{
"rules": [
{
"id": "1password-secret-key",
"name": "Uncovered a possible 1Password secret key, potentially compromising access to secrets in vaults.",
"pattern": "\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b",
"secret_group": null,
"keywords": [
"a3-"
],
"min_entropy": 3.8,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "1password-service-account-token",
"name": "Uncovered a possible 1Password service account token, potentially compromising access to secrets in vaults.",
"pattern": "ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}",
"secret_group": null,
"keywords": [
"ops_"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "adafruit-api-key",
"name": "Identified a potential Adafruit API Key, which could lead to unauthorized access to Adafruit services and sensitive data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:adafruit)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"adafruit"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "adobe-client-id",
"name": "Detected a pattern that resembles an Adobe OAuth Web Client ID, posing a risk of compromised Adobe integrations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:adobe)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"adobe"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "adobe-client-secret",
"name": "Discovered a potential Adobe Client Secret, which, if exposed, could allow unauthorized Adobe service access and data manipulation.",
"pattern": "\\b(p8e-(?i)[a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"p8e-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "age-secret-key",
"name": "Discovered a potential Age encryption tool secret key, risking data decryption and unauthorized access to sensitive information.",
"pattern": "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}",
"secret_group": null,
"keywords": [
"age-secret-key-1"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "airtable-api-key",
"name": "Uncovered a possible Airtable API Key, potentially compromising database access and leading to data leakage or alteration.",
"pattern": "(?i)[\\w.-]{0,50}?(?:airtable)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{17})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"airtable"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "airtable-personnal-access-token",
"name": "Uncovered a possible Airtable Personal AccessToken, potentially compromising database access and leading to data leakage or alteration.",
"pattern": "\\b(pat[[:alnum:]]{14}\\.[a-f0-9]{64})\\b",
"secret_group": null,
"keywords": [
"pat"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "algolia-api-key",
"name": "Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms.",
"pattern": "(?i)[\\w.-]{0,50}?(?:algolia)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"algolia"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "alibaba-access-key-id",
"name": "Detected an Alibaba Cloud AccessKey ID, posing a risk of unauthorized cloud resource access and potential data compromise.",
"pattern": "\\b(LTAI(?i)[a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"ltai"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "alibaba-secret-key",
"name": "Discovered a potential Alibaba Cloud Secret Key, potentially allowing unauthorized operations and data access within Alibaba Cloud.",
"pattern": "(?i)[\\w.-]{0,50}?(?:alibaba)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"alibaba"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "anthropic-admin-api-key",
"name": "Detected an Anthropic Admin API Key, risking unauthorized access to administrative functions and sensitive AI model configurations.",
"pattern": "\\b(sk-ant-admin01-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sk-ant-admin01"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "anthropic-api-key",
"name": "Identified an Anthropic API Key, which may compromise AI assistant integrations and expose sensitive data to unauthorized access.",
"pattern": "\\b(sk-ant-api03-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sk-ant-api03"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "artifactory-api-key",
"name": "Detected an Artifactory api key, posing a risk unauthorized access to the central repository.",
"pattern": "\\bAKCp[A-Za-z0-9]{69}\\b",
"secret_group": null,
"keywords": [
"akcp"
],
"min_entropy": 4.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "artifactory-reference-token",
"name": "Detected an Artifactory reference token, posing a risk of impersonation and unauthorized access to the central repository.",
"pattern": "\\bcmVmd[A-Za-z0-9]{59}\\b",
"secret_group": null,
"keywords": [
"cmvmd"
],
"min_entropy": 4.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "asana-client-id",
"name": "Discovered a potential Asana Client ID, risking unauthorized access to Asana projects and sensitive task information.",
"pattern": "(?i)[\\w.-]{0,50}?(?:asana)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"asana"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "asana-client-secret",
"name": "Identified an Asana Client Secret, which could lead to compromised project management integrity and unauthorized access.",
"pattern": "(?i)[\\w.-]{0,50}?(?:asana)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"asana"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "atlassian-api-token",
"name": "Detected an Atlassian API token, posing a threat to project management and collaboration tool security and data confidentiality.",
"pattern": "(?i)[\\w.-]{0,50}?(?:(?-i:ATLASSIAN|[Aa]tlassian)|(?-i:CONFLUENCE|[Cc]onfluence)|(?-i:JIRA|[Jj]ira))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20}[a-f0-9]{4})(?:[\\x60'\"\\s;]|\\\\[nr]|$)|\\b(ATATT3[A-Za-z0-9_\\-=]{186})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"atlassian",
"confluence",
"jira",
"atatt3"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "authress-service-client-access-key",
"name": "Uncovered a possible Authress Service Client Access Key, which may compromise access control services and sensitive data.",
"pattern": "\\b((?:sc|ext|scauth|authress)_(?i)[a-z0-9]{5,30}\\.[a-z0-9]{4,6}\\.(?-i:acc)[_-][a-z0-9-]{10,32}\\.[a-z0-9+/_=-]{30,120})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sc_",
"ext_",
"scauth_",
"authress_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "aws-access-token",
"name": "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms.",
"pattern": "\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\\b",
"secret_group": null,
"keywords": [
"a3t",
"akia",
"asia",
"abia",
"acca"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
".+EXAMPLE$"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "aws-amazon-bedrock-api-key-long-lived",
"name": "Identified a pattern that may indicate long-lived Amazon Bedrock API keys, risking unauthorized Amazon Bedrock usage",
"pattern": "\\b(ABSK[A-Za-z0-9+/]{109,269}={0,2})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"absk"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "aws-amazon-bedrock-api-key-short-lived",
"name": "Identified a pattern that may indicate short-lived Amazon Bedrock API keys, risking unauthorized Amazon Bedrock usage",
"pattern": "bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t",
"secret_group": null,
"keywords": [
"bedrock-api-key-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "azure-ad-client-secret",
"name": "Azure AD Client Secret",
"pattern": "(?:^|[\\\\'\"\\x60\\s>=:(,)])([a-zA-Z0-9_~.]{3}\\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\\\\'\"\\x60\\s<),])",
"secret_group": null,
"keywords": [
"q~"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "beamer-api-token",
"name": "Detected a Beamer API token, potentially compromising content management and exposing sensitive notifications and updates.",
"pattern": "(?i)[\\w.-]{0,50}?(?:beamer)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(b_[a-z0-9=_\\-]{44})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"beamer"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "bitbucket-client-id",
"name": "Discovered a potential Bitbucket Client ID, risking unauthorized repository access and potential codebase exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:bitbucket)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"bitbucket"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "bitbucket-client-secret",
"name": "Discovered a potential Bitbucket Client Secret, posing a risk of compromised code repositories and unauthorized access.",
"pattern": "(?i)[\\w.-]{0,50}?(?:bitbucket)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"bitbucket"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "bittrex-access-key",
"name": "Identified a Bittrex Access Key, which could lead to unauthorized access to cryptocurrency trading accounts and financial loss.",
"pattern": "(?i)[\\w.-]{0,50}?(?:bittrex)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"bittrex"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "bittrex-secret-key",
"name": "Detected a Bittrex Secret Key, potentially compromising cryptocurrency transactions and financial security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:bittrex)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"bittrex"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "cisco-meraki-api-key",
"name": "Cisco Meraki is a cloud-managed IT solution that provides networking, security, and device management through an easy-to-use interface.",
"pattern": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:(?-i:[Mm]eraki|MERAKI))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"meraki"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "clickhouse-cloud-api-secret-key",
"name": "Identified a pattern that may indicate clickhouse cloud API secret key, risking unauthorized clickhouse cloud api access and data breaches on ClickHouse Cloud platforms.",
"pattern": "\\b(4b1d[A-Za-z0-9]{38})\\b",
