Created
September 6, 2024 22:28
-
-
Save dmdhrumilmistry/cd43ac90fa28f3c6d9c1b87c56586103 to your computer and use it in GitHub Desktop.
OWASP OFFAT Data Leak Patterns Sample File
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Sample file: owasp-offat-data-leak-patterns.yml | |
| # Source: https://github.com/mazen160/secrets-patterns-db | |
| # License: https://github.com/mazen160/secrets-patterns-db/blob/master/LICENSE.md | |
| # WARNING: Data leak detection can be cpu intensive, so it's preffered to only | |
| # include patterns for which data is available in the API. | |
| patterns: | |
| - name: times | |
| regex: \d{1,2}:\d{2} ?(?:[ap]\.?m\.?)?|\d[ap]\.?m\.? | |
| confidence: high | |
| - name: phones | |
| regex: ((?:(?<![\d-])(?:\+?\d{1,3}[-.\s*]?)?(?:\(?\d{3}\)?[-.\s*]?)?\d{3}[-.\s*]?\d{4}(?![\d-]))|(?:(?<![\d-])(?:(?:\(\+?\d{2}\))|(?:\+?\d{2}))\s*\d{2}\s*\d{3}\s*\d{4}(?![\d-]))) | |
| confidence: high | |
| - name: phones_with_exts | |
| regex: ((?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*(?:[2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|(?:[2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?(?:[2-9]1[02-9]|[2-9][02-9]1|[2-9][02-9]{2})\s*(?:[.-]\s*)?(?:[0-9]{4})(?:\s*(?:#|x\.?|ext\.?|extension)\s*(?:\d+)?)) | |
| confidence: high | |
| - name: emails | |
| regex: ([a-z0-9!#$%&'*+\/=?^_`{|.}~-]+@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?) | |
| confidence: high | |
| - name: street_addresses | |
| regex: \d{1,4} [\w\s]{1,20}(?:street|st|avenue|ave|road|rd|highway|hwy|square|sq|trail|trl|drive|dr|court|ct|park|parkway|pkwy|circle|cir|boulevard|blvd)\W?(\s|$) | |
| confidence: high | |
| - name: po_boxes | |
| regex: P\.? ?O\.? Box \d+ | |
| confidence: high | |
| - name: ukphones | |
| regex: ^\s*\(?(020[7,8]{1}\)?[ ]?[1-9]{1}[0-9{2}[ ]?[0-9]{4})|(0[1-8]{1}[0-9]{3}\)?[]?[1-9]{1}[0-9]{2}[ ]?[0-9]{3})\s*$ | |
| confidence: high | |
| - name: email - 3 | |
| regex: \b[\w\-+.]+@+\w+.+[A-z]{3} | |
| confidence: high | |
| - name: ssn - 3 | |
| regex: "\b(?!000|666)[0-8][0-9]{2}-(?!00)[0-9]{2}-(?!0000)[0-9]{4}\b" | |
| confidence: high | |
| - name: ssn_number | |
| regex: (?!000|666|333)0*(?:[0-6][0-9][0-9]|[0-7][0-6][0-9]|[0-7][0-7][0-2])[-](?!00)[0-9]{2}[- ](?!0000)[0-9]{4} | |
| confidence: high | |
| - name: visa_credit_card | |
| regex: 4[0-9]{15} | |
| confidence: high | |
| - name: american_express_credit-card | |
| regex: 3[47][0-9]{13} | |
| confidence: high | |
| - name: otp | |
| regex: ^[0-9]{6}$ | |
| confidence: high | |
| - name: credit card - 2 | |
| regex: 4[0-9]{12}(?:[0-9]{3})?|(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12} |3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11} | |
| confidence: high | |
| - name: UK Phone Numbers | |
| regex: \b([0O]?[1lI][1lI])?[4A][4A][\dOIlZEASB]{10,11}\b | |
| confidence: high | |
| - name: US Phone Numbers | |
| regex: \b((\+|\b)[1l][\-\. ])?\(?\b[\dOlZSB]{3,5}([\-\. ]|\) ?)[\dOlZSB]{3}[\-\. ][\dOlZSB]{4}\b | |
| confidence: high | |
| - name: Email Addresses | |
| regex: \b[a-z0-9._%\+\-—|]+@[a-z0-9.\-—|]+\.[a-z|]{2,6}\b | |
| confidence: high | |
| - name: Credit card - 3 | |
| regex: \b((4\d{3}|5[1-5]\d{2}|2\d{3}|3[47]\d{1,2})[\s\-]?\d{4,6}[\s\-]?\d{4,6}?([\s\-]\d{3,4})?(\d{3})?)\b | |
| confidence: high | |
| - name: Amex Card | |
| regex: \b3[47][0-9]{13}\b | |
| confidence: high | |
| - name: BCGlobal | |
| regex: \b(6541|6556)[0-9]{12}\b | |
| confidence: high | |
| - name: Carte Blanche Card | |
| regex: \b389[0-9]{11}\b | |
| confidence: high | |
| - name: Diners Club Card | |
| regex: \b3(?:0[0-5]|[68][0-9])[0-9]{11}\b | |
| confidence: high | |
| - name: Discover Card | |
| regex: \b65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})\b | |
| confidence: high | |
| - name: Insta Payment Card | |
| regex: \b63[7-9][0-9]{13}\b | |
| confidence: high | |
| - name: JCB Card | |
| regex: \b(?:2131|1800|35\d{3})\d{11}\b | |
| confidence: high | |
| - name: Korean Local Card | |
| regex: \b9[0-9]{15}\b | |
| confidence: high | |
| - name: Laser Card | |
| regex: \b(6304|6706|6709|6771)[0-9]{12,15}\b | |
| confidence: high | |
| - name: Maestro Card | |
| regex: \b(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}\b | |
| confidence: high | |
| - name: MasterCard | |
| regex: \b(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\b | |
| confidence: high | |
| - name: Solo Card | |
| regex: \b(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}\b | |
| confidence: high | |
| - name: Switch Card | |
| regex: \b(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9] | |
| confidence: high | |
| - name: Argentina National Identity (DNI) Number | |
| regex: \d{2}\.\d{3}\.\d{3} | |
| confidence: high | |
| - name: Canada Passport ID | |
| regex: \b[\w]{2}[\d]{6}\b | |
| confidence: high | |
| - name: Croatia Vat ID card number | |
| regex: \bHR\d{11}\b | |
| confidence: high | |
| - name: Czech Republic Vat ID card number | |
| regex: \bCZ\d{8,10}\b | |
| confidence: high | |
| - name: Denmark Personal ID number | |
| regex: \b\d{10}|\d{6}[-\s]\d{4}\b | |
| confidence: high | |
| - name: France National ID card (CNI) | |
| regex: \b\d{12}\b | |
| confidence: high | |
| - name: France Social Security Number (INSEE) | |
| regex: \b\d{13}|\d{13}\s\d{2}\b | |
| confidence: high | |
| - name: France Passport ID | |
| regex: \b\d{2}11\d{5}\b | |
| confidence: high | |
| - name: Germany ID card number | |
| regex: \bl\d{8}\b | |
| confidence: high | |
| - name: Germany Passport ID | |
| regex: \b[cfghjk]\d{3}\w{5}\d\b | |
| confidence: high | |
| - name: Germany Driver's License ID | |
| regex: \b[\d\w]\d{2}[\d\w]{6}\d[\d\w]\b | |
| confidence: high | |
| - name: Ireland Personal Public Service (PPS) Number | |
| regex: \b\d{7}\w{1,2}\b | |
| confidence: high | |
| - name: Netherlands Citizen's Service (BSN) number | |
| regex: \b\d{8}|\d{3}[-\.\s]\d{3}[-\.\s]\d{3}\b | |
| confidence: high | |
| - name: Poland National ID (PESEL) | |
| regex: \b\d{11}\b | |
| confidence: high | |
| - name: Portugal Citizen Card Number | |
| regex: \d{9}[\w\d]{2}|\d{8}-\d[\d\w]{2}\d | |
| confidence: high | |
| - name: Spain Social Security Number (SSN) | |
| regex: \b\d{2}\/?\d{8}\/?\d{2}\b | |
