# Docs: https://docs.gitlab.com/ee/security/tokens/#feed-token
# Format: glft- prefix followed by 20+ alphanumeric/_/- characters.
# The feed token authenticates RSS / Atom / iCalendar feed URLs and exposes
# a user's issues, to-dos, and activity without a session; leaking one is an
# information-disclosure of all feeds readable by that user, so the severity
# is medium.
# Verify: GET a feed URL with `?feed_token=`; reported unverified here.
# Prefix: glft-
[detector]
id = "gitlab-feed-token"
name = "GitLab Feed Token"
service = "gitlab"
severity = "medium"
ml = { match_mode = "lift", entropy_mode = "disabled", weight = 1.0, context_radius_lines = 5 }
match_confidence = { literal_prefix_weight = 0.35, context_anchor_weight = 0.20, entropy_weight = 0.20, high_entropy_partial_weight = 0.12, moderate_entropy_threshold = 3.0, moderate_entropy_weight = 0.05, low_entropy_penalty_floor = 2.0, low_entropy_min_match_length = 10, low_entropy_penalty_multiplier = 0.60, keyword_nearby_weight = 0.10, sensitive_file_weight = 0.10, companion_weight = 0.05, very_high_entropy_margin = 1.2999999999999998, named_anchor_floor = 0.55, assignment_context_multiplier = 1.0, string_literal_context_multiplier = 0.9, unknown_context_multiplier = 0.8, documentation_context_multiplier = 0.3, comment_context_multiplier = 0.4, test_context_multiplier = 0.3, encrypted_context_multiplier = 0.05, soft_context_suppression_threshold = 0.5, encrypted_context_suppression_threshold = 0.8, post_match = { placeholder_multiplier = 0.05, minimum_byte_diversity = 0.1, low_diversity_multiplier = 0.1, maximum_repeat_ratio = 0.8, degenerate_run_min_length = 10, degenerate_repeat_multiplier = 0.1, fixture_path_multiplier = 0.5, ml_context_reapply_below = 0.95 } }
# "rss" removed: over-broad prefilter (fires on any RSS/feed URL or "/rss" path)
# that no regex references, the pattern requires the unambiguous `glft-` prefix
# (keyword "glft-"), so "rss" only forced wasted scan passes. Recall-neutral.
keywords = ["glft-", "gitlab", "feed_token"]
[[detector.patterns]]
regex = 'glft-[a-zA-Z0-9_\-]{20,}'
description = "GitLab feed token (glft- prefix)"
[[detector.tests]]
test_positive = "glft-Nf7Rr2Tu6Vw3Xz9Bc5Ae8Eg1H"
test_negative = "glft-short"