"secret_group": null,
"keywords": [
"4b1d"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "clojars-api-token",
"name": "Uncovered a possible Clojars API token, risking unauthorized access to Clojure libraries and potential code manipulation.",
"pattern": "(?i)CLOJARS_[a-z0-9]{60}",
"secret_group": null,
"keywords": [
"clojars_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "cloudflare-api-key",
"name": "Detected a Cloudflare API Key, potentially compromising cloud application deployments and operational security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:cloudflare)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"cloudflare"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "cloudflare-global-api-key",
"name": "Detected a Cloudflare Global API Key, potentially compromising cloud application deployments and operational security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:cloudflare)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{37})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"cloudflare"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "cloudflare-origin-ca-key",
"name": "Detected a Cloudflare Origin CA Key, potentially compromising cloud application deployments and operational security.",
"pattern": "\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"cloudflare",
"v1.0-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "codecov-access-token",
"name": "Found a pattern resembling a Codecov Access Token, posing a risk of unauthorized access to code coverage reports and sensitive data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:codecov)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"codecov"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "cohere-api-token",
"name": "Identified a Cohere Token, posing a risk of unauthorized access to AI services and data manipulation.",
"pattern": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:cohere|CO_API_KEY)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-zA-Z0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"cohere",
"co_api_key"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "coinbase-access-token",
"name": "Detected a Coinbase Access Token, posing a risk of unauthorized access to cryptocurrency accounts and financial transactions.",
"pattern": "(?i)[\\w.-]{0,50}?(?:coinbase)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"coinbase"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "confluent-access-token",
"name": "Identified a Confluent Access Token, which could compromise access to streaming data platforms and sensitive data flow.",
"pattern": "(?i)[\\w.-]{0,50}?(?:confluent)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"confluent"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "confluent-secret-key",
"name": "Found a Confluent Secret Key, potentially risking unauthorized operations and data access within Confluent services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:confluent)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"confluent"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "contentful-delivery-api-token",
"name": "Discovered a Contentful delivery API token, posing a risk to content management systems and data integrity.",
"pattern": "(?i)[\\w.-]{0,50}?(?:contentful)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{43})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"contentful"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "curl-auth-header",
"name": "Discovered a potential authorization token provided in a curl command header, which could compromise the curl accessed resource.",
"pattern": "\\bcurl\\b(?:.*?|.*?(?:[\\r\\n]{1,2}.*?){1,5})[ \\t\\n\\r](?:-H|--header)(?:=|[ \\t]{0,5})(?:\"(?i)(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))\"|'(?i)(?:Authorization:[ \\t]{0,5}(?:Basic[ \\t]([a-z0-9+/]{8,}={0,3})|(?:Bearer|(?:Api-)?Token)[ \\t]([\\w=~@.+/-]{8,})|([\\w=~@.+/-]{8,}))|(?:(?:X-(?:[a-z]+-)?)?(?:Api-?)?(?:Key|Token)):[ \\t]{0,5}([\\w=~@.+/-]{8,}))')(?:\\B|\\s|\\z)",
"secret_group": null,
"keywords": [
"curl"
],
"min_entropy": 2.75,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "curl-auth-user",
"name": "Discovered a potential basic authorization token provided in a curl command, which could compromise the curl accessed resource.",
"pattern": "\\bcurl\\b(?:.*|.*(?:[\\r\\n]{1,2}.*){1,5})[ \\t\\n\\r](?:-u|--user)(?:=|[ \\t]{0,5})(\"(:[^\"]{3,}|[^:\"]{3,}:|[^:\"]{3,}:[^\"]{3,})\"|'([^:']{3,}:[^']{3,})'|((?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w$@.-]+):(?:\"[^\"]{3,}\"|'[^']{3,}'|[\\w${}@.-]+)))(?:\\s|\\z)",
"secret_group": null,
"keywords": [
"curl"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"[^:]+:(?:change(?:it|me)|pass(?:word)?|pwd|test|token|\\*+|x+)",
"['\"]?<[^>]+>['\"]?:['\"]?<[^>]+>|<[^:]+:[^>]+>['\"]?",
"[^:]+:\\[[^]]+]",
"['\"]?[^:]+['\"]?:['\"]?\\$(?:\\d|\\w+|\\{(?:\\d|\\w+)\\})['\"]?",
"\\$\\([^)]+\\):\\$\\([^)]+\\)",
"['\"]?\\$?\\{\\{[^}]+\\}\\}['\"]?:['\"]?\\$?\\{\\{[^}]+\\}\\}['\"]?"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "databricks-api-token",
"name": "Uncovered a Databricks API token, which may compromise big data analytics platforms and sensitive data processing.",
"pattern": "\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dapi"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "datadog-access-token",
"name": "Detected a Datadog Access Token, potentially risking monitoring and analytics data exposure and manipulation.",
"pattern": "(?i)[\\w.-]{0,50}?(?:datadog)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"datadog"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "defined-networking-api-token",
"name": "Identified a Defined Networking API token, which could lead to unauthorized network operations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:dnkey)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(dnkey-[a-z0-9=_\\-]{26}-[a-z0-9=_\\-]{52})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dnkey"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "digitalocean-access-token",
"name": "Found a DigitalOcean OAuth Access Token, risking unauthorized cloud resource access and data compromise.",
"pattern": "\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"doo_v1_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "digitalocean-pat",
"name": "Discovered a DigitalOcean Personal Access Token, posing a threat to cloud infrastructure security and data privacy.",
"pattern": "\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dop_v1_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "digitalocean-refresh-token",
"name": "Uncovered a DigitalOcean OAuth Refresh Token, which could allow prolonged unauthorized access and resource manipulation.",
"pattern": "(?i)\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dor_v1_"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "discord-api-token",
"name": "Detected a Discord API key, potentially compromising communication channels and user data privacy on Discord.",
"pattern": "(?i)[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"discord"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "discord-client-id",
"name": "Identified a Discord client ID, which may lead to unauthorized integrations and data exposure in Discord applications.",
"pattern": "(?i)[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{18})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"discord"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "discord-client-secret",
"name": "Discovered a potential Discord client secret, risking compromised Discord bot integrations and data leaks.",
"pattern": "(?i)[\\w.-]{0,50}?(?:discord)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"discord"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "doppler-api-token",
"name": "Discovered a Doppler API token, posing a risk to environment and secrets management security.",
"pattern": "dp\\.pt\\.(?i)[a-z0-9]{43}",
"secret_group": null,
"keywords": [
"dp.pt."
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "droneci-access-token",
"name": "Detected a Droneci Access Token, potentially compromising continuous integration and deployment workflows.",
"pattern": "(?i)[\\w.-]{0,50}?(?:droneci)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"droneci"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "dropbox-api-token",
"name": "Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage.",
"pattern": "(?i)[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{15})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dropbox"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "dropbox-long-lived-api-token",
"name": "Found a Dropbox long-lived API token, risking prolonged unauthorized access to cloud storage and sensitive data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{11}(AAAAAAAAAA)[a-z0-9\\-_=]{43})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dropbox"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "dropbox-short-lived-api-token",
"name": "Discovered a Dropbox short-lived API token, posing a risk of temporary but potentially harmful data access and manipulation.",
"pattern": "(?i)[\\w.-]{0,50}?(?:dropbox)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(sl\\.[a-z0-9\\-=_]{135})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"dropbox"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "duffel-api-token",
"name": "Uncovered a Duffel API token, which may compromise travel platform integrations and sensitive customer data.",
"pattern": "duffel_(?:test|live)_(?i)[a-z0-9_\\-=]{43}",
"secret_group": null,
"keywords": [
"duffel_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "dynatrace-api-token",
"name": "Detected a Dynatrace API token, potentially risking application performance monitoring and data exposure.",
"pattern": "dt0c01\\.(?i)[a-z0-9]{24}\\.[a-z0-9]{64}",
"secret_group": null,
"keywords": [
"dt0c01."
