keyhog-core 0.5.4

keyhog-core — shared data model and detector specifications for the KeyHog secret scanner
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# Docs: https://developers.classlink.com/docs/getting-started
# Format: OAuth 2.0 bearer token or API key
# Verify: GET /v2/my/profile with Bearer token returns 200 if valid
# Prefix: none (requires context anchoring)

[detector]
id = "classlink-api-credentials"
name = "ClassLink API Credentials"
service = "classlink"
severity = "high"
keywords = ["classlink", "CLASSLINK", "classlink_api", "onedrove"]

[[detector.patterns]]
regex = "(?:classlink|onedrove)[_\\s.-]*(?:api[_\\s.-]*)?(?:key|token)[=:\\s\"'']+([a-zA-Z0-9_-]{40,80})"
description = "ClassLink API key/bearer token with context anchor"
group = 1

[[detector.patterns]]
regex = "(?:classlink|onedrove)[_\\s.-]*(?:client[_\\s.-]*id)[=:\\s\"'']+([a-f0-9]{32})"
description = "ClassLink OAuth client ID with context anchor"
group = 1

[[detector.patterns]]
regex = "(?:classlink|onedrove)[_\\s.-]*(?:client[_\\s.-]*secret)[=:\\s\"'']+([a-zA-Z0-9_-]{40,64})"
description = "ClassLink OAuth client secret with context anchor"
group = 1