1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# Tier-B data: the default keyword lists a `ScanConfig` classifies a candidate's
# KEY / surrounding context with. These are the SHIPPED DEFAULTS; a user config
# can still override each field at runtime, this file is the one place the
# built-in defaults live (previously inline `vec![...]` in ScanConfig::default).
#
# secret_keywords: key names that indicate a credential value follows.
# test_keywords: context words marking a value as test / non-production.
# placeholder_keywords: words marking a value as an unfilled placeholder.
# known_prefixes: credential prefixes to prioritize during scanning.
known_prefixes = [
"AKIA",
"ASIA",
"ghp_",
"sk_",
]
secret_keywords = [
"password",
"passwd",
"pwd",
"secret",
"token",
"api_key",
"apikey",
"api-key",
"access_key",
"auth",
"authorization",
"auth_token",
"auth_key",
"private_key",
"client_secret",
"encryption_key",
"signing_key",
"bearer",
"credential",
"license_key",
]
test_keywords = [
"test",
"mock",
"fake",
"stub",
"fixture",
"example",
"sample",
"sandbox",
"staging",
]
placeholder_keywords = [
"change_me",
"changeme",
"replace_me",
"todo",
"fixme",
"your_",
"insert_",
"put_your",
"fill_in",
"<your",
]