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "easypost-api-token",
"name": "Identified an EasyPost API token, which could lead to unauthorized postal and shipment service access and data exposure.",
"pattern": "\\bEZAK(?i)[a-z0-9]{54}\\b",
"secret_group": null,
"keywords": [
"ezak"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "easypost-test-api-token",
"name": "Detected an EasyPost test API token, risking exposure of test environments and potentially sensitive shipment data.",
"pattern": "\\bEZTK(?i)[a-z0-9]{54}\\b",
"secret_group": null,
"keywords": [
"eztk"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "etsy-access-token",
"name": "Found an Etsy Access Token, potentially compromising Etsy shop management and customer data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:(?-i:ETSY|[Ee]tsy))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"etsy"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "facebook-access-token",
"name": "Discovered a Facebook Access Token, posing a risk of unauthorized access to Facebook accounts and personal data exposure.",
"pattern": "(?i)\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"facebook"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "facebook-page-access-token",
"name": "Discovered a Facebook Page Access Token, posing a risk of unauthorized access to Facebook accounts and personal data exposure.",
"pattern": "\\b(EAA[MC](?i)[a-z0-9]{100,})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"eaam",
"eaac"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "facebook-secret",
"name": "Discovered a Facebook Application secret, posing a risk of unauthorized access to Facebook accounts and personal data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:facebook)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"facebook"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "fastly-api-token",
"name": "Uncovered a Fastly API key, which may compromise CDN and edge cloud services, leading to content delivery and security issues.",
"pattern": "(?i)[\\w.-]{0,50}?(?:fastly)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"fastly"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "finicity-api-token",
"name": "Detected a Finicity API token, potentially risking financial data access and unauthorized financial operations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:finicity)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"finicity"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "finicity-client-secret",
"name": "Identified a Finicity Client Secret, which could lead to compromised financial service integrations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:finicity)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"finicity"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "finnhub-access-token",
"name": "Found a Finnhub Access Token, risking unauthorized access to financial market data and analytics.",
"pattern": "(?i)[\\w.-]{0,50}?(?:finnhub)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"finnhub"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "flickr-access-token",
"name": "Discovered a Flickr Access Token, posing a risk of unauthorized photo management and potential data leakage.",
"pattern": "(?i)[\\w.-]{0,50}?(?:flickr)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"flickr"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "flutterwave-encryption-key",
"name": "Uncovered a Flutterwave Encryption Key, which may compromise payment processing and sensitive financial information.",
"pattern": "FLWSECK_TEST-(?i)[a-h0-9]{12}",
"secret_group": null,
"keywords": [
"flwseck_test"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "flutterwave-public-key",
"name": "Detected a Finicity Public Key, potentially exposing public cryptographic operations and integrations.",
"pattern": "FLWPUBK_TEST-(?i)[a-h0-9]{32}-X",
"secret_group": null,
"keywords": [
"flwpubk_test"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "flutterwave-secret-key",
"name": "Identified a Flutterwave Secret Key, risking unauthorized financial transactions and data breaches.",
"pattern": "FLWSECK_TEST-(?i)[a-h0-9]{32}-X",
"secret_group": null,
"keywords": [
"flwseck_test"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "flyio-access-token",
"name": "Uncovered a Fly.io API key",
"pattern": "\\b((?:fo1_[\\w-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"fo1_",
"fm1",
"fm2_"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "frameio-api-token",
"name": "Found a Frame.io API token, potentially compromising video collaboration and project management.",
"pattern": "fio-u-(?i)[a-z0-9\\-_=]{64}",
"secret_group": null,
"keywords": [
"fio-u-"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "freemius-secret-key",
"name": "Detected a Freemius secret key, potentially exposing sensitive information.",
"pattern": "(?i)[\"']secret_key[\"']\\s*=>\\s*[\"'](sk_[\\S]{29})[\"']",
"secret_group": null,
"keywords": [
"secret_key"
],
"min_entropy": 0,
"confidence": "medium",
"path": "(?i)\\.php$",
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "freshbooks-access-token",
"name": "Discovered a Freshbooks Access Token, posing a risk to accounting software access and sensitive financial data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:freshbooks)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"freshbooks"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gcp-api-key",
"name": "Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches.",
"pattern": "\\b(AIza[\\w-]{35})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"aiza"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"AIzaSyabcdefghijklmnopqrstuvwxyz1234567",
"AIzaSyAnLA7NfeLquW1tJFpx_eQCxoX-oo6YyIs",
"AIzaSyCkEhVjf3pduRDt6d1yKOMitrUEke8agEM",
"AIzaSyDMAScliyLx7F0NPDEJi1QmyCgHIAODrlU",
"AIzaSyD3asb-2pEZVqMkmL6M9N6nHZRR_znhrh0",
"AIzayDNSXIbFmlXbIE6mCzDLQAqITYefhixbX4A",
"AIzaSyAdOS2zB6NCsk1pCdZ4-P6GBdi_UUPwX7c",
"AIzaSyASWm6HmTMdYWpgMnjRBjxcQ9CKctWmLd4",
"AIzaSyANUvH9H9BsUccjsu2pCmEkOPjjaXeDQgY",
"AIzaSyA5_iVawFQ8ABuTZNUdcwERLJv_a_p4wtM",
"AIzaSyA4UrcGxgwQFTfaI3no3t7Lt1sjmdnP5sQ",
"AIzaSyDSb51JiIcB6OJpwwMicseKRhhrOq1cS7g",
"AIzaSyBF2RrAIm4a0mO64EShQfqfd2AFnzAvvuU",
"AIzaSyBcE-OOIbhjyR83gm4r2MFCu4MJmprNXsw",
"AIzaSyB8qGxt4ec15vitgn44duC5ucxaOi4FmqE",
"AIzaSyA8vmApnrHNFE0bApF4hoZ11srVL_n0nvY"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "generic-api-key",
"name": "Detected a Generic API Key, potentially exposing access to various services and sensitive operations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:access|auth|(?-i:[Aa]pi|API)|credential|creds|key|passw(?:or)?d|secret|token)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([\\w.=-]{10,150}|[a-z0-9][a-z0-9+/]{11,}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"access",
"api",
"auth",
"key",
"credential",
"creds",
"passwd",
"password",
"secret",
"token"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"^[a-zA-Z_.-]+$"
],
"paths": [],
"stopwords": []
},
{
"condition": "or",
"target": "match",
"regexes": [
"(?i)(?:access(?:ibility|or)|access[_.-]?id|random[_.-]?access|api[_.-]?(?:id|name|version)|rapid|capital|[a-z0-9-]*?api[a-z0-9-]*?:jar:|author|X-MS-Exchange-Organization-Auth|Authentication-Results|(?:credentials?[_.-]?id|withCredentials)|(?:bucket|foreign|hot|idx|natural|primary|pub(?:lic)?|schema|sequence)[_.-]?key|(?:turkey)|key[_.-]?(?:alias|board|code|frame|id|length|mesh|name|pair|press(?:ed)?|ring|selector|signature|size|stone|storetype|word|up|down|left|right)|key[_.-]?vault[_.-]?(?:id|name)|keyVaultToStoreSecrets|key(?:store|tab)[_.-]?(?:file|path)|issuerkeyhash|(?-i:[DdMm]onkey|[DM]ONKEY)|keying|(?:secret)[_.-]?(?:length|name|size)|UserSecretsId|(?:csrf)[_.-]?token|(?:io\\.jsonwebtoken[ \\t]?:[ \\t]?[\\w-]+)|(?:api|credentials|token)[_.-]?(?:endpoint|ur[il])|public[_.-]?token|(?:key|token)[_.-]?file|(?-i:(?:[A-Z_]+=\\n[A-Z_]+=|[a-z_]+=\\n[a-z_]+=)(?:\\n|\\z))|(?-i:(?:[A-Z.]+=\\n[A-Z.]+=|[a-z.]+=\\n[a-z.]+=)(?:\\n|\\z)))"
],
"paths": [],
"stopwords": [
"000000",
"6fe4476ee5a1832882e326b506d14126",
"_ec2_",
"aaaaaa",
"about",
"abstract",
"academy",
"acces",
"account",
"act-",
"act.",
"act_",
"action",
"active",
"actively",
"activity",
"adapter",
"add-",
"add-on",
"add.",
"add_",
"addon",
"addres",
"admin",
"adobe",
"advanced",
"adventure",
"agent",
"agile",
"air-",
"air.",
"air_",
"ajax",
"akka",
"alert",
"alfred",
"algorithm",
"all-",
"all.",
"all_",
"alloy",
"alpha",
"amazon",
"amqp",
"analysi",
"analytic",
"analyzer",
"android",
"angular",
"angularj",
"animate",
"animation",
"another",
"ansible",
"answer",
"ant-",
"ant.",
"ant_",
"any-",
"any.",
"any_",
"apache",
"app-",
"app.",
"app_",
"apple",
"arch",
"archive",
"archived",
"arduino",
"array",
"art-",
"art.",
"art_",
"article",
"asp-",
"asp.",
"asp_",
"asset",
"async",
"atom",
"attention",
"audio",
"audit",
"aura",
"auth",
"author",
"authorize",
"auto",
"automated",
"automatic",
"awesome",
"aws_",
"azure",
"back",
"backbone",
"backend",
"backup",
"bar-",
"bar.",
"bar_",
"base",
"based",
"bash",
"basic",
"batch",
"been",
"beer",
"behavior",
"being",
"benchmark",
"best",
"beta",
"better",
"big-",
"big.",
"big_",
"binary",
"binding",
"bit-",
"bit.",
"bit_",
"bitcoin",
"block",
"blog",
"board",
"book",
"bookmark",
"boost",
"boot",
"bootstrap",
"bosh",
"bot-",
"bot.",
"bot_",
"bower",
"box-",
"box.",
"box_",
"boxen",
"bracket",
"branch",
"bridge",
"browser",
"brunch",
"buffer",
"bug-",
"bug.",
"bug_",
"build",
"builder",
"building",
"buildout",
"buildpack",
"built",
"bundle",
"busines",
"but-",
"but.",
"but_",
"button",
"cache",
"caching",
"cakephp",
"calendar",
"call",
"camera",
"campfire",
"can-",
"can.",
"can_",
"canva",
"captcha",
"capture",
"card",
"carousel",
"case",
"cassandra",
"cat-",
"cat.",
"cat_",
"category",
"center",
"cento",
"challenge",
"change",
"changelog",
"channel",
"chart",
"chat",
"cheat",
"check",
"checker",
"chef",
"ches",
"chinese",
"chosen",
"chrome",
