: pattern
393
396
  values:
394
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
397
+ - (?P<value>IGQVJ[=0-9A-Za-z_-]{100,8000})(?![=0-9A-Za-z_-])
395
398
  filter_type: GeneralPattern
396
399
  required_substrings:
397
400
  - IGQVJ
@@ -405,7 +408,7 @@
405
408
  confidence: strong
406
409
  type: pattern
407
410
  values:
408
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
411
+ - (?P<value>eyJ[=0-9A-Za-z_+/-]{15,8000}(\.[=0-9A-Za-z_+/-]{0,8000}){2,16})(?![=0-9A-Za-z_-])
409
412
  filter_type:
410
413
  - ValueJsonWebTokenCheck
411
414
  required_substrings:
@@ -420,7 +423,7 @@
420
423
  confidence: moderate
421
424
  type: pattern
422
425
  values:
423
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
426
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{32}-us[0-9]{1,2})(?![0-9A-Za-z_-])
424
427
  filter_type: GeneralPattern
425
428
  required_substrings:
426
429
  - -us
@@ -434,7 +437,7 @@
434
437
  confidence: moderate
435
438
  type: pattern
436
439
  values:
437
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9A-Za-z_-]{32})(?![0-9A-Za-z_-])
440
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>key-[0-9A-Za-z_-]{32})(?![0-9A-Za-z_-])
438
441
  filter_type: GeneralPattern
439
442
  required_substrings:
440
443
  - key-
@@ -443,21 +446,6 @@
443
446
  - code
444
447
  - doc
445
448
 
446
- - name: Password
447
- severity: medium
448
- confidence: moderate
449
- type: keyword
450
- values:
451
- - (?<!by)pass(?!ed|ing|es|age|\s+[a-z]{3,80})|pw(d|\b)
452
- filter_type: PasswordKeyword
453
- use_ml: true
454
- min_line_len: 10
455
- required_substrings:
456
- - pass
457
- - pw
458
- target:
459
- - code
460
-
461
449
  - name: PayPal Braintree Access Token
462
450
  severity: high
463
451
  confidence: strong
@@ -505,7 +493,7 @@
505
493
  confidence: strong
506
494
  type: pattern
507
495
  values:
508
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
496
+ - (?P<value>MII[A-Za-f][0-9A-Za-z/+]{8}(?s:[^!#$&()*\-.:;<=>?@\[\]^_{|}~]{8,8000}))
509
497
  filter_type:
510
498
  - ValueBase64KeyCheck
511
499
  min_line_len: 160
@@ -529,26 +517,12 @@
529
517
  - code
530
518
  - doc
531
519
 
532
- - name: Secret
533
- severity: medium
534
- confidence: moderate
535
- type: keyword
536
- values:
537
- - secret
538
- filter_type: GeneralKeyword
539
- use_ml: true
540
- min_line_len: 14
541
- required_substrings:
542
- - secret
543
- target:
544
- - code
545
-
546
520
  - name: SendGrid API Key
547
521
  severity: high
548
522
  confidence: moderate
549
523
  type: pattern
550
524
  values:
551
- - (?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
525
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>SG\.[0-9A-Za-z_-]{16,32}\.[0-9A-Za-z_-]{16,64})
552
526
  filter_type: GeneralPattern
553
527
  required_substrings:
554
528
  - SG.