| confidence: high | |
| - name: Spain Social Security Number (SSN) - 2 | |
| regex: \b\d{3}[ -.]\d{2}[ -.]\d{4}\b` | |
| confidence: high | |
| - name: Sweden Passport ID | |
| regex: \b\d{8}\b | |
| confidence: high | |
| - name: United Kingdom Passport ID | |
| regex: \b\d{9}\b | |
| confidence: high | |
| - name: United Kingdom Driver's license ID | |
| regex: \b[\w9]{5}\d{6}[\w9]{2}\d{5}\b | |
| confidence: high | |
| - name: United Kingdom National Health Service (NHS) number | |
| regex: \b\d{3}\s\d{3}\s\d{4}\b | |
| confidence: high | |
| - name: ipv4 | |
| regex: (?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?) | |
| confidence: high | |
| - name: prices | |
| regex: '[$]\s?[+-]?[0-9]{1,3}(?:(?:,?[0-9]{3}))*(?:\.[0-9]{1,2})?' | |
| confidence: high | |
| - name: hex_colors | |
| regex: (#(?:[0-9a-fA-F]{8})|#(?:[0-9a-fA-F]{3}){1,2})\b | |
| confidence: high | |
| - name: credit_cards | |
| regex: ((?:(?:\d{4}[- ]?){3}\d{4}|\d{15,16}))(?![\d]) | |
| confidence: high | |
| - name: visa_cards | |
| regex: 4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4} | |
| confidence: high | |
| - name: master_cards | |
| regex: 5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4} | |
| confidence: high | |
| - name: btc_addresses | |
| regex: (?<![a-km-zA-HJ-NP-Z0-9])[13][a-km-zA-HJ-NP-Z0-9]{26,33}(?![a-km-zA-HJ-NP-Z0-9]) | |
| confidence: high | |
| - name: ssn_number - 3 | |
| regex: (?:\d{3}-\d{2}-\d{4}) | |
| confidence: high | |
| - name: md5_hashes | |
| regex: '[0-9a-fA-F]{32}' | |
| confidence: high | |
| - name: sha1_hashes | |
| regex: '[0-9a-fA-F]{40}' | |
| confidence: high | |
| - name: sha256_hashes | |
| regex: '[0-9a-fA-F]{64}' | |
| confidence: high | |
| - name: isbn13 | |
| regex: (?:[\d]-?){12}[\dxX] | |
| confidence: high | |
| - name: isbn10 | |
| regex: (?:[\d]-?){9}[\dxX] | |
| confidence: high | |
| - name: mac_addresses | |
| regex: (([0-9a-fA-F]{2}[:-]){5}([0-9a-fA-F]{2})) | |
| confidence: high | |
| - name: iban_numbers | |
| regex: '[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z\d]?){0,16}' | |
| confidence: high | |
| - name: git_repos | |
| regex: ((git|ssh|http(s)?)|(git@[\w\.]+))(:(\/\/)?)([\w\.@\:/\-~]+)(\.git)(\/)? | |
| confidence: high | |
| - name: Driver's License Number (simplified) | |
| regex: ^[A-Z]{2}-\d{6}$ | |
| confidence: high | |
| - name: Passport Number (simplified) - 3 | |
| regex: ^[A-Z]\d{7}$ | |
| confidence: high | |
| - name: Social Security Number (SSN) - 3 | |
| regex: ^\d{3}-\d{2}-\d{4}$ | |
| confidence: high | |
| - name: Social Security Number (SSN) - 4 | |
| regex: (?:\\b\\d{3}-?\\d{2}-?(\\d{4})\\b) | |
| confidence: high | |
| - name: Date of Birth | |
| regex: ^\d{2}/\d{2}/\d{4}$|^\d{4}-\d{2}-\d{2}$ | |
| confidence: high | |
| - name: Arista network configuration | |
| regex: "via\\ \\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3},\\ \\d{2}:\\d{2}:\\d{2}" | |
| confidence: high | |
| - name: BBVA Compass Routing Number - California | |
| regex: "^321170538$" | |
| confidence: high | |
| - name: Bank of America Routing Numbers - California | |
| regex: "^(?:121|026)00(?:0|9)(?:358|593)$" | |
| confidence: high | |
| - name: Box Links | |
| regex: "https://app.box.com/[s|l]/\\S+" | |
| confidence: high | |
| - name: CVE Number | |
| regex: "CVE-\\d{4}-\\d{4,7}" | |
| confidence: high | |
| - name: California Drivers License | |
| regex: "^[A-Z]{1}\\d{7}$" | |
| confidence: high | |
| - name: Chase Routing Numbers - California | |
| regex: "^322271627$" | |
| confidence: high | |
| - name: Cisco Router Config | |
| regex: "service\\ timestamps\\ [a-z]{3,5}\\ datetime\\ msec|boot-[a-z]{3,5}-marker|interface\\ [A-Za-z0-9]{0,10}[E,e]thernet" | |
| confidence: high | |
| - name: Citibank Routing Numbers - California | |
| regex: "^32(?:11|22)71(?:18|72)4$" | |
| confidence: high | |
| - name: DSA Private Key | |
| regex: "-----BEGIN DSA PRIVATE KEY-----(?:[a-zA-Z0-9\\+\\=\\/\"']|\\s)+?-----END DSA PRIVATE KEY-----" | |
| confidence: high | |
| - name: Dropbox Links | |
| regex: "https://www.dropbox.com/(?:s|l)/\\S+" | |
| confidence: high | |
| - name: EC Private Key | |
| regex: "-----BEGIN (?:EC|ECDSA) PRIVATE KEY-----(?:[a-zA-Z0-9\\+\\=\\/\"']|\\s)+?-----END (?:EC|ECDSA) PRIVATE KEY-----" | |
| confidence: high | |
| - name: Encrypted DSA Private Key | |
| regex: "-----BEGIN DSA PRIVATE KEY-----\\s.*,ENCRYPTED(?:.|\\s)+?-----END DSA PRIVATE KEY-----" | |
| confidence: high | |
| - name: Encrypted EC Private Key | |
| regex: "-----BEGIN (?:EC|ECDSA) PRIVATE KEY-----\\s.*,ENCRYPTED(?:.|\\s)+?-----END (?:EC|ECDSA) PRIVATE KEY-----" | |
| confidence: high | |
| - name: Encrypted Private Key | |
| regex: "-----BEGIN ENCRYPTED PRIVATE KEY-----(?:.|\\s)+?-----END ENCRYPTED PRIVATE KEY-----" | |
| confidence: high | |
| - name: Encrypted PuTTY SSH DSA Key | |
| regex: "PuTTY-User-Key-File-2: ssh-dss\\s*Encryption: aes(?:.|\\s?)*?Private-MAC:" | |
| confidence: high | |
| - name: Encrypted RSA Private Key | |
| regex: "-----BEGIN RSA PRIVATE KEY-----\\s.*,ENCRYPTED(?:.|\\s)+?-----END RSA PRIVATE KEY-----" | |
| confidence: high | |
| - name: Google Application Identifier | |
| regex: "[0-9]+-\\w+.apps.googleusercontent.com" | |
| confidence: high | |
| - name: HIPAA PHI National Drug Code | |
| regex: "^\\d{4,5}-\\d{3,4}-\\d{1,2}$" | |
| confidence: high | |
| - name: Huawei config file | |
| regex: "sysname\\ HUAWEI|set\\ authentication\\ password\\ simple\\ huawei" | |
| confidence: high | |
| - name: Individual Taxpayer Identification Numbers (ITIN) | |
| regex: "^9\\d{2}(?:[ \\-]?)[7,8]\\d(?:[ \\-]?)\\d{4}$" | |
| confidence: high | |
| - name: John the Ripper | |
| regex: "[J,j]ohn\\ [T,t]he\\ [R,r]ipper|john-[1-9].[1-9].[1-9]|Many\\ salts:|Only\\ one\\ salt:|openwall.com/john/|List.External:[0-9a-zA-Z]*|Loaded\\ [0-9]*\\ password hash|guesses:\\ \\d*\\ \\ time:\\ \\d*:\\d{2}:\\d{2}:\\d{2}|john\\.pot" | |
| confidence: high | |
| - name: KeePass 1.x CSV Passwords | |
| regex: "\"Account\",\"Login Name\",\"Password\",\"Web Site\",\"Comments\"" | |
| confidence: high | |
| - name: KeePass 1.x XML Passwords | |
| regex: "<pwlist>\\s*?<pwentry>[\\S\\s]*?<password>[\\S\\s]*?<\\/pwentry>\\s*?<\\/pwlist>" | |