"ckeditor",
"clas",
"classe",
"classic",
"clean",
"cli-",
"cli.",
"cli_",
"client",
"clojure",
"clone",
"closure",
"cloud",
"club",
"cluster",
"cms-",
"cms_",
"coco",
"code",
"coding",
"coffee",
"color",
"combination",
"combo",
"command",
"commander",
"comment",
"commit",
"common",
"community",
"compas",
"compiler",
"complete",
"component",
"composer",
"computer",
"computing",
"con-",
"con.",
"con_",
"concept",
"conf",
"config",
"connect",
"connector",
"console",
"contact",
"container",
"contao",
"content",
"contest",
"context",
"control",
"convert",
"converter",
"conway'",
"cookbook",
"cookie",
"cool",
"copy",
"cordova",
"core",
"couchbase",
"couchdb",
"countdown",
"counter",
"course",
"craft",
"crawler",
"create",
"creating",
"creator",
"credential",
"crm-",
"crm.",
"crm_",
"cros",
"crud",
"csv-",
"csv.",
"csv_",
"cube",
"cucumber",
"cuda",
"current",
"currently",
"custom",
"daemon",
"dark",
"dart",
"dash",
"dashboard",
"data",
"database",
"date",
"day-",
"day.",
"day_",
"dead",
"debian",
"debug",
"debugger",
"deck",
"define",
"del-",
"del.",
"del_",
"delete",
"demo",
"deploy",
"design",
"designer",
"desktop",
"detection",
"detector",
"dev-",
"dev.",
"dev_",
"develop",
"developer",
"device",
"devise",
"diff",
"digital",
"directive",
"directory",
"discovery",
"display",
"django",
"dns-",
"dns_",
"doc-",
"doc.",
"doc_",
"docker",
"docpad",
"doctrine",
"document",
"doe-",
"doe.",
"doe_",
"dojo",
"dom-",
"dom.",
"dom_",
"domain",
"don't",
"done",
"dot-",
"dot.",
"dot_",
"dotfile",
"download",
"draft",
"drag",
"drill",
"drive",
"driven",
"driver",
"drop",
"dropbox",
"drupal",
"dsl-",
"dsl.",
"dsl_",
"dynamic",
"easy",
"ecdsa",
"eclipse",
"edit",
"editing",
"edition",
"editor",
"element",
"emac",
"email",
"embed",
"embedded",
"ember",
"emitter",
"emulator",
"encoding",
"endpoint",
"engine",
"english",
"enhanced",
"entity",
"entry",
"env_",
"episode",
"erlang",
"error",
"espresso",
"event",
"evented",
"example",
"exchange",
"exercise",
"experiment",
"expire",
"exploit",
"explorer",
"export",
"exporter",
"expres",
"ext-",
"ext.",
"ext_",
"extended",
"extension",
"external",
"extra",
"extractor",
"fabric",
"facebook",
"factory",
"fake",
"fast",
"feature",
"feed",
"fewfwef",
"ffmpeg",
"field",
"file",
"filter",
"find",
"finder",
"firefox",
"firmware",
"first",
"fish",
"fix-",
"fix_",
"flash",
"flask",
"flat",
"flex",
"flexible",
"flickr",
"flow",
"fluent",
"fluentd",
"fluid",
"folder",
"font",
"force",
"foreman",
"fork",
"form",
"format",
"formatter",
"forum",
"foundry",
"framework",
"free",
"friend",
"friendly",
"front-end",
"frontend",
"ftp-",
"ftp.",
"ftp_",
"fuel",
"full",
"fun-",
"fun.",
"fun_",
"func",
"future",
"gaia",
"gallery",
"game",
"gateway",
"gem-",
"gem.",
"gem_",
"gen-",
"gen.",
"gen_",
"general",
"generator",
"generic",
"genetic",
"get-",
"get.",
"get_",
"getenv",
"getting",
"ghost",
"gist",
"git-",
"git.",
"git_",
"github",
"gitignore",
"gitlab",
"glas",
"gmail",
"gnome",
"gnu-",
"gnu.",
"gnu_",
"goal",
"golang",
"gollum",
"good",
"google",
"gpu-",
"gpu.",
"gpu_",
"gradle",
"grail",
"graph",
"graphic",
"great",
"grid",
"groovy",
"group",
"grunt",
"guard",
"gui-",
"gui.",
"gui_",
"guide",
"guideline",
"gulp",
"gwt-",
"gwt.",
"gwt_",
"hack",
"hackathon",
"hacker",
"hacking",
"hadoop",
"haml",
"handler",
"hardware",
"has-",
"has_",
"hash",
"haskell",
"have",
"haxe",
"hello",
"help",
"helper",
"here",
"hero",
"heroku",
"high",
"hipchat",
"history",
"home",
"homebrew",
"homepage",
"hook",
"host",
"hosting",
"hot-",
"hot.",
"hot_",
"house",
"how-",
"how.",
"how_",
"html",
"http",
"hub-",
"hub.",
"hub_",
"hubot",
"human",
"icon",
"ide-",
"ide.",
"ide_",
"idea",
"identity",
"idiomatic",
"image",
"impact",
"import",
"important",
"importer",
"impres",
"index",
"infinite",
"info",
"injection",
"inline",
"input",
"inside",
"inspector",
"instagram",
"install",
"installer",
"instant",
"intellij",
"interface",
"internet",
"interview",
"into",
"intro",
"ionic",
"iphone",
"ipython",
"irc-",
"irc_",
"iso-",
"iso.",
"iso_",
"issue",
"jade",
"jasmine",
"java",
"jbos",
"jekyll",
"jenkin",
"jetbrains",
"job-",
"job.",
"job_",
"joomla",
"jpa-",
"jpa.",
"jpa_",
"jquery",
"json",
"just",
"kafka",
"karma",
"kata",
"kernel",
"keyboard",
"kindle",
"kit-",
"kit.",
"kit_",
"kitchen",
"knife",
"koan",
"kohana",
"lab-",
"lab.",
"lab_",
"lambda",
"lamp",
"language",
"laravel",
"last",
"latest",
"latex",
"launcher",
"layer",
"layout",
"lazy",
"ldap",
"leaflet",
"league",
"learn",
"learning",
"led-",
"led.",
"led_",
"leetcode",
"les-",
"les.",
"les_",
"level",
"leveldb",
"lib-",
"lib.",
"lib_",
"librarie",
"library",
"license",
"life",
"liferay",
"light",
"lightbox",
"like",
"line",
"link",
"linked",
"linkedin",
"linux",
"lisp",
"list",
"lite",
"little",
"load",
"loader",
"local",
"location",
"lock",
"log-",
"log.",
"log_",
"logger",
"logging",
"logic",
"login",
"logstash",
"longer",
"look",
"love",
"lua-",
"lua.",
"lua_",
"mac-",
"mac.",
"mac_",
"machine",
"made",
"magento",
"magic",
"mail",
"make",
"maker",
"making",
"man-",
"man.",
"man_",
"manage",
"manager",
"manifest",
"manual",
"map-",
"map.",
"map_",
"mapper",
"mapping",
"markdown",
"markup",
"master",
"math",
"matrix",
"maven",
"md5",
"mean",
"media",
"mediawiki",
"meetup",
"memcached",
"memory",
"menu",
"merchant",
"message",
"messaging",
"meta",
"metadata",
"meteor",
"method",
"metric",
"micro",
"middleman",
"migration",
"minecraft",
"miner",
"mini",
"minimal",
"mirror",
"mit-",
"mit.",
"mit_",
"mobile",
"mocha",
"mock",
"mod-",
"mod.",
"mod_",
"mode",
"model",
"modern",
"modular",
"module",
"modx",
"money",
"mongo",
"mongodb",
"mongoid",
"mongoose",
"monitor",
"monkey",
"more",
"motion",
"moved",
"movie",
"mozilla",
"mqtt",
"mule",
"multi",
"multiple",
"music",
"mustache",
"mvc-",
"mvc.",
"mvc_",
"mysql",
"nagio",
"name",
"native",
"need",
"neo-",
"neo.",
"neo_",
"nest",
"nested",
"net-",
"net.",
"net_",
"nette",
"network",
"new-",
"new.",
"new_",
"next",
"nginx",
"ninja",
"nlp-",
"nlp.",
"nlp_",
"node",
"nodej",
"nosql",
"not-",
"not.",
"not_",
"note",
"notebook",
"notepad",
"notice",
"notifier",
"now-",
"now.",
"now_",
"number",
"oauth",
"object",
"objective",
"obsolete",
"ocaml",
"octopres",
"official",
"old-",
"old.",
"old_",
"onboard",
"online",
"only",
"open",
"opencv",
"opengl",
"openshift",
"openwrt",
"option",
"oracle",
"org-",
"org.",
"org_",
"origin",
"original",
"orm-",
"orm.",
"orm_",
"osx-",
"osx_",
"our-",
"our.",
"our_",
"out-",
"out.",
"out_",
"output",
"over",
"overview",
"own-",
"own.",
"own_",
"pack",
"package",
"packet",
"page",
"panel",
"paper",
"paperclip",
"para",
"parallax",
"parallel",
"parse",
"parser",
"parsing",
"particle",
"party",
"password",
"patch",
"path",
"pattern",
"payment",
"paypal",
"pdf-",
"pdf.",
"pdf_",
"pebble",
"people",
"perl",
"personal",
"phalcon",
"phoenix",
"phone",
"phonegap",
"photo",
"php-",
"php.",
"php_",
"physic",
"picker",
"pipeline",
"platform",
"play",
"player",
"please",
"plu-",
"plu.",
"plu_",
"plug-in",
"plugin",
"plupload",
"png-",
"png.",
"png_",
"poker",
"polyfill",
"polymer",
"pool",
"pop-",
"pop.",
"pop_",
"popcorn",
"popup",
"port",
"portable",
"portal",
"portfolio",
"post",
"power",
"powered",
"powerful",
"prelude",
"pretty",
"preview",
"principle",
"print",
"pro-",
"pro.",
"pro_",
"problem",
"proc",
"product",
"profile",
"profiler",
"program",
"progres",
"project",
"protocol",
"prototype",
"provider",
"proxy",
"public",
"pull",
"puppet",
"pure",
"purpose",
"push",
"pusher",
"pyramid",
"python",
"quality",
"query",
"queue",
"quick",
"rabbitmq",
"rack",
"radio",
"rail",
"railscast",
"random",
"range",
"raspberry",
"rdf-",
"rdf.",
"rdf_",
"react",
"reactive",
"read",
"reader",
"readme",
"ready",
"real",
"real-time",
"reality",
"realtime",
"recipe",
"recorder",
"red-",
"red.",
"red_",
"reddit",
"redi",
"redmine",
"reference",
"refinery",
"refresh",
"registry",
"related",
"release",
"remote",
"rendering",
"repo",
"report",
"request",
"require",
"required",
"requirej",
"research",
"resource",
"response",
"resque",
"rest",
"restful",
"resume",
"reveal",
"reverse",
"review",
"riak",
"rich",
"right",
"ring",
"robot",
"role",
"room",
"router",
"routing",
"rpc-",
"rpc.",
"rpc_",
"rpg-",
"rpg.",
"rpg_",
"rspec",
"ruby-",
"ruby.",
"ruby_",
"rule",
"run-",
"run.",
"run_",
"runner",
"running",
"runtime",
"rust",
"rvm-",
"rvm.",
"rvm_",
"salt",
"sample",
"sandbox",
"sas-",
"sas.",
"sas_",
"sbt-",
"sbt.",
"sbt_",
"scala",
"scalable",
"scanner",
"schema",
"scheme",
"school",
"science",
"scraper",
"scratch",
"screen",
"script",
"scroll",
"scs-",
"scs.",
"scs_",
"sdk-",
"sdk.",
"sdk_",
"sdl-",
"sdl.",
"sdl_",
"search",
"secure",
"security",
"see-",
"see.",
"see_",
"seed",
"select",
"selector",
"selenium",
"semantic",
"sencha",
"send",
"sentiment",
"serie",
"server",
"service",
"session",
"set-",
"set.",
"set_",
"setting",
"setup",
"sha1",
"sha2",
"sha256",
"share",
"shared",
"sharing",
"sheet",
"shell",
"shield",
"shipping",
"shop",
"shopify",
"shortener",
"should",
"show",
"showcase",
"side",
"silex",
"simple",
"simulator",
"single",
"site",
"skeleton",
"sketch",
"skin",
"slack",
"slide",
"slider",
"slim",
"small",
"smart",
"smtp",
"snake",
"snapshot",
"snippet",
"soap",
"social",
"socket",
"software",
"solarized",
"solr",
"solution",
"solver",
"some",
"soon",
"source",
"space",
"spark",
"spatial",
"spec",
"sphinx",
"spine",
"spotify",
"spree",
"spring",
"sprite",
"sql-",
"sql.",
"sql_",
"sqlite",
"ssh-",
"ssh.",
"ssh_",
"stack",
"staging",
"standard",
"stanford",
"start",
"started",
"starter",
"startup",
"stat",
"statamic",
"state",
"static",
"statistic",
"statsd",
"statu",
"steam",
"step",
"still",
"stm-",
"stm.",
"stm_",
"storage",
"store",
"storm",
"story",
"strategy",
"stream",
"streaming",
"string",
"stripe",
"structure",
"studio",
"study",
"stuff",
"style",
"sublime",
"sugar",
"suite",
"summary",
"super",
"support",
"supported",
"svg-",
"svg.",
"svg_",
"svn-",
"svn.",
"svn_",
"swagger",
"swift",
"switch",
"switcher",
"symfony",
"symphony",
"sync",
"synopsi",
"syntax",