@@ -576,7 +550,7 @@
576
550
  confidence: strong
577
551
  type: pattern
578
552
  values:
579
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>xox[a-z]\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
553
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>xox[a-z]\-[0-9A-Za-z-]{10,250})(?![0-9A-Za-z_-])
580
554
  filter_type: GeneralPattern
581
555
  required_substrings:
582
556
  - xox
@@ -620,7 +594,7 @@
620
594
  confidence: moderate
621
595
  type: pattern
622
596
  values:
623
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
597
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>EAAA[0-9A-Za-z_-]{60})(?![0-9A-Za-z_-])
624
598
  filter_type:
625
599
  - ValuePatternCheck
626
600
  - ValueBase64PartCheck
@@ -636,7 +610,7 @@
636
610
  confidence: strong
637
611
  type: pattern
638
612
  values:
639
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
613
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sq0[a-z]{3}-[0-9A-Za-z_-]{22}([0-9A-Za-z_-]{21})?)(?![0-9A-Za-z_-])
640
614
  filter_type: GeneralPattern
641
615
  required_substrings:
642
616
  - sq0
@@ -645,26 +619,12 @@
645
619
  - code
646
620
  - doc
647
621
 
648
- - name: Token
649
- severity: medium
650
- confidence: moderate
651
- type: keyword
652
- values:
653
- - token(?!ize)
654
- filter_type: GeneralKeyword
655
- use_ml: true
656
- min_line_len: 13
657
- required_substrings:
658
- - token
659
- target:
660
- - code
661
-
662
622
  - name: Twilio Credentials
663
623
  severity: high
664
624
  confidence: moderate
665
625
  type: pattern
666
626
  values:
667
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
627
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>(AC|AD|AL|CA|CF|CL|CN|CR|FW|IP|KS|MM|NO|PK|PN|QU|RE|SC|SD|SK|SM|TR|UT|XE|XR)[0-9A-Fa-f]{32})(?![0-9A-Za-z_+-])
668
628
  filter_type: TokenPattern
669
629
  required_substrings:
670
630
  - AC
@@ -716,7 +676,7 @@
716
676
  confidence: moderate
717
677
  type: pattern
718
678
  values:
719
- - (^|\W|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
679
+ - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:pass(in|out|word|phrase)))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,80})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
720
680
  filter_type: GeneralKeyword
721
681
  use_ml: true
722
682
  required_substrings:
@@ -730,7 +690,7 @@
730
690
  confidence: moderate
731
691
  type: pattern
732
692
  values:
733
- - (^|\W|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
693
+ - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:token))\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
734
694
  filter_type: GeneralKeyword
735
695
  use_ml: true
736
696
  required_substrings:
@@ -744,7 +704,7 @@
744
704
  confidence: moderate
745
705
  type: pattern
746
706
  values:
747
- - (^|\W|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
707
+ - (^|\W|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<variable>-[A-Za-z_-]*(?i:secret)[A-Za-z_-]*)\s\s*(?!-)(?P<value_leftquote>(\\?[\"']){1,3})?(pass:)?(?!file:|env:|fd:)(?P<value>(?(value_leftquote)[^\"'\\]|[^\s\"'\\]){4,4000})(?(value_leftquote)(?P<value_rightquote>(\\?[\"']){1,3}))
748
708
  filter_type: GeneralKeyword
749
709
  use_ml: true
750
710
  required_substrings:
@@ -767,40 +727,12 @@
767
727
  target:
768
728
  - code
769
729
 
770
- - name: Auth
771
- severity: medium
772
- confidence: moderate
773
- type: keyword
774
- values:
775
- - auth(?!ors?(?!i[tz]))
776
- filter_type: GeneralKeyword
777
- use_ml: true
778
- min_line_len: 12
779
- required_substrings:
780
- - auth
781