| confidence: high | |
| - name: Large number of US Phone Numbers | |
| regex: "\\d{3}-\\d{3}-\\d{4}|\\(\\d{3}\\)\\ ?\\d{3}-?\\d{4}" | |
| confidence: high | |
| - name: Large number of US Zip Codes | |
| regex: "^(\\d{5}-\\d{4}|\\d{5})$" | |
| confidence: high | |
| - name: Lightweight Directory Access Protocol | |
| regex: "(?:dn|cn|dc|sn):\\s*[a-zA-Z0-9=, ]*" | |
| confidence: high | |
| - name: Metasploit Module | |
| regex: "require\\ 'msf/core'|class\\ Metasploit|include\\ Msf::Exploit::\\w+::\\w+" | |
| confidence: high | |
| - name: MySQL database dump | |
| regex: "DROP DATABASE IF EXISTS(?:.|\\n){5,300}CREATE DATABASE(?:.|\\n){5,300}DROP TABLE IF EXISTS(?:.|\\n){5,300}CREATE TABLE" | |
| confidence: high | |
| - name: MySQLite database dump | |
| regex: "DROP\\ TABLE\\ IF\\ EXISTS\\ \\[[a-zA-Z]*\\];|CREATE\\ TABLE\\ \\[[a-zA-Z]*\\];" | |
| confidence: high | |
| - name: Network Proxy Auto-Config | |
| regex: "proxy\\.pac|function\\ FindProxyForURL\\(\\w+,\\ \\w+\\)" | |
| confidence: high | |
| - name: Nmap Scan Report | |
| regex: "Nmap\\ scan\\ report\\ for\\ [a-zA-Z0-9.]+" | |
| confidence: high | |
| - name: PGP Header | |
| regex: "-{5}(?:BEGIN|END)\\ PGP\\ MESSAGE-{5}" | |
| confidence: high | |
| - name: PGP Private Key Block | |
| regex: "-----BEGIN PGP PRIVATE KEY BLOCK-----(?:.|\\s)+?-----END PGP PRIVATE KEY BLOCK-----" | |
| confidence: high | |
| - name: PKCS7 Encrypted Data | |
| regex: "(?:Signer|Recipient)Info(?:s)?\\ ::=\\ \\w+|[D|d]igest(?:Encryption)?Algorithm|EncryptedKey\\ ::= \\w+" | |
| confidence: high | |
| - name: Password etc passwd | |
| regex: "[a-zA-Z0-9\\-]+:[x|\\*]:\\d+:\\d+:[a-zA-Z0-9/\\- \"]*:/[a-zA-Z0-9/\\-]*:/[a-zA-Z0-9/\\-]+" | |
| confidence: high | |
| - name: Password etc shadow | |
| regex: "[a-zA-Z0-9\\-]+:(?:(?:!!?)|(?:\\*LOCK\\*?)|\\*|(?:\\*LCK\\*?)|(?:\\$.*\\$.*\\$.*?)?):\\d*:\\d*:\\d*:\\d*:\\d*:\\d*:" | |
| confidence: high | |
| - name: PlainText Private Key | |
| regex: "-----BEGIN PRIVATE KEY-----(?:.|\\s)+?-----END PRIVATE KEY-----" | |
| confidence: high | |
| - name: PuTTY SSH DSA Key | |
| regex: "PuTTY-User-Key-File-2: ssh-dss\\s*Encryption: none(?:.|\\s?)*?Private-MAC:" | |
| confidence: high | |
| - name: PuTTY SSH RSA Key | |
| regex: "PuTTY-User-Key-File-2: ssh-rsa\\s*Encryption: none(?:.|\\s?)*?Private-MAC:" | |
| confidence: high | |
| - name: Public Key Cryptography System (PKCS) | |
| regex: "protocol=\"application/x-pkcs[0-9]{0,2}-signature\"" | |
| confidence: high | |
| - name: Public encrypted key | |
| regex: "-----BEGIN PUBLIC KEY-----(?:.|\\s)+?-----END PUBLIC KEY-----" | |
| confidence: high | |
| - name: RSA Private Key | |
| regex: "-----BEGIN RSA PRIVATE KEY-----(?:[a-zA-Z0-9\\+\\=\\/\"']|\\s)+?-----END RSA PRIVATE KEY-----" | |
| confidence: high | |
| - name: SSL Certificate | |
| regex: "-----BEGIN CERTIFICATE-----(?:.|\\n)+?\\s-----END CERTIFICATE-----" | |
| confidence: high | |
| - name: SWIFT Codes | |
| regex: "[A-Za-z]{4}(?:GB|US|DE|RU|CA|JP|CN)[0-9a-zA-Z]{2,5}$" | |
| confidence: high | |
| - name: Samba Password config file | |
| regex: "[a-z]*:\\d{3}:[0-9a-zA-Z]*:[0-9a-zA-Z]*:\\[U\\ \\]:.*" | |
| confidence: high | |
| - name: Slack 2FA Backup Codes | |
| regex: "Two-Factor\\s*\\S*Authentication\\s*\\S*Backup\\s*\\S*Codes(?:.|\\n)*[Ss]lack(?:.|\\n)*\\d{9}" | |
| confidence: high | |
| - name: UK Drivers License Numbers | |
| regex: "[A-Z]{5}\\d{6}[A-Z]{2}\\d{1}[A-Z]{2}" | |
| confidence: high | |
| - name: UK Passport Number | |
| regex: "\\d{10}GB[RP]\\d{7}[UMF]{1}\\d{9}" | |
| confidence: high | |
| - name: USBank Routing Numbers - California | |
| regex: "^12(?:1122676|2235821)$" | |
| confidence: high | |
| - name: United Bank Routing Number - California | |
| regex: "^122243350$" | |
| confidence: high | |
| - name: Wells Fargo Routing Numbers - California | |
| regex: "^121042882$" | |
| confidence: high | |
| - name: aws_access_key | |
| regex: "((access[-_]?key[-_]?id)|(ACCESS[-_]?KEY[-_]?ID)|([Aa]ccessKeyId)|(access[_-]?id)).{0,20}AKIA[a-zA-Z0-9+/]{16}[^a-zA-Z0-9+/]" | |
| confidence: high | |
| - name: aws_credentials_context | |
| regex: "access_key_id|secret_access_key|AssetSync.configure" | |
| confidence: high | |
| - name: aws_secret_key | |
| regex: "((secret[-_]?access[-_]?key)|(SECRET[-_]?ACCESS[-_]?KEY|(private[-_]?key))|([Ss]ecretAccessKey)).{0,20}[^a-zA-Z0-9+/][a-zA-Z0-9+/]{40}\\b" | |
| confidence: high | |
| - name: facebook_secret | |
| regex: "(facebook_secret|FACEBOOK_SECRET|facebook_app_secret|FACEBOOK_APP_SECRET)[a-z_ =\\s\"'\\:]{0,5}[^a-zA-Z0-9][a-f0-9]{32}[^a-zA-Z0-9]" | |
| confidence: high | |
| - name: github_key | |
| regex: "(GITHUB_SECRET|GITHUB_KEY|github_secret|github_key|github_token|GITHUB_TOKEN|github_api_key|GITHUB_API_KEY)[a-z_ =\\s\"'\\:]{0,10}[^a-zA-Z0-9][a-zA-Z0-9]{40}[^a-zA-Z0-9]" | |
| confidence: high | |
| - name: google_two_factor_backup | |
| regex: "(?:BACKUP VERIFICATION CODES|SAVE YOUR BACKUP CODES)[\\s\\S]{0,300}@" | |
| confidence: high | |
| - name: heroku_key | |
| regex: "(heroku_api_key|HEROKU_API_KEY|heroku_secret|HEROKU_SECRET)[a-z_ =\\s\"'\\:]{0,10}[^a-zA-Z0-9-]\\w{8}(?:-\\w{4}){3}-\\w{12}[^a-zA-Z0-9\\-]" | |
| confidence: high | |
| - name: microsoft_office_365_oauth_context | |
| regex: "https://login.microsoftonline.com/common/oauth2/v2.0/token|https://login.windows.net/common/oauth2/token" | |
| confidence: high | |
| - name: pgSQL Connection Information | |
| regex: "(?:postgres|pgsql)\\:\\/\\/" | |
| confidence: high | |
| - name: slack_api_key | |
| regex: "(slack_api_key|SLACK_API_KEY|slack_key|SLACK_KEY)[a-z_ =\\s\"'\\:]{0,10}[^a-f0-9][a-f0-9]{32}[^a-f0-9]" | |
| confidence: high | |
| - name: slack_api_token | |
| regex: "(xox[pb](?:-[a-zA-Z0-9]+){4,})" | |
| confidence: high | |
| - name: ssh_dss_public | |
| regex: "ssh-dss [0-9A-Za-z+/]+[=]{2}" | |
| confidence: high | |
| - name: ssh_rsa_public | |
| regex: "ssh-rsa AAAA[0-9A-Za-z+/]+[=]{0,3} [^@]+@[^@]+" | |
| confidence: high | |
| - name: IBAN | |
| regex: '[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}' | |
| confidence: high | |
| - name: GPS Data | |
| regex: '^([-+]?)([\d]{1,2})(((\.)(\d+)(,)))(\s*)(([-+]?)([\d]{1,3})((\.)(\d+))?)' | |
| confidence: high | |
