stakpak-shared 0.3.74

Stakpak: Your DevOps AI Agent. Generate infrastructure code, debug Kubernetes, configure CI/CD, automate deployments, without giving an LLM the keys to production.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

[[rules]]
id = "anthropic-api-key"
description = "Found an Anthropic API Key, posing a risk of unauthorized access to AI services and data manipulation."
regex = '''\bsk-ant-api03-[A-Za-z0-9_-]{20,100}[A-Za-z0-9_-]'''
entropy = 3.5
keywords = ["sk-ant-api", "anthropic"]

[[rules]]
id = "generic-password-catch-all"
description = "Generic rule to catch password assignments in configuration and code"
# (?:^|[^a-zA-Z]) prevents matching inside words like "compass" or "passed"
# Allows patterns like DB_PASSWORD, MYSQL_PASSWORD (underscore before PASSWORD is ok)
# Requires an assignment operator (=, :) immediately after the keyword
# Requires at least 8 characters for the password value
# Entropy 3.1 filters out low-randomness values like "abcdefgh" (entropy=3.0)
regex = '''(?i)(?:^|[^a-zA-Z])(?:password|passwd)\s*[=:]\s*['"]?([^\s'";\n\r]{8,50})['"]?'''
entropy = 3.1
keywords = ["password", "passwd"]
[[rules.allowlists]]
description = "Allow common false positives - patterns match the FULL regex match (e.g., password=value)"
regexes = [
    # Placeholder values that START with common placeholder words (password=placeholder, password=test123)
    '''(?i)(?:password|passwd)[=:]\s*['"]?(password|passwd|changeme|placeholder|example|test|dummy|fake|sample)[a-z0-9_]*['"]?$''',
    # Variable references as values
    '''(?i)(?:password|passwd)[=:]\s*['"]?\$\{[^}]+\}['"]?''',
    '''(?i)(?:password|passwd)[=:]\s*['"]?\$[A-Z_]+['"]?''',
    '''(?i)(?:password|passwd)[=:]\s*['"]?\{\{[^}]+\}\}['"]?''',
    # Command-line flags
    '''(?i)(?:password|passwd)[=:]\s*['"]?--?[a-z][a-z-]*['"]?''',
    # Numbers only (12345678...)
    '''(?i)(?:password|passwd)[=:]\s*['"]?[0-9]{8,}['"]?''',
    # Already redacted secrets - prevent cascade detection
    '''\[REDACTED_SECRET:[^\]]+\]''',
]

[[rules]]
id = "url-embedded-passwords"
description = "Catch passwords embedded in URLs (e.g., redis://:password@host or postgres://user:password@host)"
# Matches both ://:password@ (empty username) and ://user:password@ patterns
# Uses [^@\s]+ to capture passwords that might contain special chars, then @ followed by host
regex = '''(?i)://(?:[^:@\s]*:)([^@\s]{4,50})@[a-zA-Z0-9]'''
entropy = 0.5
keywords = ["://", "@"]

[[rules]]
id = "huawei-access-key-id"
description = "Detected a Huawei Cloud Access Key ID (AK), which could allow unauthorized access to Huawei Cloud services."
regex = '''\b[A-Z0-9]{20}\b'''
entropy = 3.5
keywords = ["huawei", "access key id", "accesskeyid", "access_key_id"]

[[rules]]
id = "huawei-secret-access-key"
description = "Detected a Huawei Cloud Secret Access Key (SK), which could allow unauthorized access to Huawei Cloud services and data."
regex = '''\b[A-Za-z0-9]{40}\b'''
entropy = 4.0
keywords = ["huawei", "secret access key", "secretaccesskey", "secret_access_key"]