- target:
782
- - code
783
-
784
- - name: Key
785
- severity: medium
786
- confidence: moderate
787
- type: keyword
788
- values:
789
- - key(?!word|board|pad|name)
790
- filter_type: GeneralKeyword
791
- use_ml: true
792
- min_line_len: 11
793
- required_substrings:
794
- - key
795
- target:
796
- - code
797
-
798
730
  - name: Telegram Bot API Token
799
731
  severity: high
800
732
  confidence: moderate
801
733
  type: pattern
802
734
  values:
803
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
735
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9]{8,10}:[0-9A-Za-z_-]{35})(?![0-9A-Za-z_-])
804
736
  filter_type: GeneralPattern
805
737
  required_substrings:
806
738
  - :AA
@@ -814,7 +746,7 @@
814
746
  confidence: strong
815
747
  type: pattern
816
748
  values:
817
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>pypi-[0-9A-Za-z_-]{150,255})
749
+ - (?P<value>pypi-[0-9A-Za-z_-]{150,255})
818
750
  filter_type: GeneralPattern
819
751
  required_substrings:
820
752
  - pypi-
@@ -828,7 +760,7 @@
828
760
  confidence: strong
829
761
  type: pattern
830
762
  values:
831
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
763
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gh[pousr]_[0-9A-Za-z_-]{36,255})
832
764
  filter_type:
833
765
  - ValueGitHubCheck
834
766
  required_substrings:
@@ -847,7 +779,7 @@
847
779
  confidence: strong
848
780
  type: pattern
849
781
  values:
850
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>github_pat_[0-9A-Za-z_]{80,255})
782
+ - (?P<value>github_pat_[0-9A-Za-z_]{80,255})
851
783
  filter_type: GeneralPattern
852
784
  required_substrings:
853
785
  - github_pat_
@@ -861,7 +793,7 @@
861
793
  confidence: moderate
862
794
  type: pattern
863
795
  values:
864
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
796
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{1,80}\.firebaseio\.com|[a-z0-9.-]{1,80}\.firebaseapp\.com)
865
797
  filter_type: GeneralPattern
866
798
  required_substrings:
867
799
  - .firebase
@@ -875,7 +807,7 @@
875
807
  confidence: moderate
876
808
  type: pattern
877
809
  values:
878
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
810
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9.-]{3,63}\.s3\.amazonaws\.com|[a-z0-9.-]{3,63}\.s3-website[.-](eu|ap|us|ca|sa|cn))
879
811
  filter_type: GeneralPattern
880
812
  required_substrings:
881
813
  - .s3-website
@@ -885,54 +817,12 @@
885
817
  - code
886
818
  - doc
887
819
 
888
- - name: Nonce
889
- severity: medium
890
- confidence: moderate
891
- type: keyword
892
- values:
893
- - (?<!\\)nonce
894
- filter_type: GeneralKeyword
895
- use_ml: true
896
- min_line_len: 13
897
- required_substrings:
898
- - nonce
899
- target:
900
- - code
901
-
902
- - name: Salt
903
- severity: medium
904
- confidence: moderate
905
- type: keyword
906
- values:
907
- - salt
908
- filter_type: GeneralKeyword
909
- use_ml: true
910
- min_line_len: 12
911
- required_substrings:
912
- - salt
913
- target:
914
- - code
915
-
916
- - name: Certificate
917
- severity: medium
918
- confidence: moderate
919
- type: keyword
920
- values:
921
- - cert
922
- filter_type: GeneralKeyword
923
- use_ml: true
924
- min_line_len: 12
925
- required_substrings:
926
- - cert
927
- target:
928
- - code
929
-
930
820
  - name: Jfrog Token
931
821
  severity: high
932
822
  confidence: strong
933
823
  type: pattern
934
824
  values:
935
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
825
+ - (?P<value>(cmVmdGtuO[0-9A-Za-z_-]{55}|AKCp[0-9A-Za-z_-]{69}))(?![0-9A-Za-z_-])
936
826
  filter_type:
937
827