| - name: Blood Type | |
| regex: '^(A|B|AB|O)[-+]$' | |
| confidence: high | |
| - name: Date of Birth - 2 | |
| regex: '^([1-9]|[12][0-9]|3[01])(\/?\.\-?\-?\s?)(0[1-9]|1[12])(\/?\.?\-?\s?)(19[0-9][0-9]|20[0][0-9]|20[1][0-8])$' | |
| confidence: high | |
| - name: Tax Number | |
| regex: '^[0-9]{10}$' | |
| confidence: high | |
| - name: Bitcoin Address | |
| regex: '^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$' | |
| confidence: high | |
| - name: AWS API Gateway | |
| regex: '[0-9a-z]+.execute-api.[0-9a-z._-]+.amazonaws.com' | |
| confidence: low | |
| - name: AWS API Key | |
| regex: AKIA[0-9A-Z]{16} | |
| confidence: high | |
| - name: AWS ARN | |
| regex: arn:aws:[a-z0-9-]+:[a-z]{2}-[a-z]+-[0-9]+:[0-9]+:.+ | |
| confidence: high | |
| - name: AWS Access Key ID Value | |
| regex: (A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16} | |
| confidence: high | |
| - name: AWS AppSync GraphQL Key | |
| regex: da2-[a-z0-9]{26} | |
| confidence: high | |
| - name: AWS EC2 External | |
| regex: ec2-[0-9a-z._-]+.compute(-1)?.amazonaws.com | |
| confidence: low | |
| - name: AWS EC2 Internal | |
| regex: '[0-9a-z._-]+.compute(-1)?.internal' | |
| confidence: low | |
| - name: AWS ELB | |
| regex: '[0-9a-z._-]+.elb.amazonaws.com' | |
| confidence: low | |
| - name: AWS ElasticCache | |
| regex: '[0-9a-z._-]+.cache.amazonaws.com' | |
| confidence: low | |
| - name: AWS MWS ID | |
| regex: mzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} | |
| confidence: low | |
| - name: AWS MWS key | |
| regex: amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} | |
| confidence: high | |
| - name: AWS RDS | |
| regex: '[0-9a-z._-]+.rds.amazonaws.com' | |
| confidence: high | |
| - name: AWS S3 Bucket | |
| regex: s3://[0-9a-z._/-]+ | |
| confidence: high | |
| - name: AWS client ID | |
| regex: (A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16} | |
| confidence: low | |
| - name: AWS cred file info | |
| regex: (aws_access_key_id|aws_secret_access_key) | |
| confidence: high | |
| - name: Abbysale | |
| regex: (?:abbysale).{0,40}\b([a-z0-9A-Z]{40})\b | |
| confidence: high | |
| - name: Abstract | |
| regex: (?:abstract).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Abuseipdb | |
| regex: (?:abuseipdb).{0,40}\b([a-z0-9]{80})\b | |
| confidence: high | |
| - name: Accuweather | |
| regex: (?:accuweather).{0,40}([a-z0-9A-Z\%]{35})\b | |
| confidence: high | |
| - name: Adafruitio | |
| regex: \b(aio\_[a-zA-Z0-9]{28})\b | |
| confidence: high | |
| - name: Adobeio - 1 | |
| regex: (?:adobe).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Adzuna - 1 | |
| regex: (?:adzuna).{0,40}\b([a-z0-9]{8})\b | |
| confidence: high | |
| - name: Adzuna - 2 | |
| regex: (?:adzuna).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Aeroworkflow - 1 | |
| regex: (?:aeroworkflow).{0,40}\b([0-9]{1,})\b | |
| confidence: high | |
| - name: Aeroworkflow - 2 | |
| regex: (?:aeroworkflow).{0,40}\b([a-zA-Z0-9^!]{20})\b | |
| confidence: high | |
| - name: Agora | |
| regex: (?:agora).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Airbrakeprojectkey - 1 | |
| regex: (?:airbrake).{0,40}\b([0-9]{6})\b | |
| confidence: high | |
| - name: Airbrakeprojectkey - 2 | |
| regex: (?:airbrake).{0,40}\b([a-zA-Z-0-9]{32})\b | |
| confidence: high | |
| - name: Airbrakeuserkey | |
| regex: (?:airbrake).{0,40}\b([a-zA-Z-0-9]{40})\b | |
| confidence: high | |
| - name: Airship | |
| regex: (?:airship).{0,40}\b([0-9Aa-zA-Z]{91})\b | |
| confidence: high | |
| - name: Airvisual | |
| regex: (?:airvisual).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Alconost | |
| regex: (?:alconost).{0,40}\b([0-9Aa-z]{32})\b | |
| confidence: high | |
| - name: Alegra - 1 | |
| regex: (?:alegra).{0,40}\b([a-z0-9-]{20})\b | |
| confidence: high | |
| - name: Alegra - 2 | |
| regex: (?:alegra).{0,40}\b([a-zA-Z0-9.-@]{25,30})\b | |
| confidence: high | |
| - name: Aletheiaapi | |
| regex: (?:aletheiaapi).{0,40}\b([A-Z0-9]{32})\b | |
| confidence: high | |
| - name: Algoliaadminkey - 1 | |
| regex: (?:algolia).{0,40}\b([A-Z0-9]{10})\b | |
| confidence: low | |
| - name: Algoliaadminkey - 2 | |
| regex: (?:algolia).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: low | |
| - name: Alibaba - 2 | |
| regex: \b(LTAI[a-zA-Z0-9]{17,21})[\"' ;\s]* | |
| confidence: high | |
| - name: Alienvault | |
| regex: (?:alienvault).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Allsports | |
| regex: (?:allsports).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Amadeus - 1 | |
| regex: (?:amadeus).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Amadeus - 2 | |
| regex: (?:amadeus).{0,40}\b([0-9A-Za-z]{16})\b | |
| confidence: high | |
| - name: Amazon SNS Topic | |
| regex: arn:aws:sns:[a-z0-9\-]+:[0-9]+:[A-Za-z0-9\-_]+ | |
| confidence: low | |
| - name: Ambee | |
| regex: (?:ambee).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Amplitudeapikey | |
| regex: (?:amplitude).{0,40}\b([a-f0-9]{32}) | |
| confidence: high | |
| - name: Apacta | |
| regex: (?:apacta).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Api2cart | |
| regex: (?:api2cart).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Apideck - 1 | |
| regex: \b(sk_live_[a-z0-9A-Z-]{93})\b | |
| confidence: high | |
| - name: Apideck - 2 | |
| regex: (?:apideck).{0,40}\b([a-z0-9A-Z]{40})\b | |
| confidence: high | |
| - name: Apiflash - 1 | |
| regex: (?:apiflash).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Apiflash - 2 | |
| regex: (?:apiflash).{0,40}\b([a-zA-Z0-9\S]{21,30})\b | |
| confidence: high | |
| - name: Apifonica | |
| regex: (?:apifonica).{0,40}\b([0-9a-z]{11}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Apify | |
| regex: \b(apify\_api\_[a-zA-Z-0-9]{36})\b | |
| confidence: high | |
| - name: Apimatic - 1 | |
| regex: (?:apimatic).{0,40}\b([a-z0-9-\S]{8,32})\b | |
| confidence: high | |
| - name: Apimatic - 2 | |
| regex: (?:apimatic).{0,40}\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b | |
| confidence: high | |
| - name: Apiscience | |
| regex: (?:apiscience).{0,40}\b([a-bA-Z0-9\S]{22})\b | |
| confidence: high | |
| - name: Apollo | |
| regex: (?:apollo).{0,40}\b([a-zA-Z0-9]{22})\b | |
| confidence: high | |
