[[detector]]
id = "aws-access-key"
action = "Disable or delete the exposed IAM access key, then rotate any paired secret access key and session token."
revoke_url = "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_ManagingAccessKeys"
docs_url = "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"
revoke_command = "aws iam update-access-key --access-key-id {{credential}} --status Inactive"
[[detector]]
id = "slack-bot-token"
action = "Revoke the exposed Slack bot token from the app configuration, reinstall the app if needed, and rotate dependent credentials."
revoke_url = "https://api.slack.com/authentication/token-types#bot"
docs_url = "https://api.slack.com/authentication/best-practices"
revoke_command = "curl -X POST https://slack.com/api/auth.revoke -H 'Authorization: Bearer {{credential}}'"
[[detector]]
id = "slack-user-token"
action = "Revoke the exposed Slack user token, review granted scopes, and reissue the token from the owning workspace or app."
revoke_url = "https://api.slack.com/methods/auth.revoke"
docs_url = "https://api.slack.com/authentication/best-practices"
revoke_command = "curl -X POST https://slack.com/api/auth.revoke -H 'Authorization: Bearer {{credential}}'"
[[detector]]
id = "slack-app-token"
action = "Rotate the Slack app-level token from the app configuration and review socket-mode or workflow integrations using it."
docs_url = "https://api.slack.com/authentication/token-types#app"
[[detector]]
id = "slack-webhook-url"
action = "Revoke the exposed Slack incoming webhook URL from the app configuration and create a new webhook for the affected channel."
docs_url = "https://api.slack.com/messaging/webhooks#regenerating"
[[detector]]
id = "stripe-secret-key"
action = "Roll the exposed Stripe secret key in the Dashboard, update production consumers, then delete the old key."
revoke_url = "https://docs.stripe.com/keys#roll-api-key"
docs_url = "https://docs.stripe.com/keys"
[[detector]]
id = "github-classic-pat"
action = "Revoke the exposed GitHub classic PAT, audit recent token usage, and recreate it with the minimum required scopes."
revoke_url = "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation"
docs_url = "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"
[[detector]]
id = "github-pat-fine-grained"
action = "Revoke the exposed GitHub fine-grained PAT, audit recent token usage, and recreate it with the minimum required repository access."
revoke_url = "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation"
docs_url = "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens"
[[detector]]
id = "npm-access-token"
action = "Revoke the exposed npm token, rotate automation secrets, and review package publish activity."
revoke_url = "https://docs.npmjs.com/revoking-access-tokens"
docs_url = "https://docs.npmjs.com/about-access-tokens"
[[service]]
match = "aws"
action = "Rotate the exposed AWS credential in IAM, revoke active sessions where applicable, and audit CloudTrail for use."
docs_url = "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html"
[[service]]
match = "slack"
action = "Revoke the exposed Slack credential from the app or workspace that issued it, then review scopes and recent usage."
docs_url = "https://api.slack.com/authentication/best-practices"
[[service]]
match = "stripe"
action = "Roll the exposed Stripe credential in the Dashboard and update every runtime that consumed the old value."
docs_url = "https://docs.stripe.com/keys"
[[service]]
match = "github"
action = "Revoke the exposed GitHub credential, audit recent usage, and recreate it with minimum required scopes."
docs_url = "https://docs.github.com/en/authentication/keeping-your-account-and-data-secure"
[[service]]
match = "gitlab"
action = "Revoke the exposed GitLab token, audit recent activity, and recreate it with minimum required scopes."
docs_url = "https://docs.gitlab.com/user/profile/personal_access_tokens/"
[[service]]
match = "google"
action = "Rotate the exposed Google credential in the owning Cloud project and review IAM/API key restrictions."
docs_url = "https://cloud.google.com/docs/authentication/api-keys"
[[service]]
match = "gcp"
action = "Rotate the exposed Google Cloud credential in the owning project and review IAM/API key restrictions."
docs_url = "https://cloud.google.com/docs/authentication/api-keys"
[[service]]
match = "npm"
action = "Revoke the exposed npm token, rotate automation secrets, and review package publish activity."
docs_url = "https://docs.npmjs.com/about-access-tokens"
[[severity]]
severity = "critical"
action = "Revoke immediately at the provider, rotate dependent credentials, and audit recent usage."
[[severity]]
severity = "high"
action = "Revoke and rotate the exposed credential, then remove it from the codebase."
[[severity]]
severity = "medium"
action = "Review usage, rotate if active, and move the secret into managed configuration."
[[severity]]
severity = "low"
action = "Remove the exposed value from the codebase and confirm it cannot authenticate."
[[severity]]
severity = "client-safe"
action = "Public by design; verify domain, origin, referrer, and quota restrictions before suppressing."
[[severity]]
severity = "info"
action = "Review the finding and document why it is safe before suppressing it."