"system",
"tab-",
"tab.",
"tab_",
"table",
"tag-",
"tag.",
"tag_",
"talk",
"target",
"task",
"tcp-",
"tcp.",
"tcp_",
"tdd-",
"tdd.",
"tdd_",
"team",
"tech",
"template",
"term",
"terminal",
"testing",
"tetri",
"text",
"textmate",
"theme",
"theory",
"three",
"thrift",
"time",
"timeline",
"timer",
"tiny",
"tinymce",
"tip-",
"tip.",
"tip_",
"title",
"todo",
"todomvc",
"token",
"tool",
"toolbox",
"toolkit",
"top-",
"top.",
"top_",
"tornado",
"touch",
"tower",
"tracker",
"tracking",
"traffic",
"training",
"transfer",
"translate",
"transport",
"tree",
"trello",
"try-",
"try.",
"try_",
"tumblr",
"tut-",
"tut.",
"tut_",
"tutorial",
"tweet",
"twig",
"twitter",
"type",
"typo",
"ubuntu",
"uiview",
"ultimate",
"under",
"unit",
"unity",
"universal",
"unix",
"update",
"updated",
"upgrade",
"upload",
"uploader",
"uri-",
"uri.",
"uri_",
"url-",
"url.",
"url_",
"usage",
"usb-",
"usb.",
"usb_",
"use-",
"use.",
"use_",
"used",
"useful",
"user",
"using",
"util",
"utilitie",
"utility",
"vagrant",
"validator",
"value",
"variou",
"varnish",
"version",
"via-",
"via.",
"via_",
"video",
"view",
"viewer",
"vim-",
"vim.",
"vim_",
"vimrc",
"virtual",
"vision",
"visual",
"vpn",
"want",
"warning",
"watch",
"watcher",
"wave",
"way-",
"way.",
"way_",
"weather",
"web-",
"web_",
"webapp",
"webgl",
"webhook",
"webkit",
"webrtc",
"website",
"websocket",
"welcome",
"what",
"what'",
"when",
"where",
"which",
"why-",
"why.",
"why_",
"widget",
"wifi",
"wiki",
"win-",
"win.",
"win_",
"window",
"wip-",
"wip.",
"wip_",
"within",
"without",
"wizard",
"word",
"wordpres",
"work",
"worker",
"workflow",
"working",
"workshop",
"world",
"wrapper",
"write",
"writer",
"writing",
"written",
"www-",
"www.",
"www_",
"xamarin",
"xcode",
"xml-",
"xml.",
"xml_",
"xmpp",
"xxxxxx",
"yahoo",
"yaml",
"yandex",
"yeoman",
"yet-",
"yet.",
"yet_",
"yii-",
"yii.",
"yii_",
"youtube",
"yui-",
"yui.",
"yui_",
"zend",
"zero",
"zip-",
"zip.",
"zip_",
"zsh-",
"zsh.",
"zsh_"
]
},
{
"condition": "or",
"target": "line",
"regexes": [
"--mount=type=secret,",
"import[ \\t]+\\{[ \\t\\w,]+\\}[ \\t]+from[ \\t]+['\"][^'\"]+['\"]"
],
"paths": [],
"stopwords": []
},
{
"condition": "and",
"target": "line",
"regexes": [
"LICENSE[^=]*=\\s*\"[^\"]+",
"LIC_FILES_CHKSUM[^=]*=\\s*\"[^\"]+",
"SRC[^=]*=\\s*\"[a-zA-Z0-9]+"
],
"paths": [
"\\.bb$",
"\\.bbappend$",
"\\.bbclass$",
"\\.inc$"
],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "github-app-token",
"name": "Identified a GitHub App Token, which may compromise GitHub application integrations and source code security.",
"pattern": "(?:ghu|ghs)_[0-9a-zA-Z]{36}",
"secret_group": null,
"keywords": [
"ghu_",
"ghs_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [],
"paths": [
"(?:^|/)@octokit/auth-token/README\\.md$"
],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "github-fine-grained-pat",
"name": "Found a GitHub Fine-Grained Personal Access Token, risking unauthorized repository access and code manipulation.",
"pattern": "github_pat_\\w{82}",
"secret_group": null,
"keywords": [
"github_pat_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "github-oauth",
"name": "Discovered a GitHub OAuth Access Token, posing a risk of compromised GitHub account integrations and data leaks.",
"pattern": "gho_[0-9a-zA-Z]{36}",
"secret_group": null,
"keywords": [
"gho_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "github-pat",
"name": "Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure.",
"pattern": "ghp_[0-9a-zA-Z]{36}",
"secret_group": null,
"keywords": [
"ghp_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [],
"paths": [
"(?:^|/)@octokit/auth-token/README\\.md$"
],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "github-refresh-token",
"name": "Detected a GitHub Refresh Token, which could allow prolonged unauthorized access to GitHub services.",
"pattern": "ghr_[0-9a-zA-Z]{36}",
"secret_group": null,
"keywords": [
"ghr_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-cicd-job-token",
"name": "Identified a GitLab CI/CD Job Token, potential access to projects and some APIs on behalf of a user while the CI job is running.",
"pattern": "glcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_-]{20}",
"secret_group": null,
"keywords": [
"glcbt-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-deploy-token",
"name": "Identified a GitLab Deploy Token, risking access to repositories, packages and containers with write access.",
"pattern": "gldt-[0-9a-zA-Z_\\-]{20}",
"secret_group": null,
"keywords": [
"gldt-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-feature-flag-client-token",
"name": "Identified a GitLab feature flag client token, risks exposing user lists and features flags used by an application.",
"pattern": "glffct-[0-9a-zA-Z_\\-]{20}",
"secret_group": null,
"keywords": [
"glffct-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-feed-token",
"name": "Identified a GitLab feed token, risking exposure of user data.",
"pattern": "glft-[0-9a-zA-Z_\\-]{20}",
"secret_group": null,
"keywords": [
"glft-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-incoming-mail-token",
"name": "Identified a GitLab incoming mail token, risking manipulation of data sent by mail.",
"pattern": "glimt-[0-9a-zA-Z_\\-]{25}",
"secret_group": null,
"keywords": [
"glimt-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-kubernetes-agent-token",
"name": "Identified a GitLab Kubernetes Agent token, risking access to repos and registry of projects connected via agent.",
"pattern": "glagent-[0-9a-zA-Z_\\-]{50}",
"secret_group": null,
"keywords": [
"glagent-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-oauth-app-secret",
"name": "Identified a GitLab OIDC Application Secret, risking access to apps using GitLab as authentication provider.",
"pattern": "gloas-[0-9a-zA-Z_\\-]{64}",
"secret_group": null,
"keywords": [
"gloas-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-pat",
"name": "Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure.",
"pattern": "glpat-[\\w-]{20}",
"secret_group": null,
"keywords": [
"glpat-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-pat-routable",
"name": "Identified a GitLab Personal Access Token (routable), risking unauthorized access to GitLab repositories and codebase exposure.",
"pattern": "\\bglpat-[0-9a-zA-Z_-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b",
"secret_group": null,
"keywords": [
"glpat-"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-ptt",
"name": "Found a GitLab Pipeline Trigger Token, potentially compromising continuous integration workflows and project security.",
"pattern": "glptt-[0-9a-f]{40}",
"secret_group": null,
"keywords": [
"glptt-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-rrt",
"name": "Discovered a GitLab Runner Registration Token, posing a risk to CI/CD pipeline integrity and unauthorized access.",
"pattern": "GR1348941[\\w-]{20}",
"secret_group": null,
"keywords": [
"gr1348941"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-runner-authentication-token",
"name": "Discovered a GitLab Runner Authentication Token, posing a risk to CI/CD pipeline integrity and unauthorized access.",
"pattern": "glrt-[0-9a-zA-Z_\\-]{20}",
"secret_group": null,
"keywords": [
"glrt-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-runner-authentication-token-routable",
"name": "Discovered a GitLab Runner Authentication Token (Routable), posing a risk to CI/CD pipeline integrity and unauthorized access.",
"pattern": "\\bglrt-t\\d_[0-9a-zA-Z_\\-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b",
"secret_group": null,
"keywords": [
"glrt-"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-scim-token",
"name": "Discovered a GitLab SCIM Token, posing a risk to unauthorized access for a organization or instance.",
"pattern": "glsoat-[0-9a-zA-Z_\\-]{20}",
"secret_group": null,
"keywords": [
"glsoat-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitlab-session-cookie",
"name": "Discovered a GitLab Session Cookie, posing a risk to unauthorized access to a user account.",
"pattern": "_gitlab_session=[0-9a-z]{32}",
"secret_group": null,
"keywords": [
"_gitlab_session="
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gitter-access-token",
"name": "Uncovered a Gitter Access Token, which may lead to unauthorized access to chat and communication services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:gitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"gitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "gocardless-api-token",
"name": "Detected a GoCardless API token, potentially risking unauthorized direct debit payment operations and financial data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:gocardless)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(live_(?i)[a-z0-9\\-_=]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"live_",
"gocardless"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "grafana-api-key",
"name": "Identified a Grafana API key, which could compromise monitoring dashboards and sensitive data analytics.",
"pattern": "(?i)\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"eyjrijoi"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "grafana-cloud-api-token",
"name": "Found a Grafana cloud API token, risking unauthorized access to cloud-based monitoring services and data exposure.",
"pattern": "(?i)\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"glc_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "grafana-service-account-token",
"name": "Discovered a Grafana service account token, posing a risk of compromised monitoring services and data integrity.",
"pattern": "(?i)\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"glsa_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "harness-api-key",
"name": "Identified a Harness Access Token (PAT or SAT), risking unauthorized access to a Harness account.",
"pattern": "(?:pat|sat)\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}",
"secret_group": null,
"keywords": [
"pat.",
"sat."