| - name: Appcues - 1 | |
| regex: (?:appcues).{0,40}\b([0-9]{5})\b | |
| confidence: high | |
| - name: Appcues - 2 | |
| regex: (?:appcues).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Appcues - 3 | |
| regex: (?:appcues).{0,40}\b([a-z0-9-]{39})\b | |
| confidence: high | |
| - name: Appfollow | |
| regex: (?:appfollow).{0,40}\b([0-9A-Za-z]{20})\b | |
| confidence: high | |
| - name: Appsynergy | |
| regex: (?:appsynergy).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Apptivo - 1 | |
| regex: (?:apptivo).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Apptivo - 2 | |
| regex: (?:apptivo).{0,40}\b([a-zA-Z0-9-]{32})\b | |
| confidence: high | |
| - name: Artifactory - 2 | |
| regex: \b([A-Za-z0-9](?:[A-Za-z0-9\-]{0,61}[A-Za-z0-9])\.jfrog\.io) | |
| confidence: high | |
| - name: Artifactory API Token | |
| regex: (?:\s|=|:|"|^)AKC[a-zA-Z0-9]{10,} | |
| confidence: low | |
| - name: Artifactory Password | |
| regex: (?:\s|=|:|"|^)AP[\dABCDEF][a-zA-Z0-9]{8,} | |
| confidence: low | |
| - name: Artsy - 1 | |
| regex: (?:artsy).{0,40}\b([0-9a-zA-Z]{20})\b | |
| confidence: high | |
| - name: Artsy - 2 | |
| regex: (?:artsy).{0,40}\b([0-9a-zA-Z]{32})\b | |
| confidence: high | |
| - name: Asanaoauth | |
| regex: (?:asana).{0,40}\b([a-z\/:0-9]{51})\b | |
| confidence: high | |
| - name: Asanapersonalaccesstoken | |
| regex: (?:asana).{0,40}\b([0-9]{1,}\/[0-9]{16,}:[A-Za-z0-9]{32,})\b | |
| confidence: high | |
| - name: Assemblyai | |
| regex: (?:assemblyai).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Asymmetric Private Key | |
| regex: '-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----' | |
| confidence: high | |
| - name: Audd | |
| regex: (?:audd).{0,40}\b([a-z0-9-]{32})\b | |
| confidence: high | |
| - name: Auth0managementapitoken | |
| regex: (?:auth0).{0,40}\b(ey[a-zA-Z0-9._-]+)\b | |
| confidence: high | |
| - name: Auth0oauth - 1 | |
| regex: (?:auth0).{0,40}\b([a-zA-Z0-9_-]{32,60})\b | |
| confidence: low | |
| - name: Autodesk - 1 | |
| regex: (?:autodesk).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Autodesk - 2 | |
| regex: (?:autodesk).{0,40}\b([0-9A-Za-z]{16})\b | |
| confidence: high | |
| - name: Autoklose | |
| regex: (?:autoklose).{0,40}\b([a-zA-Z0-9-]{32})\b | |
| confidence: high | |
| - name: Autopilot | |
| regex: (?:autopilot).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Avazapersonalaccesstoken | |
| regex: (?:avaza).{0,40}\b([0-9]+-[0-9a-f]{40})\b | |
| confidence: high | |
| - name: Aviationstack | |
| regex: (?:aviationstack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Aws - 1 | |
| regex: \b((?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16})\b | |
| confidence: high | |
| - name: Axonaut | |
| regex: (?:axonaut).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Aylien - 1 | |
| regex: (?:aylien).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Aylien - 2 | |
| regex: (?:aylien).{0,40}\b([a-z0-9]{8})\b | |
| confidence: high | |
| - name: Ayrshare | |
| regex: (?:ayrshare).{0,40}\b([A-Z]{7}-[A-Z0-9]{7}-[A-Z0-9]{7}-[A-Z0-9]{7})\b | |
| confidence: high | |
| - name: Bannerbear | |
| regex: (?:bannerbear).{0,40}\b([0-9a-zA-Z]{22}tt)\b | |
| confidence: high | |
| - name: Baremetrics | |
| regex: (?:baremetrics).{0,40}\b([a-zA-Z0-9_]{25})\b | |
| confidence: high | |
| - name: Baseapiio | |
| regex: (?:baseapi|base-api).{0,40}\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Beamer | |
| regex: (?:beamer).{0,40}\b([a-zA-Z0-9_+/]{45}=) | |
| confidence: high | |
| - name: Bearer token | |
| regex: (bearer).+ | |
| confidence: low | |
| - name: Beebole | |
| regex: (?:beebole).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Besttime | |
| regex: (?:besttime).{0,40}\b([0-9A-Za-z_]{36})\b | |
| confidence: high | |
| - name: Billomat - 1 | |
| regex: (?:billomat).{0,40}\b([0-9a-z]{1,})\b | |
| confidence: high | |
| - name: Billomat - 2 | |
| regex: (?:billomat).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Bitbar | |
| regex: (?:bitbar).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Bitcoinaverage | |
| regex: (?:bitcoinaverage).{0,40}\b([a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Bitfinex | |
| regex: (?:bitfinex).{0,40}\b([A-Za-z0-9_-]{43})\b | |
| confidence: high | |
| - name: Bitly Secret Key | |
| regex: R_[0-9a-f]{32} | |
| confidence: high | |
| - name: Bitlyaccesstoken | |
| regex: (?:bitly).{0,40}\b([a-zA-Z-0-9]{40})\b | |
| confidence: high | |
| - name: Bitmex - 1 | |
| regex: (?:bitmex).{0,40}([ \r\n]{1}[0-9a-zA-Z\-\_]{24}[ \r\n]{1}) | |
| confidence: high | |
| - name: Bitmex - 2 | |
| regex: (?:bitmex).{0,40}([ \r\n]{1}[0-9a-zA-Z\-\_]{48}[ \r\n]{1}) | |
| confidence: high | |
| - name: Blablabus | |
| regex: (?:blablabus).{0,40}\b([0-9A-Za-z]{22})\b | |
| confidence: high | |
| - name: Blazemeter | |
| regex: (?:blazemeter|runscope).{0,40}\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Blitapp | |
| regex: (?:blitapp).{0,40}\b([a-zA-Z0-9_-]{39})\b | |
| confidence: high | |
| - name: Blogger | |
| regex: (?:blogger).{0,40}\b([0-9A-Za-z-]{39})\b | |
| confidence: low | |
| - name: Bombbomb | |
| regex: (?:bombbomb).{0,40}\b([a-zA-Z0-9-._]{704})\b | |
| confidence: high | |
| - name: Boostnote | |
| regex: (?:boostnote).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Borgbase | |
| regex: (?:borgbase).{0,40}\b([a-zA-Z0-9/_.-]{148,152})\b | |
| confidence: high | |
| - name: Braintree API Key | |
| regex: access_token$production$[0-9a-z]{16}$[0-9a-f]{32} | |
| confidence: high | |
| - name: Brandfetch | |
| regex: (?:brandfetch).{0,40}\b([0-9A-Za-z]{40})\b | |
| confidence: high | |
| - name: Browshot | |
| regex: (?:browshot).{0,40}\b([a-zA-Z-0-9]{28})\b | |
| confidence: high | |
| - name: Buddyns | |
| regex: (?:buddyns).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Bugherd | |
| regex: (?:bugherd).{0,40}\b([0-9a-z]{22})\b | |
| confidence: high | |
| - name: Bugsnag | |
| regex: (?:bugsnag).{0,40}\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Buildkite | |
| regex: (?:buildkite).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: Bulbul | |
| regex: (?:bulbul).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Buttercms | |
