1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
# Dataiku DSS — scanner patterns for values that appear in UNSTRUCTURED dumps
# (diag.txt, stacks.txt, *.log, *_listing.txt) where field-level rules can't
# reach. The profile's structured pass handles the JSON/INI config; these
# patterns + the auto-seeded literals from that pass cover the rest.
#
# Raw single-value files (run/shared-secret.txt, config/configkey.json) are
# caught by the bare-token line rule below — a whole line that is nothing but
# a long base64/base62 blob is a secret, not prose.
# Local user password hashes (config/users.json format) — also leak into
# backend.log / audit.log on auth events.
- kind: regex
pattern: '\bpbkdf2_[a-z0-9]+:\d+:[a-f0-9]+:[a-f0-9]+\b'
category: custom:password
label: dku_pbkdf2_hash
# License signature / public-key blobs (base64, may be split across the dump).
# Keyword is non-capturing so capture group 1 is the blob the scanner replaces.
- kind: regex
pattern: '(?i)"r1(?:Sig|Pub|PubSig)"\s*:\s*"([A-Za-z0-9+/]{40,}={0,2})"'
category: auth_token
label: dku_license_blob
# Credential keyword followed by a value (covers config keys serialized into
# log lines / command output that no structured rule sees). Keyword is
# non-capturing so only the value (capture group 1) is redacted.
- kind: regex
pattern: '(?i)\b(?:password|passwd|secret|api[_-]?key|secretkey|accesskey|auth[_-]?token|bindpassword)\b["'']?\s*[:=]\s*["'']?([A-Za-z0-9+/=_\-]{8,})'
category: auth_token
label: dku_kv_credential
# A line that is nothing but a long base64/base62 token — raw secret files
# (run/shared-secret.txt, config/configkey.json) hold exactly one such line.
# 40+ chars keeps prose, paths, and short ids out; verified zero false
# positives across a full 25 MB diagnosis bundle.
- kind: regex
pattern: '(?m)^([A-Za-z0-9+/]{40,}={0,2})[ \t]*$'
category: auth_token
label: dku_bare_secret_line
# Machine hostname next to a keyword. Backup for partial-input runs (a lone
# sysctl.txt or log fed without diag.txt) — whole-bundle runs get full
# coverage from the diag.txt profile discovery, which seeds the value.
- kind: regex
pattern: '(?im)^\s*(?:HOSTNAME|kernel\.hostname)\s*=\s*([A-Za-z0-9][A-Za-z0-9._-]{3,})\s*$'
category: hostname
label: dku_hostname_kv
# DSS install / instance identifiers (base62 ids) shown in install.ini and
# license.json, echoed in diag output. Keyword non-capturing → value is group 1.
- kind: regex
pattern: '(?i)\b(?:installid|instanceId)\b["'']?\s*[:=]\s*["'']?([A-Za-z0-9]{8,})'
category: auth_token
label: dku_install_identifier
# Pass-through values: Dataiku enums, default identifiers, and placeholders that
# the structured pass might otherwise propagate as literals and over-redact.
- kind: allow
values:
- "dataiku"
- "dss"
- "DSS"
- "design"
- "automation"
- "deployer"
- "apinode"
# User profiles / source types / readability enums
- "DESIGNER"
- "EXPLORER"
- "READER"
- "DATA_SCIENTIST"
- "DATA_ANALYST"
- "LOCAL"
- "LDAP"
- "SSO"
- "GLOBAL"
- "ALL"
- "NONE"
- "administrators"
- "readers"
- "data_scientists"
# Connection types
- "Filesystem"
- "PostgreSQL"
- "Snowflake"
- "S3"
- "GCS"
- "Azure"
- "HDFS"
- "EC2"
# Common scalars / dirs
- "true"
- "false"
- "null"
- "none"
- "nil"
- "0"
- "1"
- "localhost"
- "127.0.0.1"
- "0.0.0.0"
- "::1"
- "${dip.home}"
- "managed_datasets"
- "managed_folders"
# Placeholder / example values
- "changeme"
- "CHANGE_ME"
- "YOUR_*"
- "CHANGE_*"
- "REPLACE_*"
- "ENTER_*"
- "<*>"
- "${*}"
- "{{*}}"
- "example"
- "sample"
- "placeholder"
- "example.com"
# Service-account / shared-dir usernames (DSS runs as `dataiku`, not a
# person). The user_home_path detector captures the bare username, so these
# allow `/home/dataiku` and `/home/projects` through while real user homes
# (/home/alice) are still redacted. (`dataiku` is already allowed above.)
- "projects"
# Dataiku public/vendor URLs (docs, help, license/update check) — the
# vendor's own public site, not customer data endpoints.
- "https://*.dataiku.com*"
- "https://dataiku.com*"