  - ValueJfrogTokenCheck
938
828
  required_substrings:
@@ -948,7 +838,7 @@
948
838
  confidence: strong
949
839
  type: pattern
950
840
  values:
951
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
841
+ - (?P<value>eyJ[=0-9A-Za-z_-]{50,500}\.eyJ[=0-9A-Za-z_-]{8,8000}\.[=0-9A-Za-z_-]{18,800})
952
842
  filter_type:
953
843
  - ValueAzureTokenCheck
954
844
  required_substrings:
@@ -963,7 +853,7 @@
963
853
  confidence: moderate
964
854
  type: pattern
965
855
  values:
966
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
856
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_~.-]{3}8Q~[0-9A-Za-z_~.-]{34})(?![0-9A-Za-z_-])
967
857
  filter_type: TokenPattern
968
858
  min_line_len: 40
969
859
  required_substrings:
@@ -977,7 +867,7 @@
977
867
  confidence: moderate
978
868
  type: pattern
979
869
  values:
980
- - (?:(?<![0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
870
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{52}JQQJ9[9DH][0-9A-Za-z]{26}([0-9A-Za-z=]{4})?)(?![0-9A-Za-z_/+-])
981
871
  min_line_len: 80
982
872
  filter_type:
983
873
  - ValuePatternCheck(17)
@@ -994,7 +884,7 @@
994
884
  confidence: strong
995
885
  type: pattern
996
886
  values:
997
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
887
+ - (?P<value>ATBB[0-9A-Za-z]{24}[A-F0-9]{8})(?![0-9A-Za-z_])
998
888
  filter_type:
999
889
  - ValueAtlassianTokenCheck
1000
890
  min_line_len: 28
@@ -1039,7 +929,7 @@
1039
929
  confidence: weak
1040
930
  type: pattern
1041
931
  values:
1042
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{18}([0-9A-Za-z]{14})?)(?![=0-9A-Za-z_+-])
932
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{18}([0-9A-Za-z]{14})?)(?![=0-9A-Za-z_+-])
1043
933
  filter_type: WeirdBase64Token
1044
934
  min_line_len: 18
1045
935
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1052,7 +942,7 @@
1052
942
  confidence: weak
1053
943
  type: pattern
1054
944
  values:
1055
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>([0-9A-Za-z_-]{32}){1,2})(?![=0-9A-Za-z_+-])
945
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>([0-9A-Za-z_-]{32}){1,2})(?![=0-9A-Za-z_+-])
1056
946
  filter_type: WeirdBase64Token
1057
947
  min_line_len: 32
1058
948
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1065,7 +955,7 @@
1065
955
  confidence: strong
1066
956
  type: pattern
1067
957
  values:
1068
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
958
+ - (?<!BBDC-)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{40})(?![0-9A-Za-z_-])
1069
959
  filter_type:
1070
960
  - ValueAtlassianTokenCheck
1071
961
  min_line_len: 44
@@ -1083,7 +973,7 @@
1083
973
  confidence: weak
1084
974
  type: pattern
1085
975
  values:
1086
- - (?:(?<![.0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{24})(?![=.0-9A-Za-z_/+-])
976
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z]{24})(?![=.0-9A-Za-z_/+-])
1087
977
  filter_type: WeirdBase64Token
1088
978
  min_line_len: 24
1089
979
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1111,7 +1001,7 @@
1111
1001
  confidence: strong
1112
1002
  type: pattern
1113
1003
  values:
1114
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>do[op]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1004
+ - (?P<value>do[op]_v1_[a-f0-9]{64})(?![0-9A-Za-z_-])
1115
1005
  filter_type: TokenPattern
1116
1006
  min_line_len: 71
1117
1007
  required_substrings:
@@ -1126,7 +1016,7 @@
1126
1016
  confidence: moderate
1127
1017
  type: pattern
1128
1018
  values:
1129
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>sl.[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