| regex: (?:buttercms).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: Caflou | |
| regex: (?:caflou).{0,40}\b([a-bA-Z0-9\S]{155})\b | |
| confidence: high | |
| - name: Calendarific | |
| regex: (?:calendarific).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: Calendlyapikey | |
| regex: (?:calendly).{0,40}\b([a-zA-Z-0-9]{20}.[a-zA-Z-0-9]{171}.[a-zA-Z-0-9_]{43})\b | |
| confidence: high | |
| - name: Calorieninja | |
| regex: (?:calorieninja).{0,40}\b([0-9A-Za-z]{40})\b | |
| confidence: high | |
| - name: Campayn | |
| regex: (?:campayn).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Cannyio | |
| regex: (?:canny).{0,40}\b([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[0-9]{4}-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Capsulecrm | |
| regex: (?:capsulecrm).{0,40}\b([a-zA-Z0-9-._+=]{64})\b | |
| confidence: high | |
| - name: Captaindata - 1 | |
| regex: (?:captaindata).{0,40}\b([0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Captaindata - 2 | |
| regex: (?:captaindata).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Carboninterface | |
| regex: (?:carboninterface).{0,40}\b([a-zA-Z0-9]{21})\b | |
| confidence: high | |
| - name: Cashboard - 1 | |
| regex: (?:cashboard).{0,40}\b([0-9A-Z]{3}-[0-9A-Z]{3}-[0-9A-Z]{3}-[0-9A-Z]{3})\b | |
| confidence: high | |
| - name: Cashboard - 2 | |
| regex: (?:cashboard).{0,40}\b([0-9a-z]{1,})\b | |
| confidence: high | |
| - name: Caspio - 1 | |
| regex: (?:caspio).{0,40}\b([a-z0-9]{8})\b | |
| confidence: high | |
| - name: Caspio - 2 | |
| regex: (?:caspio).{0,40}\b([a-z0-9]{50})\b | |
| confidence: high | |
| - name: Censys - 1 | |
| regex: (?:censys).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Censys - 2 | |
| regex: (?:censys).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Centralstationcrm | |
| regex: (?:centralstation).{0,40}\b([a-z0-9]{30})\b | |
| confidence: high | |
| - name: Cexio - 1 | |
| regex: (?:cexio|cex.io).{0,40}\b([a-z]{2}[0-9]{9})\b | |
| confidence: high | |
| - name: Cexio - 2 | |
| regex: (?:cexio|cex.io).{0,40}\b([0-9A-Za-z]{24,27})\b | |
| confidence: high | |
| - name: Chatbot | |
| regex: (?:chatbot).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Chatfule | |
| regex: (?:chatfuel).{0,40}\b([a-zA-Z0-9]{128})\b | |
| confidence: high | |
| - name: Checio | |
| regex: (?:checio).{0,40}\b(pk_[a-z0-9]{45})\b | |
| confidence: high | |
| - name: Checklyhq | |
| regex: (?:checklyhq).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Checkout - 1 | |
| regex: (?:checkout).{0,40}\b((sk_|sk_test_)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\b | |
| confidence: high | |
| - name: Checkout - 2 | |
| regex: (?:checkout).{0,40}\b(cus_[0-9a-zA-Z]{26})\b | |
| confidence: high | |
| - name: Checkvist - 1 | |
| regex: (?:checkvist).{0,40}\b([\w\.-]+@[\w-]+\.[\w\.-]{2,5})\b | |
| confidence: high | |
| - name: Checkvist - 2 | |
| regex: (?:checkvist).{0,40}\b([0-9a-zA-Z]{14})\b | |
| confidence: high | |
| - name: Cicero | |
| regex: (?:cicero).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Circleci | |
| regex: (?:circle).{0,40}([a-fA-F0-9]{40}) | |
| confidence: low | |
| - name: Clearbit | |
| regex: (?:clearbit).{0,40}\b([0-9a-z_]{35})\b | |
| confidence: high | |
| - name: Clickhelp - 1 | |
| regex: \b([0-9A-Za-z]{3,20}.try.clickhelp.co)\b | |
| confidence: high | |
| - name: Clickhelp - 2 | |
| regex: (?:clickhelp).{0,40}\b([0-9A-Za-z]{24})\b | |
| confidence: high | |
| - name: Clicksendsms - 2 | |
| regex: (?:sms).{0,40}\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b | |
| confidence: high | |
| - name: Clickuppersonaltoken | |
| regex: (?:clickup).{0,40}\b(pk_[0-9]{8}_[0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Cliengo | |
| regex: (?:cliengo).{0,40}\b([0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Clinchpad | |
| regex: (?:clinchpad).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Clockify | |
| regex: (?:clockify).{0,40}\b([a-zA-Z0-9]{48})\b | |
| confidence: high | |
| - name: Clockworksms - 1 | |
| regex: (?:clockwork|textanywhere).{0,40}\b([0-9a-zA-Z]{24})\b | |
| confidence: high | |
| - name: Clockworksms - 2 | |
| regex: (?:clockwork|textanywhere).{0,40}\b([0-9]{5})\b | |
| confidence: high | |
| - name: Closecrm | |
| regex: \b(api_[a-z0-9A-Z.]{45})\b | |
| confidence: high | |
| - name: Cloudelements - 1 | |
| regex: (?:cloudelements).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Cloudelements - 2 | |
| regex: (?:cloudelements).{0,40}\b([a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Cloudflareapitoken | |
| regex: (?:cloudflare).{0,40}\b([A-Za-z0-9_-]{40})\b | |
| confidence: low | |
| - name: Cloudflarecakey | |
| regex: (?:cloudflare).{0,40}\b(v[A-Za-z0-9._-]{173,})\b | |
| confidence: high | |
| - name: Cloudimage | |
| regex: (?:cloudimage).{0,40}\b([a-z0-9_]{30})\b | |
| confidence: high | |
| - name: Cloudinary Credentials | |
| regex: cloudinary://[0-9]+:[A-Za-z0-9\-_\.]+@[A-Za-z0-9\-_\.]+ | |
| confidence: high | |
| - name: Cloudmersive | |
| regex: (?:cloudmersive).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Cloudplan | |
| regex: (?:cloudplan).{0,40}\b([A-Z0-9-]{32})\b | |
| confidence: high | |
| - name: Cloverly | |
| regex: (?:cloverly).{0,40}\b([a-z0-9:_]{28})\b | |
| confidence: high | |
| - name: Cloze - 1 | |
| regex: (?:cloze).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Cloze - 2 | |
| regex: (?:cloze).{0,40}\b([\w\.-]+@[\w-]+\.[\w\.-]{2,5})\b | |
| confidence: high | |
| - name: Clustdoc | |
| regex: (?:clustdoc).{0,40}\b([0-9a-zA-Z]{60})\b | |
| confidence: high | |
| - name: Codacy | |
| regex: (?:codacy).{0,40}\b([0-9A-Za-z]{20})\b | |
| confidence: high | |
| - name: Coinapi | |
| regex: (?:coinapi).{0,40}\b([A-Z0-9-]{36})\b | |
| confidence: high | |
| - name: Coinbase | |
| regex: (?:coinbase).{0,40}\b([a-zA-Z-0-9]{64})\b | |
| confidence: high | |
| - name: Coinlayer | |
| regex: (?:coinlayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Coinlib | |
| regex: (?:coinlib).{0,40}\b([a-z0-9]{16})\b | |
| confidence: high | |
| - name: Column | |
| regex: (?:column).{0,40}\b((?:test|live)_[a-zA-Z0-9]{27})\b | |
| confidence: high | |
| - name: Commercejs | |