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "hashicorp-tf-api-token",
"name": "Uncovered a HashiCorp Terraform user/org API token, which may lead to unauthorized infrastructure management and security breaches.",
"pattern": "(?i)[a-z0-9]{14}\\.(?-i:atlasv1)\\.[a-z0-9\\-_=]{60,70}",
"secret_group": null,
"keywords": [
"atlasv1"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "hashicorp-tf-password",
"name": "Identified a HashiCorp Terraform password field, risking unauthorized infrastructure configuration and security breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:administrator_login_password|password)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(\"[a-z0-9=_\\-]{8,20}\")(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"administrator_login_password",
"password"
],
"min_entropy": 2,
"confidence": "medium",
"path": "(?i)\\.(?:tf|hcl)$",
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "heroku-api-key",
"name": "Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:heroku)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"heroku"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "heroku-api-key-v2",
"name": "Detected a Heroku API Key, potentially compromising cloud application deployments and operational security.",
"pattern": "\\b((HRKU-AA[0-9a-zA-Z_-]{58}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"hrku-aa"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "hubspot-api-key",
"name": "Found a HubSpot API Token, posing a risk to CRM data integrity and unauthorized marketing operations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:hubspot)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"hubspot"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "huggingface-access-token",
"name": "Discovered a Hugging Face Access token, which could lead to unauthorized access to AI models and sensitive data.",
"pattern": "\\b(hf_(?i:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"hf_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "huggingface-organization-api-token",
"name": "Uncovered a Hugging Face Organization API token, potentially compromising AI organization accounts and associated data.",
"pattern": "\\b(api_org_(?i:[a-z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"api_org_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "infracost-api-token",
"name": "Detected an Infracost API Token, risking unauthorized access to cloud cost estimation tools and financial data.",
"pattern": "\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"ico-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "intercom-api-key",
"name": "Identified an Intercom API Token, which could compromise customer communication channels and data privacy.",
"pattern": "(?i)[\\w.-]{0,50}?(?:intercom)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{60})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"intercom"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "intra42-client-secret",
"name": "Found a Intra42 client secret, which could lead to unauthorized access to the 42School API and sensitive data.",
"pattern": "\\b(s-s4t2(?:ud|af)-(?i)[abcdef0123456789]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"intra",
"s-s4t2ud-",
"s-s4t2af-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "jfrog-api-key",
"name": "Found a JFrog API Key, posing a risk of unauthorized access to software artifact repositories and build pipelines.",
"pattern": "(?i)[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{73})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"jfrog",
"artifactory",
"bintray",
"xray"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "jfrog-identity-token",
"name": "Discovered a JFrog Identity Token, potentially compromising access to JFrog services and sensitive software artifacts.",
"pattern": "(?i)[\\w.-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"jfrog",
"artifactory",
"bintray",
"xray"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "jwt",
"name": "Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.",
"pattern": "\\b(ey[a-zA-Z0-9]{17,}\\.ey[a-zA-Z0-9\\/\\\\_-]{17,}\\.(?:[a-zA-Z0-9\\/\\\\_-]{10,}={0,2})?)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"ey"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "jwt-base64",
"name": "Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information.",
"pattern": "\\bZXlK(?:(?P<alg>aGJHY2lPaU)|(?P<apu>aGNIVWlPaU)|(?P<apv>aGNIWWlPaU)|(?P<aud>aGRXUWlPaU)|(?P<b64>aU5qUWlP)|(?P<crit>amNtbDBJanBi)|(?P<cty>amRIa2lPaU)|(?P<epk>bGNHc2lPbn)|(?P<enc>bGJtTWlPaU)|(?P<jku>cWEzVWlPaU)|(?P<jwk>cWQyc2lPb)|(?P<iss>cGMzTWlPaU)|(?P<iv>cGRpSTZJ)|(?P<kid>cmFXUWlP)|(?P<key_ops>clpYbGZiM0J6SWpwY)|(?P<kty>cmRIa2lPaUp)|(?P<nonce>dWIyNWpaU0k2)|(?P<p2c>d01tTWlP)|(?P<p2s>d01uTWlPaU)|(?P<ppt>d2NIUWlPaU)|(?P<sub>emRXSWlPaU)|(?P<svt>emRuUWlP)|(?P<tag>MFlXY2lPaU)|(?P<typ>MGVYQWlPaUp)|(?P<url>MWNtd2l)|(?P<use>MWMyVWlPaUp)|(?P<ver>MlpYSWlPaU)|(?P<version>MlpYSnphVzl1SWpv)|(?P<x>NElqb2)|(?P<x5c>NE5XTWlP)|(?P<x5t>NE5YUWlPaU)|(?P<x5ts256>NE5YUWpVekkxTmlJNkl)|(?P<x5u>NE5YVWlPaU)|(?P<zip>NmFYQWlPaU))[a-zA-Z0-9\\/\\\\_+\\-\\r\\n]{40,}={0,2}",
"secret_group": null,
"keywords": [
"zxlk"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "kraken-access-token",
"name": "Identified a Kraken Access Token, potentially compromising cryptocurrency trading accounts and financial security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:kraken)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9\\/=_\\+\\-]{80,90})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"kraken"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "kubernetes-secret-yaml",
"name": "Possible Kubernetes Secret detected, posing a risk of leaking credentials/tokens from your deployments",
"pattern": "(?i)(?:\\bkind:[ \\t]*[\"']?\\bsecret\\b[\"']?(?s:.){0,200}?\\bdata:(?s:.){0,100}?\\s+([\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:[\"']?[a-z0-9+/]{10,}={0,3}[\"']?|\\{\\{[ \\t\\w\"|$:=,.-]+\\}\\}|\"\"|''))|\\bdata:(?s:.){0,100}?\\s+([\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:[\"']?[a-z0-9+/]{10,}={0,3}[\"']?|\\{\\{[ \\t\\w\"|$:=,.-]+\\}\\}|\"\"|''))(?s:.){0,200}?\\bkind:[ \\t]*[\"']?\\bsecret\\b[\"']?)",
"secret_group": null,
"keywords": [
"secret"
],
"min_entropy": 0,
"confidence": "medium",
"path": "(?i)\\.ya?ml$",
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"[\\w.-]+:(?:[ \\t]*(?:\\||>[-+]?)\\s+)?[ \\t]*(?:\\{\\{[ \\t\\w\"|$:=,.-]+\\}\\}|\"\"|'')"
],
"paths": [],
"stopwords": []
},
{
"condition": "or",
"target": "match",
"regexes": [
"(kind:(?s:.)+\\n---\\n(?s:.)+\\bdata:|data:(?s:.)+\\n---\\n(?s:.)+\\bkind:)"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "kucoin-access-token",
"name": "Found a Kucoin Access Token, risking unauthorized access to cryptocurrency exchange services and transactions.",
"pattern": "(?i)[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"kucoin"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "kucoin-secret-key",
"name": "Discovered a Kucoin Secret Key, which could lead to compromised cryptocurrency operations and financial data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:kucoin)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"kucoin"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "launchdarkly-access-token",
"name": "Uncovered a Launchdarkly Access Token, potentially compromising feature flag management and application functionality.",
"pattern": "(?i)[\\w.-]{0,50}?(?:launchdarkly)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"launchdarkly"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "linear-api-key",
"name": "Detected a Linear API Token, posing a risk to project management tools and sensitive task data.",
"pattern": "lin_api_(?i)[a-z0-9]{40}",
"secret_group": null,
"keywords": [
"lin_api_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "linear-client-secret",
"name": "Identified a Linear Client Secret, which may compromise secure integrations and sensitive project management data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:linear)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"linear"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "linkedin-client-id",
"name": "Found a LinkedIn Client ID, risking unauthorized access to LinkedIn integrations and professional data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{14})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"linkedin",
"linked_in",
"linked-in"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "linkedin-client-secret",
"name": "Discovered a LinkedIn Client secret, potentially compromising LinkedIn application integrations and user data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:linked[_-]?in)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"linkedin",
"linked_in",
"linked-in"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "lob-api-key",
"name": "Uncovered a Lob API Key, which could lead to unauthorized access to mailing and address verification services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((live|test)_[a-f0-9]{35})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"test_",
"live_"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "lob-pub-api-key",
"name": "Detected a Lob Publishable API Key, posing a risk of exposing mail and print service integrations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:lob)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((test|live)_pub_[a-f0-9]{31})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"test_pub",
"live_pub",
"_pub"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "looker-client-id",
"name": "Found a Looker Client ID, risking unauthorized access to a Looker account and exposing sensitive data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"looker"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "looker-client-secret",
"name": "Found a Looker Client Secret, risking unauthorized access to a Looker account and exposing sensitive data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:looker)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"looker"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mailchimp-api-key",
"name": "Identified a Mailchimp API key, potentially compromising email marketing campaigns and subscriber data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:MailchimpSDK.initialize|mailchimp)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32}-us\\d\\d)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mailchimp"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mailgun-private-api-token",
"name": "Found a Mailgun private API token, risking unauthorized email service operations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(key-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mailgun"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mailgun-pub-key",
"name": "Discovered a Mailgun public validation key, which could expose email verification processes and associated data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pubkey-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mailgun"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mailgun-signing-key",
"name": "Uncovered a Mailgun webhook signing key, potentially compromising email automation and data integrity.",
"pattern": "(?i)[\\w.-]{0,50}?(?:mailgun)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mailgun"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mapbox-api-token",
"name": "Detected a MapBox API token, posing a risk to geospatial services and sensitive location data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:mapbox)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pk\\.[a-z0-9]{60}\\.[a-z0-9]{22})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mapbox"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "mattermost-access-token",
"name": "Identified a Mattermost Access Token, which may compromise team communication channels and data privacy.",
"pattern": "(?i)[\\w.-]{0,50}?(?:mattermost)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"mattermost"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "maxmind-license-key",
"name": "Discovered a potential MaxMind license key.",
"pattern": "\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"_mmk"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "messagebird-api-token",
"name": "Found a MessageBird API token, risking unauthorized access to communication platforms and message data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"messagebird",
"message-bird",
"message_bird"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "messagebird-client-id",
"name": "Discovered a MessageBird client ID, potentially compromising API integrations and sensitive communication data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:message[_-]?bird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"messagebird",
"message-bird",
"message_bird"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "microsoft-teams-webhook",
"name": "Uncovered a Microsoft Teams Webhook, which could lead to unauthorized access to team collaboration tools and data leaks.",
"pattern": "https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}",
"secret_group": null,
"keywords": [
"webhook.office.com",
"webhookb2",
"incomingwebhook"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "netlify-access-token",
"name": "Detected a Netlify Access Token, potentially compromising web hosting services and site management.",