1019
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>sl.[0-9A-Za-z_-]{135})(?![0-9A-Za-z_-])
1130
1020
  filter_type: TokenPattern
1131
1021
  min_line_len: 138
1132
1022
  required_substrings:
@@ -1140,7 +1030,7 @@
1140
1030
  confidence: moderate
1141
1031
  type: pattern
1142
1032
  values:
1143
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1033
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>oy2[a-z0-9]{43})(?![0-9A-Za-z_-])
1144
1034
  filter_type: TokenPattern
1145
1035
  min_line_len: 46
1146
1036
  required_substrings:
@@ -1154,7 +1044,7 @@
1154
1044
  confidence: strong
1155
1045
  type: pattern
1156
1046
  values:
1157
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64})(?![0-9A-Za-z_-])
1047
+ - (?P<value>(_gitlab_session=|GR1348941|gl(agent|soat|ffct|p[at]t|oas|cbt|imt|[dfr]t)-)[0-9A-Za-z_-]{20,64})(?![0-9A-Za-z_-])
1158
1048
  filter_type:
1159
1049
  - ValuePatternCheck
1160
1050
  min_line_len: 25
@@ -1181,7 +1071,7 @@
1181
1071
  confidence: strong
1182
1072
  type: pattern
1183
1073
  values:
1184
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1074
+ - (?P<value>eyJ[=0-9A-Za-z_-]{64,360})(?![=0-9A-Za-z_-])
1185
1075
  filter_type:
1186
1076
  - ValueGrafanaCheck
1187
1077
  min_line_len: 67
@@ -1196,7 +1086,7 @@
1196
1086
  confidence: strong
1197
1087
  type: pattern
1198
1088
  values:
1199
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1089
+ - (?P<value>glc_eyJ[0-9A-Za-z_-]{80,360})(?![0-9A-Za-z_-])
1200
1090
  filter_type:
1201
1091
  - ValueGrafanaCheck
1202
1092
  min_line_len: 87
@@ -1211,7 +1101,7 @@
1211
1101
  confidence: strong
1212
1102
  type: pattern
1213
1103
  values:
1214
- - (?:(?<![0-9A-Za-z_])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1104
+ - (?P<value>glsa_[0-9A-Za-z_-]{32}_[0-9A-Fa-f]{8})
1215
1105
  min_line_len: 46
1216
1106
  filter_type:
1217
1107
  - ValueGrafanaServiceCheck
@@ -1226,7 +1116,7 @@
1226
1116
  confidence: weak
1227
1117
  type: pattern
1228
1118
  values:
1229
- - (?:(?<![0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1119
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?=[0-9A-Za-z]{64})(?P<value>[0-9A-Za-z]{10,12}[B-Za-z0-9]A{10,12}[B-Za-z0-9][0-9A-Za-z]{40,44})(?![=0-9A-Za-z_/+-])
1230
1120
  filter_type: [ ]
1231
1121
  min_line_len: 43
1232
1122
  required_substrings:
@@ -1240,7 +1130,7 @@
1240
1130
  confidence: weak
1241
1131
  type: pattern
1242
1132
  values:
1243
- - (?:(?<![.0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1133
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{15})(?![=0-9A-Za-z_/+-])
1244
1134
  filter_type: WeirdBase36Token
1245
1135
  min_line_len: 15
1246
1136
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1253,7 +1143,7 @@
1253
1143
  confidence: weak
1254
1144
  type: pattern
1255
1145
  values:
1256
- - (?:(?<![.0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{24,25})(?![=0-9A-Za-z_/+-])
1146
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[a-z0-9]{24,25})(?![=0-9A-Za-z_/+-])
1257
1147
  filter_type: WeirdBase36Token
1258
1148
  min_line_len: 24
1259
1149
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1266,7 +1156,7 @@
1266
1156
  confidence: weak
1267
1157
  type: pattern
1268
1158
  values:
1269
- - (?:(?<![.0-9A-Za-z_/+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{20})(?![=0-9A-Za-z_/+-])
1159
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{20})(?![=0-9A-Za-z_/+-])
1270
1160
  filter_type: WeirdBase64Token
1271
1161
  min_line_len: 20
1272
1162
  required_regex: "[0-9A-Za-z_/+-]{15}"
@@ -1279,7 +1169,7 @@
1279
1169