| regex: (?:commercejs).{0,40}\b([a-z0-9_]{48})\b | |
| confidence: high | |
| - name: Commodities | |
| regex: (?:commodities).{0,40}\b([a-zA-Z0-9]{60})\b | |
| confidence: high | |
| - name: Companyhub - 1 | |
| regex: (?:companyhub).{0,40}\b([0-9a-zA-Z]{20})\b | |
| confidence: high | |
| - name: Companyhub - 2 | |
| regex: (?:companyhub).{0,40}\b([a-zA-Z0-9$%^=-]{4,32})\b | |
| confidence: high | |
| - name: Confluent - 1 | |
| regex: (?:confluent).{0,40}\b([a-zA-Z-0-9]{16})\b | |
| confidence: high | |
| - name: Confluent - 2 | |
| regex: (?:confluent).{0,40}\b([a-zA-Z-0-9]{64})\b | |
| confidence: high | |
| - name: Convertkit | |
| regex: (?:convertkit).{0,40}\b([a-z0-9A-Z_]{22})\b | |
| confidence: high | |
| - name: Convier | |
| regex: (?:convier).{0,40}\b([0-9]{2}\|[a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Copper - 2 | |
| regex: (?:copper).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Countrylayer | |
| regex: (?:countrylayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Courier | |
| regex: (?:courier).{0,40}\b(pk\_[a-zA-Z0-9]{1,}\_[a-zA-Z0-9]{28})\b | |
| confidence: high | |
| - name: Coveralls | |
| regex: (?:coveralls).{0,40}\b([a-zA-Z0-9-]{37})\b | |
| confidence: high | |
| - name: Crowdin | |
| regex: (?:crowdin).{0,40}\b([0-9A-Za-z]{80})\b | |
| confidence: high | |
| - name: Cryptocompare | |
| regex: (?:cryptocompare).{0,40}\b([a-z-0-9]{64})\b | |
| confidence: high | |
| - name: Currencycloud - 1 | |
| regex: (?:currencycloud).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Currencyfreaks | |
| regex: (?:currencyfreaks).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Currencylayer | |
| regex: (?:currencylayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Currencyscoop | |
| regex: (?:currencyscoop).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Currentsapi | |
| regex: (?:currentsapi).{0,40}\b([a-zA-Z0-9\S]{48})\b | |
| confidence: high | |
| - name: Customerguru - 1 | |
| regex: (?:guru).{0,40}\b([a-z0-9A-Z]{50})\b | |
| confidence: high | |
| - name: Customerguru - 2 | |
| regex: (?:guru).{0,40}\b([a-z0-9A-Z]{30})\b | |
| confidence: high | |
| - name: Customerio | |
| regex: (?:customer).{0,40}\b([a-z0-9A-Z]{20})\b | |
| confidence: low | |
| - name: D7network | |
| regex: (?:d7network).{0,40}\b([a-zA-Z0-9\W\S]{23}\=) | |
| confidence: high | |
| - name: Dailyco | |
| regex: (?:daily).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Dandelion | |
| regex: (?:dandelion).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Databricks | |
| regex: dapi[a-f0-9]{32}\b | |
| confidence: high | |
| - name: Datadogtoken - 1 | |
| regex: (?:datadog).{0,40}\b([a-zA-Z-0-9]{32})\b | |
| confidence: low | |
| - name: Datadogtoken - 2 | |
| regex: (?:datadog).{0,40}\b([a-zA-Z-0-9]{40})\b | |
| confidence: low | |
| - name: Datafire | |
| regex: (?:datafire).{0,40}\b([a-z0-9\S]{175,190})\b | |
| confidence: high | |
| - name: Datagov | |
| regex: (?:data.gov).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Debounce | |
| regex: (?:debounce).{0,40}\b([a-zA-Z0-9]{13})\b | |
| confidence: low | |
| - name: Deepai | |
| regex: (?:deepai).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Deepgram | |
| regex: (?:deepgram).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Delighted | |
| regex: (?:delighted).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Deputy - 1 | |
| regex: \b([0-9a-z]{1,}.as.deputy.com)\b | |
| confidence: high | |
| - name: Deputy - 2 | |
| regex: (?:deputy).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Detectlanguage | |
| regex: (?:detectlanguage).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Dfuse | |
| regex: \b(web\_[0-9a-z]{32})\b | |
| confidence: high | |
| - name: Diffbot | |
| regex: (?:diffbot).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Digitaloceantoken | |
| regex: (?:digitalocean).{0,40}\b([A-Za-z0-9_-]{64})\b | |
| confidence: high | |
| - name: Discord Webhook | |
| regex: https://discordapp\.com/api/webhooks/[0-9]+/[A-Za-z0-9\-]+ | |
| confidence: high | |
| - name: Discordbottoken - 1 | |
| regex: (?:discord).{0,40}\b([A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27})\b | |
| confidence: high | |
| - name: Discordbottoken - 2 | |
| regex: (?:discord).{0,40}\b([0-9]{17})\b | |
| confidence: high | |
| - name: Discordwebhook | |
| regex: (https:\/\/discord.com\/api\/webhooks\/[0-9]{18}\/[0-9a-zA-Z-]{68}) | |
| confidence: high | |
| - name: Ditto | |
| regex: (?:ditto).{0,40}\b([a-z0-9]{8}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{12}\.[a-z0-9]{40})\b | |
| confidence: high | |
| - name: Dnscheck - 1 | |
| regex: (?:dnscheck).{0,40}\b([a-z0-9A-Z-]{36})\b | |
| confidence: high | |
| - name: Dnscheck - 2 | |
| regex: (?:dnscheck).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Documo | |
| regex: \b(ey[a-zA-Z0-9]{34}.ey[a-zA-Z0-9]{154}.[a-zA-Z0-9_-]{43})\b | |
| confidence: high | |
| - name: Doppler | |
| regex: \b(dp\.pt\.[a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Dotmailer - 1 | |
| regex: (?:dotmailer).{0,40}\b(apiuser-[a-z0-9]{12}@apiconnector.com)\b | |
| confidence: high | |
| - name: Dotmailer - 2 | |
| regex: (?:dotmailer).{0,40}\b([a-zA-Z0-9\S]{8,24})\b | |
| confidence: high | |
| - name: Dovico | |
| regex: (?:dovico).{0,40}\b([0-9a-z]{32}\.[0-9a-z]{1,}\b) | |
| confidence: high | |
| - name: Dronahq | |
| regex: (?:dronahq).{0,40}\b([a-z0-9]{50})\b | |
| confidence: high | |
| - name: Droneci | |
| regex: (?:droneci).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Dropbox | |
| regex: \b(sl\.[A-Za-z0-9\-\_]{130,140})\b | |
| confidence: high | |
| - name: Dwolla | |
| regex: (?:dwolla).{0,40}\b([a-zA-Z-0-9]{50})\b | |
| confidence: high | |
| - name: Dynalist | |
| regex: (?:dynalist).{0,40}\b([a-zA-Z0-9-_]{128})\b | |
| confidence: high | |
| - name: Dynatrace token | |
| regex: dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64} | |
| confidence: high | |
| - name: Dyspatch | |
| regex: (?:dyspatch).{0,40}\b([A-Z0-9]{52})\b | |
| confidence: high | |
| - name: EC | |
| regex: '-----BEGIN EC PRIVATE KEY-----' | |
| confidence: high | |
| - name: Eagleeyenetworks - 1 | |