"pattern": "(?i)[\\w.-]{0,50}?(?:netlify)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40,46})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"netlify"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "new-relic-browser-api-token",
"name": "Identified a New Relic ingest browser API token, risking unauthorized access to application performance data and analytics.",
"pattern": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRJS-[a-f0-9]{19})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"nrjs-"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "new-relic-insert-key",
"name": "Discovered a New Relic insight insert key, compromising data injection into the platform.",
"pattern": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRII-[a-z0-9-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"nrii-"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "new-relic-user-api-id",
"name": "Found a New Relic user API ID, posing a risk to application monitoring services and data integrity.",
"pattern": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"new-relic",
"newrelic",
"new_relic"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "new-relic-user-api-key",
"name": "Discovered a New Relic user API Key, which could lead to compromised application insights and performance monitoring.",
"pattern": "(?i)[\\w.-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRAK-[a-z0-9]{27})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"nrak"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "notion-api-token",
"name": "Notion API token",
"pattern": "\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"ntn_"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "npm-access-token",
"name": "Uncovered an npm access token, potentially compromising package management and code repository access.",
"pattern": "(?i)\\b(npm_[a-z0-9]{36})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"npm_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "nuget-config-password",
"name": "Identified a password within a Nuget config file, potentially compromising package management access.",
"pattern": "(?i)<add key=\\\"(?:(?:ClearText)?Password)\\\"\\s*value=\\\"(.{8,})\\\"\\s*/>",
"secret_group": null,
"keywords": [
"<add key="
],
"min_entropy": 1,
"confidence": "medium",
"path": "(?i)nuget\\.config$",
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"33f!!lloppa",
"hal\\+9ooo_da!sY",
"^\\%\\S.*\\%$"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "nytimes-access-token",
"name": "Detected a Nytimes Access Token, risking unauthorized access to New York Times APIs and content services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:nytimes|new-york-times,|newyorktimes)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"nytimes",
"new-york-times",
"newyorktimes"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "octopus-deploy-api-key",
"name": "Discovered a potential Octopus Deploy API key, risking application deployments and operational security.",
"pattern": "\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"api-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "okta-access-token",
"name": "Identified an Okta Access Token, which may compromise identity management services and user authentication data.",
"pattern": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:(?-i:[Oo]kta|OKTA))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(00[\\w=\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"okta"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "openai-api-key",
"name": "Found an OpenAI API Key, posing a risk of unauthorized access to AI services and data manipulation.",
"pattern": "\\b(sk-(?:proj|svcacct|admin)-(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})T3BlbkFJ(?:[A-Za-z0-9_-]{74}|[A-Za-z0-9_-]{58})\\b|sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"t3blbkfj"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "openshift-user-token",
"name": "Found an OpenShift user token, potentially compromising an OpenShift/Kubernetes cluster.",
"pattern": "\\b(sha256~[\\w-]{43})(?:[^\\w-]|\\z)",
"secret_group": null,
"keywords": [
"sha256~"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "perplexity-api-key",
"name": "Detected a Perplexity API key, which could lead to unauthorized access to Perplexity AI services and data exposure.",
"pattern": "\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$|\\b)",
"secret_group": null,
"keywords": [
"pplx-"
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "plaid-api-token",
"name": "Discovered a Plaid API Token, potentially compromising financial data aggregation and banking services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"plaid"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "plaid-client-id",
"name": "Uncovered a Plaid Client ID, which could lead to unauthorized financial service integrations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"plaid"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "plaid-secret-key",
"name": "Detected a Plaid Secret key, risking unauthorized access to financial accounts and sensitive transaction data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:plaid)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"plaid"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "planetscale-api-token",
"name": "Identified a PlanetScale API token, potentially compromising database management and operations.",
"pattern": "\\b(pscale_tkn_(?i)[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pscale_tkn_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "planetscale-oauth-token",
"name": "Found a PlanetScale OAuth token, posing a risk to database access control and sensitive data integrity.",
"pattern": "\\b(pscale_oauth_[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pscale_oauth_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "planetscale-password",
"name": "Discovered a PlanetScale password, which could lead to unauthorized database operations and data breaches.",
"pattern": "(?i)\\b(pscale_pw_(?i)[\\w=\\.-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pscale_pw_"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "postman-api-token",
"name": "Uncovered a Postman API token, potentially compromising API testing and development workflows.",
"pattern": "\\b(PMAK-(?i)[a-f0-9]{24}\\-[a-f0-9]{34})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pmak-"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "prefect-api-token",
"name": "Detected a Prefect API token, risking unauthorized access to workflow management and automation services.",
"pattern": "\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pnu_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "private-key",
"name": "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.",
"pattern": "(?i)-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S-]{64,}?KEY(?: BLOCK)?-----",
"secret_group": null,
"keywords": [
"-----begin"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "privateai-api-token",
"name": "Identified a PrivateAI Token, posing a risk of unauthorized access to AI services and data manipulation.",
"pattern": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:private[_-]?ai)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"privateai",
"private_ai",
"private-ai"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "pulumi-api-token",
"name": "Found a Pulumi API token, posing a risk to infrastructure as code services and cloud resource management.",
"pattern": "\\b(pul-[a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"pul-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "pypi-upload-token",
"name": "Discovered a PyPI upload token, potentially compromising Python package distribution and repository integrity.",
"pattern": "pypi-AgEIcHlwaS5vcmc[\\w-]{50,1000}",
"secret_group": null,
"keywords": [
"pypi-ageichlwas5vcmc"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "rapidapi-access-token",
"name": "Uncovered a RapidAPI Access Token, which could lead to unauthorized access to various APIs and data services.",
"pattern": "(?i)[\\w.-]{0,50}?(?:rapidapi)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_-]{50})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"rapidapi"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "readme-api-token",
"name": "Detected a Readme API token, risking unauthorized documentation management and content exposure.",
"pattern": "\\b(rdme_[a-z0-9]{70})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"rdme_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "rubygems-api-token",
"name": "Identified a Rubygem API token, potentially compromising Ruby library distribution and package management.",
"pattern": "\\b(rubygems_[a-f0-9]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"rubygems_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "scalingo-api-token",
"name": "Found a Scalingo API token, posing a risk to cloud platform services and application deployment security.",
"pattern": "\\b(tk-us-[\\w-]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"tk-us-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sendbird-access-id",
"name": "Discovered a Sendbird Access ID, which could compromise chat and messaging platform integrations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:sendbird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sendbird"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sendbird-access-token",
"name": "Uncovered a Sendbird Access Token, potentially risking unauthorized access to communication services and user data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:sendbird)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sendbird"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sendgrid-api-token",
"name": "Detected a SendGrid API token, posing a risk of unauthorized email service operations and data exposure.",
"pattern": "\\b(SG\\.(?i)[a-z0-9=_\\-\\.]{66})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sg."
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sendinblue-api-token",
"name": "Identified a Sendinblue API token, which may compromise email marketing services and subscriber data privacy.",
"pattern": "\\b(xkeysib-[a-f0-9]{64}\\-(?i)[a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"xkeysib-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sentry-access-token",
"name": "Found a Sentry.io Access Token (old format), risking unauthorized access to error tracking services and sensitive application data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:sentry)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sentry"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sentry-org-token",
"name": "Found a Sentry.io Organization Token, risking unauthorized access to error tracking services and sensitive application data.",
"pattern": "\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|\\z)",
"secret_group": null,
"keywords": [
"sntrys_eyjpyxqio"
],
"min_entropy": 4.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sentry-user-token",
"name": "Found a Sentry.io User Token, risking unauthorized access to error tracking services and sensitive application data.",
"pattern": "\\b(sntryu_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sntryu_"
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "settlemint-application-access-token",
"name": "Found a Settlemint Application Access Token.",
"pattern": "\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sm_aat"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "settlemint-personal-access-token",
"name": "Found a Settlemint Personal Access Token.",
"pattern": "\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sm_pat"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "settlemint-service-access-token",
"name": "Found a Settlemint Service Access Token.",
"pattern": "\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sm_sat"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "shippo-api-token",
"name": "Discovered a Shippo API token, potentially compromising shipping services and customer order data.",
"pattern": "\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"shippo_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "shopify-access-token",
"name": "Uncovered a Shopify access token, which could lead to unauthorized e-commerce platform access and data breaches.",
"pattern": "shpat_[a-fA-F0-9]{32}",
"secret_group": null,
"keywords": [
"shpat_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "shopify-custom-access-token",
"name": "Detected a Shopify custom access token, potentially compromising custom app integrations and e-commerce data security.",
"pattern": "shpca_[a-fA-F0-9]{32}",
"secret_group": null,
"keywords": [
"shpca_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "shopify-private-app-access-token",
"name": "Identified a Shopify private app access token, risking unauthorized access to private app data and store operations.",
"pattern": "shppa_[a-fA-F0-9]{32}",
"secret_group": null,
"keywords": [
"shppa_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "shopify-shared-secret",
"name": "Found a Shopify shared secret, posing a risk to application authentication and e-commerce platform security.",
"pattern": "shpss_[a-fA-F0-9]{32}",
"secret_group": null,
"keywords": [
"shpss_"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sidekiq-secret",