  confidence: strong
1280
1170
  type: pattern
1281
1171
  values:
1282
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1172
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hv[brs]\.[0-9A-Za-z_-]{80,160})
1283
1173
  filter_type:
1284
1174
  - ValuePatternCheck
1285
1175
  - ValueEntropyBase64Check
@@ -1297,7 +1187,7 @@
1297
1187
  confidence: strong
1298
1188
  type: pattern
1299
1189
  values:
1300
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1190
+ - (?P<value>[0-9A-Za-z_-]{14}\.atlasv1\.[0-9A-Za-z_-]{67})(?![0-9A-Za-z_-])
1301
1191
  filter_type:
1302
1192
  - ValuePatternCheck
1303
1193
  - ValueEntropyBase64Check
@@ -1313,7 +1203,7 @@
1313
1203
  confidence: weak
1314
1204
  type: pattern
1315
1205
  values:
1316
- - (?:(?<![0-9A-Za-z_+-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[A-Z2-7]{16})(?![=0-9A-Za-z_+-])
1206
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>[A-Z2-7]{16})(?![=0-9A-Za-z_+-])
1317
1207
  filter_type:
1318
1208
  - ValueCoupleKeywordCheck
1319
1209
  - ValuePatternCheck
@@ -1364,7 +1254,7 @@
1364
1254
  confidence: strong
1365
1255
  type: pattern
1366
1256
  values:
1367
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{52})(?![0-9A-Za-z_-])
1257
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>gsk_[0-9A-Za-z_-]{52})(?![0-9A-Za-z_-])
1368
1258
  min_line_len: 56
1369
1259
  filter_type:
1370
1260
  - ValuePatternCheck
@@ -1380,7 +1270,7 @@
1380
1270
  confidence: moderate
1381
1271
  type: pattern
1382
1272
  values:
1383
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1273
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>hf_[0-9A-Za-z_-]{34})(?![0-9A-Za-z_-])
1384
1274
  min_line_len: 37
1385
1275
  filter_type:
1386
1276
  - ValuePatternCheck
@@ -1396,7 +1286,7 @@
1396
1286
  confidence: strong
1397
1287
  type: pattern
1398
1288
  values:
1399
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1289
+ - (?P<value>tvly-[0-9A-Za-z_-]{32,40})(?![0-9A-Za-z_-])
1400
1290
  min_line_len: 37
1401
1291
  filter_type:
1402
1292
  - ValuePatternCheck(5)
@@ -1412,11 +1302,10 @@
1412
1302
  confidence: strong
1413
1303
  type: pattern
1414
1304
  values:
1415
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1305
+ - (?P<value>sntrys_eyJ[0-9A-Za-z_-]{80,8000}=*([0-9A-Za-z_-]{32,256})?)(?![0-9A-Za-z_-])
1416
1306
  min_line_len: 37
1417
1307
  filter_type:
1418
1308
  - ValuePatternCheck(5)
1419
- - ValueEntropyBase64Check
1420
1309
  required_substrings:
1421
1310
  - sntrys_eyJ
1422
1311
  target:
@@ -1428,7 +1317,7 @@
1428
1317
  confidence: strong
1429
1318
  type: pattern
1430
1319
  values:
1431
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1320
+ - (?P<value>sntryu_[0-9a-f]{64})(?![0-9A-Za-z_-])
1432
1321
  min_line_len: 37
1433
1322
  filter_type:
1434
1323
  - ValuePatternCheck(5)
@@ -1443,7 +1332,7 @@
1443
1332
  confidence: strong
1444
1333
  type: pattern
1445
1334
  values:
1446
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1335
+ - (?P<value>[MNO][ADQTgjwz][AEIMQUYcgk][012345wxyz][0-9A-Za-z_-]{20,24}\.[0-9A-Za-z_-]{6}\.[0-9A-Za-z_-]{30,40})(?![0-9A-Za-z_-])
1447
1336
  min_line_len: 62
1448
1337
  filter_type:
1449
1338
  - ValueDiscordBotCheck
@@ -1477,7 +1366,7 @@
1477
1366
  confidence: weak
1478
1367
  type: pattern
1479
1368
  values:
1480
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1369
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>wx[0-9a-f]{16})(?![0-9A-Za-z_-])
1481
1370
  min_line_len: 18
1482
1371
  filter_type: TokenPattern
1483
1372
  required_substrings:
@@ -1491,7 +1380,7 @@
1491
1380
