1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
# Tier-B: path substrings that mark a file as security-sensitive, boosting the
# confidence of a match found in it. Matched case-insensitively as substrings
# via a single Aho-Corasick automaton (see confidence/signals.rs). Drop new
# markers here to extend coverage (no code change required).
markers = [
# Sensitive filenames
".env",
".env.local",
".env.production",
".env.staging",
"credentials",
"secrets",
"apikeys",
"api_keys",
".npmrc",
".pypirc",
".netrc",
".pgpass",
"terraform.tfvars",
"variables.tf",
"docker-compose",
"application.yml",
"application.properties",
"config.json",
"config.yaml",
"config.toml",
# Sensitive extensions (matched as substrings, extensions are at end of path
# and names are distinctive)
".pem",
".key",
".p12",
".pfx",
".jks",
".keystore",
".cer",
".crt",
# CI/CD secret files
".github/workflows",
"gitlab-ci.yml",
"Jenkinsfile",
"buildspec.yml",
# Cloud config
"serverless.yml",
"sam-template",
"helm/values",
"chart/values",
]