"name": "Discovered a Sidekiq Secret, which could lead to compromised background job processing and application data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:BUNDLE_ENTERPRISE__CONTRIBSYS__COM|BUNDLE_GEMS__CONTRIBSYS__COM)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{8}:[a-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"bundle_enterprise__contribsys__com",
"bundle_gems__contribsys__com"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sidekiq-sensitive-url",
"name": "Uncovered a Sidekiq Sensitive URL, potentially exposing internal job queues and sensitive operation details.",
"pattern": "(?i)\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\\/|\\#|\\?|:]|$)",
"secret_group": null,
"keywords": [
"gems.contribsys.com",
"enterprise.contribsys.com"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-app-token",
"name": "Detected a Slack App-level token, risking unauthorized access to Slack applications and workspace data.",
"pattern": "(?i)xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+",
"secret_group": null,
"keywords": [
"xapp"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-bot-token",
"name": "Identified a Slack Bot token, which may compromise bot integrations and communication channel security.",
"pattern": "xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*",
"secret_group": null,
"keywords": [
"xoxb"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-config-access-token",
"name": "Found a Slack Configuration access token, posing a risk to workspace configuration and sensitive data access.",
"pattern": "(?i)xoxe.xox[bp]-\\d-[A-Z0-9]{163,166}",
"secret_group": null,
"keywords": [
"xoxe.xoxb-",
"xoxe.xoxp-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-config-refresh-token",
"name": "Discovered a Slack Configuration refresh token, potentially allowing prolonged unauthorized access to configuration settings.",
"pattern": "(?i)xoxe-\\d-[A-Z0-9]{146}",
"secret_group": null,
"keywords": [
"xoxe-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-legacy-bot-token",
"name": "Uncovered a Slack Legacy bot token, which could lead to compromised legacy bot operations and data exposure.",
"pattern": "xoxb-[0-9]{8,14}-[a-zA-Z0-9]{18,26}",
"secret_group": null,
"keywords": [
"xoxb"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-legacy-token",
"name": "Detected a Slack Legacy token, risking unauthorized access to older Slack integrations and user data.",
"pattern": "xox[os]-\\d+-\\d+-\\d+-[a-fA-F\\d]+",
"secret_group": null,
"keywords": [
"xoxo",
"xoxs"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-legacy-workspace-token",
"name": "Identified a Slack Legacy Workspace token, potentially compromising access to workspace data and legacy features.",
"pattern": "xox[ar]-(?:\\d-)?[0-9a-zA-Z]{8,48}",
"secret_group": null,
"keywords": [
"xoxa",
"xoxr"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-user-token",
"name": "Found a Slack User token, posing a risk of unauthorized user impersonation and data access within Slack workspaces.",
"pattern": "xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34}",
"secret_group": null,
"keywords": [
"xoxp-",
"xoxe-"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "slack-webhook-url",
"name": "Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels.",
"pattern": "(?:https?://)?hooks.slack.com/(?:services|workflows|triggers)/[A-Za-z0-9+/]{43,56}",
"secret_group": null,
"keywords": [
"hooks.slack.com"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "snyk-api-token",
"name": "Uncovered a Snyk API token, potentially compromising software vulnerability scanning and code security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:snyk[_.-]?(?:(?:api|oauth)[_.-]?)?(?:key|token))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"snyk"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sonar-api-token",
"name": "Uncovered a Sonar API token, potentially compromising software vulnerability scanning and code security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:sonar[_.-]?(login|token))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((?:squ_|sqp_|sqa_)?[a-z0-9=_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": 2,
"keywords": [
"sonar"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sourcegraph-access-token",
"name": "Sourcegraph is a code search and navigation engine.",
"pattern": "(?i)\\b(\\b(sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}|sgp_[a-fA-F0-9]{40}|[a-fA-F0-9]{40})\\b)(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sgp_",
"sourcegraph"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "square-access-token",
"name": "Detected a Square Access Token, risking unauthorized payment processing and financial transaction exposure.",
"pattern": "\\b((?:EAAA|sq0atp-)[\\w-]{22,60})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sq0atp-",
"eaaa"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "squarespace-access-token",
"name": "Identified a Squarespace Access Token, which may compromise website management and content control on Squarespace.",
"pattern": "(?i)[\\w.-]{0,50}?(?:squarespace)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"squarespace"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "stripe-access-token",
"name": "Found a Stripe Access Token, posing a risk to payment processing services and sensitive financial data.",
"pattern": "\\b((?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sk_test",
"sk_live",
"sk_prod",
"rk_test",
"rk_live",
"rk_prod"
],
"min_entropy": 2,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sumologic-access-id",
"name": "Discovered a SumoLogic Access ID, potentially compromising log management services and data analytics integrity.",
"pattern": "[\\w.-]{0,50}?(?i:[\\w.-]{0,50}?(?:(?-i:[Ss]umo|SUMO))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3})(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(su[a-zA-Z0-9]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sumo"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "sumologic-access-token",
"name": "Uncovered a SumoLogic Access Token, which could lead to unauthorized access to log data and analytics insights.",
"pattern": "(?i)[\\w.-]{0,50}?(?:(?-i:[Ss]umo|SUMO))(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"sumo"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "telegram-bot-api-token",
"name": "Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram.",
"pattern": "(?i)[\\w.-]{0,50}?(?:telegr)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{5,16}:(?-i:A)[a-z0-9_\\-]{34})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"telegr"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "travisci-access-token",
"name": "Identified a Travis CI Access Token, potentially compromising continuous integration services and codebase security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:travis)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{22})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"travis"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twilio-api-key",
"name": "Found a Twilio API Key, posing a risk to communication services and sensitive customer interaction data.",
"pattern": "SK[0-9a-fA-F]{32}",
"secret_group": null,
"keywords": [
"sk"
],
"min_entropy": 3,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitch-api-token",
"name": "Discovered a Twitch API token, which could compromise streaming services and account integrations.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitch)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitch"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitter-access-secret",
"name": "Uncovered a Twitter Access Secret, potentially risking unauthorized Twitter integrations and data breaches.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{45})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitter-access-token",
"name": "Detected a Twitter Access Token, posing a risk of unauthorized account operations and social media data exposure.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{15,25}-[a-zA-Z0-9]{20,40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitter-api-key",
"name": "Identified a Twitter API Key, which may compromise Twitter application integrations and user data security.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitter-api-secret",
"name": "Found a Twitter API Secret, risking the security of Twitter app integrations and sensitive data access.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{50})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "twitter-bearer-token",
"name": "Discovered a Twitter Bearer Token, potentially compromising API access and data retrieval from Twitter.",
"pattern": "(?i)[\\w.-]{0,50}?(?:twitter)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(A{22}[a-zA-Z0-9%]{80,100})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"twitter"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "typeform-api-token",
"name": "Uncovered a Typeform API token, which could lead to unauthorized survey management and data collection.",
"pattern": "(?i)[\\w.-]{0,50}?(?:typeform)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(tfp_[a-z0-9\\-_\\.=]{59})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"tfp_"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "vault-batch-token",
"name": "Detected a Vault Batch Token, risking unauthorized access to secret management services and sensitive data.",
"pattern": "\\b(hvb\\.[\\w-]{138,300})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"hvb."
],
"min_entropy": 4,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "vault-service-token",
"name": "Identified a Vault Service Token, potentially compromising infrastructure security and access to sensitive credentials.",
"pattern": "\\b((?:hvs\\.[\\w-]{90,120}|s\\.(?i:[a-z0-9]{24})))(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"hvs.",
"s."
],
"min_entropy": 3.5,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
},
{
"condition": "or",
"target": "secret",
"regexes": [
"s\\.[A-Za-z]{24}"
],
"paths": [],
"stopwords": []
}
],
"exclude_paths": []
},
{
"id": "yandex-access-token",
"name": "Found a Yandex Access Token, posing a risk to Yandex service integrations and user data privacy.",
"pattern": "(?i)[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(t1\\.[A-Z0-9a-z_-]+[=]{0,2}\\.[A-Z0-9a-z_-]{86}[=]{0,2})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"yandex"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "yandex-api-key",
"name": "Discovered a Yandex API Key, which could lead to unauthorized access to Yandex services and data manipulation.",
"pattern": "(?i)[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(AQVN[A-Za-z0-9_\\-]{35,38})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"yandex"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "yandex-aws-access-token",
"name": "Uncovered a Yandex AWS Access Token, potentially compromising cloud resource access and data security on Yandex Cloud.",
"pattern": "(?i)[\\w.-]{0,50}?(?:yandex)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(YC[a-zA-Z0-9_\\-]{38})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"yandex"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
},
{
"id": "zendesk-secret-key",
"name": "Detected a Zendesk Secret Key, risking unauthorized access to customer support services and sensitive ticketing data.",
"pattern": "(?i)[\\w.-]{0,50}?(?:zendesk)(?:[ \\t\\w.-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)",
"secret_group": null,
"keywords": [
"zendesk"
],
"min_entropy": 0,
"confidence": "medium",
"path": null,
"allowlist": [
{
"condition": "or",
"target": "secret",
"regexes": [
"(?i)^true|false|null$",
"^(?i:a+|b+|c+|d+|e+|f+|g+|h+|i+|j+|k+|l+|m+|n+|o+|p+|q+|r+|s+|t+|u+|v+|w+|x+|y+|z+|\\*+|\\.+)$",
"^\\$(?:\\d+|\\{\\d+\\})$",
"^\\$(?:[A-Z_]+|[a-z_]+)$",
"^\\$\\{(?:[A-Z_]+|[a-z_]+)\\}$",
"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*\\}\\}$",
"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*\\}\\}$",
"^%(?:[A-Z_]+|[a-z_]+)%$",
"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$",
"^\\{\\d{0,2}\\}$",
"^@(?:[A-Z_]+|[a-z_]+)@$",
"^/Users/(?i)[a-z0-9]+/[\\w .-/]+$",
"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./-]+$"
],
"paths": [
"gitleaks\\.toml",
"(?i)\\.(?:bmp|gif|jpe?g|png|svg|tiff?)$",
"(?i)\\.(?:eot|[ot]tf|woff2?)$",
"(?i)\\.(?:docx?|xlsx?|pdf|bin|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe|gltf)$",
"go\\.(?:mod|sum|work(?:\\.sum)?)$",
"(?:^|/)vendor/modules\\.txt$",
"(?:^|/)vendor/(?:github\\.com|golang\\.org/x|google\\.golang\\.org|gopkg\\.in|istio\\.io|k8s\\.io|sigs\\.k8s\\.io)(?:/.*)?$",
"(?:^|/)gradlew(?:\\.bat)?$",
"(?:^|/)gradle\\.lockfile$",
"(?:^|/)mvnw(?:\\.cmd)?$",
"(?:^|/)\\.mvn/wrapper/MavenWrapperDownloader\\.java$",
"(?:^|/)node_modules(?:/.*)?$",
"(?:^|/)(?:deno\\.lock|npm-shrinkwrap\\.json|package-lock\\.json|pnpm-lock\\.yaml|yarn\\.lock)$",
"(?:^|/)bower_components(?:/.*)?$",
"(?:^|/)(?:angular|bootstrap|jquery(?:-?ui)?|plotly|swagger-?ui)[a-zA-Z0-9.-]*(?:\\.min)?\\.js(?:\\.map)?$",
"(?:^|/)javascript\\.json$",
"(?:^|/)(?:Pipfile|poetry)\\.lock$",
"(?i)(?:^|/)(?:v?env|virtualenv)/lib(?:64)?(?:/.*)?$",
"(?i)(?:^|/)(?:lib(?:64)?/python[23](?:\\.\\d{1,2})+|python/[23](?:\\.\\d{1,2})+/lib(?:64)?)(?:/.*)?$",
"(?i)(?:^|/)[a-z0-9_.]+-[0-9.]+\\.dist-info(?:/.+)?$",
"(?:^|/)vendor/(?:bundle|ruby)(?:/.*?)?$",
"\\.gem$",
"verification-metadata\\.xml",
"Database.refactorlog",
"(?:^|/)\\.git$"
],
"stopwords": [
"014df517-39d1-4453-b7b3-9930c563627c",
"abcdefghijklmnopqrstuvwxyz"
]
}
],
"exclude_paths": []
}
]
}