  confidence: weak
1492
1381
  type: pattern
1493
1382
  values:
1494
- - (?:(?<![0-9A-Za-z_-])|\\[0abfnrtv]|(%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu]([0-9A-Fa-f]{4}){1,2}|\x1B\[[0-9;]{0,80}m)(?P<value>00D[0-9A-Za-z]{9,15}(![.0-9A-Za-z_-]{24,200})?)(?![0-9A-Za-z_-])
1383
+ - (?:^|[^0-9A-Za-z_+-]|\\[0abfnrtv]|(?:%|\\x)[0-9A-Fa-f]{2}|\\[0-7]{3}|\\[Uu][0-9A-Fa-f]{4}|\x1B\[[0-9;]{0,80}m)(?P<value>00D[0-9A-Za-z]{9,15}(![.0-9A-Za-z_-]{24,200})?)(?![0-9A-Za-z_-])
1495
1384
  min_line_len: 12
1496
1385
  filter_type:
1497
1386
  - ValuePatternCheck(9)
@@ -1502,3 +1391,144 @@
1502
1391
  target:
1503
1392
  - code
1504
1393
  - doc
1394
+
1395
+ - name: API
1396
+ severity: medium
1397
+ confidence: moderate
1398
+ type: keyword
1399
+ values:
1400
+ - api(?!tal)
1401
+ filter_type: GeneralKeyword
1402
+ use_ml: true
1403
+ min_line_len: 11
1404
+ required_substrings:
1405
+ - api
1406
+ target:
1407
+ - code
1408
+
1409
+ - name: Auth
1410
+ severity: medium
1411
+ confidence: moderate
1412
+ type: keyword
1413
+ values:
1414
+ - auth(?!ors?(?!i[tz]))
1415
+ filter_type: GeneralKeyword
1416
+ use_ml: true
1417
+ min_line_len: 12
1418
+ required_substrings:
1419
+ - auth
1420
+ target:
1421
+ - code
1422
+
1423
+ - name: Certificate
1424
+ severity: medium
1425
+ confidence: moderate
1426
+ type: keyword
1427
+ values:
1428
+ - cert
1429
+ filter_type: GeneralKeyword
1430
+ use_ml: true
1431
+ min_line_len: 12
1432
+ required_substrings:
1433
+ - cert
1434
+ target:
1435
+ - code
1436
+
1437
+ - name: Credential
1438
+ severity: medium
1439
+ confidence: moderate
1440
+ type: keyword
1441
+ values:
1442
+ - credential
1443
+ filter_type: GeneralKeyword
1444
+ use_ml: true
1445
+ min_line_len: 18
1446
+ required_substrings:
1447
+ - credential
1448
+ target:
1449
+ - code
1450
+
1451
+ - name: Key
1452
+ severity: medium
1453
+ confidence: moderate
1454
+ type: keyword
1455
+ values:
1456
+ - key(?!word|board|pad|name)
1457
+ filter_type: GeneralKeyword
1458
+ use_ml: true
1459
+ min_line_len: 11
1460
+ required_substrings:
1461
+ - key
1462
+ target:
1463
+ - code
1464
+
1465
+ - name: Nonce
1466
+ severity: medium
1467
+ confidence: moderate
1468
+ type: keyword
1469
+ values:
1470
+ - (?<!\\)nonce
1471
+ filter_type: GeneralKeyword
1472
+ use_ml: true
1473
+ min_line_len: 13
1474
+ required_substrings:
1475
+ - nonce
1476
+ target:
1477
+ - code
1478
+
1479
+ - name: Password
1480
+ severity: medium
1481
+ confidence: moderate
1482
+ type: keyword
1483
+ values:
1484
+ - (?<!by)pass(?!ed|ing|es|age|\s+[a-z]{3,80})|pw(d|\b)
1485
+ filter_type: PasswordKeyword
1486
+ use_ml: true
1487
+ min_line_len: 10
1488
+ required_substrings:
1489
+ - pass
1490
+ - pw
1491
+ target:
1492
+ - code
1493
+
1494
+ - name: Salt
1495
+ severity: medium
1496
+ confidence: moderate
1497
+ type: keyword
1498
+ values:
1499
+ - salt
1500
+ filter_type: GeneralKeyword
1501
+ use_ml: true
1502
+ min_line_len: 12
1503
+ required_substrings:
1504
+ - salt
1505
+ target:
1506
+ - code
1507
+
1508
+ - name: Secret
1509
+ severity: medium
1510
+ confidence: moderate
1511
+ type: keyword
1512
+ values:
1513
+ - secret
1514
+ filter_type: GeneralKeyword
1515
+ use_ml: true
1516
+ min_line_len: 14
1517
+ required_substrings:
1518
+ - secret
1519
+ target:
1520
+ - code
1521
+
1522
+ - name: Token
1523
+ severity: medium
1524
+ confidence: moderate
1525
+ type: keyword
1526
+ values:
1527
+ - token(?!ize)
1528
+ filter_type: GeneralKeyword
1529
+ use_ml: true
1530
+ min_line_len: 13
1531
+ required_substrings:
1532
+ - token
1533
+ target:
1534
+ - code