# Docs: https://docs.saltproject.io/en/latest/topics/netapi/index.html
# Format: Salt API uses username/password with eauth, returns X-Auth-Token
# Verify: POST /login with credentials returns token if valid
# Prefix: none (requires context anchoring)
[detector]
id = "saltstack-credentials"
name = "SaltStack API Credentials"
service = "saltstack"
severity = "critical"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
min_confidence = 0.20
keywords = ["SALT_API_PASSWORD", "SALT_PASSWORD", "SALT"]
entropy_high = 4.5
entropy_floor = [{ max_len = 24, floor = 3.0 }, { max_len = 40, floor = 2.8 }, { floor = 3.5 }]
canonical_hex_key_material = [{ lengths = [32, 40, 48, 64] }]
[[detector.patterns]]
regex = '''(?:SALT[_\-\s]*API[_\-\s]*PASSWORD|SALT[_\-\s]*PASSWORD)[=:\s"'']+([a-zA-Z0-9!@#$%^&*._-]+)'''
description = "SaltStack API password"
group = 1
weak_anchor = true
[[detector.companions]]
name = "username"
regex = '''(?:SALT[_\-\s]*API[_\-\s]*USERNAME|SALT[_\-\s]*USERNAME)[=:\s"'']+([a-zA-Z0-9_-]+)'''
within_lines = 5
required = false
# `X-Auth-Token` and bare `"token":<40+hex>` patterns dropped 2026-05-29.
# Both are entirely generic - `X-Auth-Token` is a common HTTP header used
# by Splunk, Vault, Consul, OpenStack, Cinder, Neutron, Heat, Ceilometer,
# OpenSearch, Solr, et al; bare `"token"` is JSON-API ubiquitous. Mirror
# v22 traced 50 FPs across sha1-hex, sha256-hex prefixes, and git-commit
# values to these two patterns. SALT_*_PASSWORD remains the secret-bearing
# primary; SALT_*_USERNAME is optional companion context and never a finding.
[[detector.tests]]
test_positive = "SALT_API_USERNAME=saltadmin\nSALT_API_PASSWORD=Xy9KmPq2LvWnB7tR"
test_negative = "SALT_API_USERNAME=saltadmin\nSALT_API_PASSWORD=YOUR_API_KEY_HERE_PLACEHOLDER_VALUE"