| regex: (?:eagleeyenetworks).{0,40}\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b | |
| confidence: high | |
| - name: Eagleeyenetworks - 2 | |
| regex: (?:eagleeyenetworks).{0,40}\b([a-zA-Z0-9]{15})\b | |
| confidence: high | |
| - name: Easyinsight - 1 | |
| regex: (?:easyinsight|easy-insight).{0,40}\b([a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Easyinsight - 2 | |
| regex: (?:easyinsight|easy-insight).{0,40}\b([0-9Aa-zA-Z]{20})\b | |
| confidence: high | |
| - name: Edamam - 1 | |
| regex: (?:edamam).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Edamam - 2 | |
| regex: (?:edamam).{0,40}\b([0-9a-z]{8})\b | |
| confidence: high | |
| - name: Edenai | |
| regex: (?:edenai).{0,40}\b([a-zA-Z0-9]{36}.[a-zA-Z0-9]{92}.[a-zA-Z0-9_]{43})\b | |
| confidence: high | |
| - name: Eightxeight - 1 | |
| regex: (?:8x8).{0,40}\b([a-zA-Z0-9_]{18,30})\b | |
| confidence: low | |
| - name: Eightxeight - 2 | |
| regex: (?:8x8).{0,40}\b([a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Elasticemail | |
| regex: (?:elastic).{0,40}\b([A-Za-z0-9_-]{96})\b | |
| confidence: high | |
| - name: Enablex - 1 | |
| regex: (?:enablex).{0,40}\b([a-zA-Z0-9]{36})\b | |
| confidence: high | |
| - name: Enablex - 2 | |
| regex: (?:enablex).{0,40}\b([a-z0-9]{24})\b | |
| confidence: high | |
| - name: Enigma | |
| regex: (?:enigma).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Ethplorer | |
| regex: (?:ethplorer).{0,40}\b([a-z0-9A-Z-]{22})\b | |
| confidence: high | |
| - name: Etsyapikey | |
| regex: (?:etsy).{0,40}\b([a-zA-Z-0-9]{24})\b | |
| confidence: low | |
| - name: Everhour | |
| regex: (?:everhour).{0,40}\b([0-9Aa-f]{4}-[0-9a-f]{4}-[0-9a-f]{6}-[0-9a-f]{6}-[0-9a-f]{8})\b | |
| confidence: high | |
| - name: Exchangerateapi | |
| regex: (?:exchangerate).{0,40}\b([a-z0-9]{24})\b | |
| confidence: high | |
| - name: Exchangeratesapi | |
| regex: (?:exchangerates).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: FCM Server Key | |
| regex: AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140} | |
| confidence: low | |
| - name: FCM_server_key | |
| regex: (AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140}) | |
| confidence: low | |
| - name: Facebook Access Token | |
| regex: EAACEdEose0cBA[0-9A-Za-z]+ | |
| confidence: high | |
| - name: Facebook OAuth | |
| regex: '[fF][aA][cC][eE][bB][oO][oO][kK].*[''|"][0-9a-f]{32}[''|"]' | |
| confidence: low | |
| - name: Facebookoauth | |
| regex: (?:facebook).{0,40}\b([A-Za-z0-9]{32})\b | |
| confidence: low | |
| - name: Faceplusplus | |
| regex: (?:faceplusplus).{0,40}\b([0-9a-zA-Z_-]{32})\b | |
| confidence: high | |
| - name: Fakejson | |
| regex: (?:fakejson).{0,40}\b([a-zA-Z0-9]{22})\b | |
| confidence: high | |
| - name: Fastforex | |
| regex: (?:fastforex).{0,40}\b([a-z0-9-]{28})\b | |
| confidence: high | |
| - name: Fastlypersonaltoken | |
| regex: (?:fastly).{0,40}\b([A-Za-z0-9_-]{32})\b | |
| confidence: high | |
| - name: Feedier | |
| regex: (?:feedier).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Fetchrss | |
| regex: (?:fetchrss).{0,40}\b([0-9A-Za-z.]{40})\b | |
| confidence: high | |
| - name: Figmapersonalaccesstoken | |
| regex: (?:figma).{0,40}\b([0-9]{6}-[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Fileio | |
| regex: (?:fileio).{0,40}\b([A-Z0-9.-]{39})\b | |
| confidence: high | |
| - name: Finage | |
| regex: \b(API_KEY[0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Financialmodelingprep | |
| regex: (?:financialmodelingprep).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Findl | |
| regex: (?:findl).{0,40}\b([a-z0-9]{8}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Finnhub | |
| regex: (?:finnhub).{0,40}\b([0-9a-z]{20})\b | |
| confidence: high | |
| - name: Firebase Database Detect - 1 | |
| regex: '[a-z0-9.-]+\.firebaseio\.com' | |
| confidence: low | |
| - name: Firebase Database Detect - 2 | |
| regex: '[a-z0-9.-]+\.firebaseapp\.com' | |
| confidence: low | |
| - name: Fixerio | |
| regex: (?:fixer).{0,40}\b([A-Za-z0-9]{32})\b | |
| confidence: high | |
| - name: Flatio | |
| regex: (?:flat).{0,40}\b([0-9a-z]{128})\b | |
| confidence: high | |
| - name: Fleetbase | |
| regex: \b(flb_live_[0-9a-zA-Z]{20})\b | |
| confidence: high | |
| - name: Flickr | |
| regex: (?:flickr).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Flightapi | |
| regex: (?:flightapi).{0,40}\b([a-z0-9]{24})\b | |
| confidence: high | |
| - name: Flightstats - 1 | |
| regex: (?:flightstats).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Flightstats - 2 | |
| regex: (?:flightstats).{0,40}\b([0-9a-z]{8})\b | |
| confidence: high | |
| - name: Float | |
| regex: (?:float).{0,40}\b([a-zA-Z0-9-._+=]{59,60})\b | |
| confidence: low | |
| - name: Flowflu - 2 | |
| regex: (?:flowflu).{0,40}\b([a-zA-Z0-9]{51})\b | |
| confidence: high | |
| - name: Flutterwave | |
| regex: \b(FLWSECK-[0-9a-z]{32}-X)\b | |
| confidence: high | |
| - name: Fmfw - 1 | |
| regex: (?:fmfw).{0,40}\b([a-zA-Z0-9-]{32})\b | |
| confidence: high | |
| - name: Fmfw - 2 | |
| regex: (?:fmfw).{0,40}\b([a-zA-Z0-9_-]{32})\b | |
| confidence: high | |
| - name: Formbucket | |
| regex: (?:formbucket).{0,40}\b([0-9A-Za-z]{1,}.[0-9A-Za-z]{1,}\.[0-9A-Z-a-z\-_]{1,}) | |
| confidence: high | |
| - name: Formio | |
| regex: (?:formio).{0,40}\b(eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[0-9A-Za-z]{310}\.[0-9A-Z-a-z\-_]{43}[ | |
| \r\n]{1}) | |
| confidence: high | |
| - name: Foursquare | |
| regex: (?:foursquare).{0,40}\b([0-9A-Z]{48})\b | |
| confidence: high | |
| - name: Frameio | |
| regex: \b(fio-u-[0-9a-zA-Z_-]{64})\b | |
| confidence: high | |
| - name: Freshbooks - 1 | |
| regex: (?:freshbooks).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Freshbooks - 2 | |
| regex: (?:freshbooks).{0,40}\b(https://www.[0-9A-Za-z_-]{1,}.com)\b | |
| confidence: high | |
| - name: Freshdesk - 1 | |
| regex: (?:freshdesk).{0,40}\b([0-9A-Za-z]{20})\b | |
| confidence: high | |
| - name: Freshdesk - 2 | |
| regex: \b([0-9a-z-]{1,}.freshdesk.com)\b | |
| confidence: high | |
| - name: Front | |
| regex: (?:front).{0,40}\b([0-9a-zA-Z]{36}.[0-9a-zA-Z\.\-\_]{188,244})\b | |
| confidence: high | |
| - name: Fulcrum | |
| regex: (?:fulcrum).{0,40}\b([a-z0-9]{80})\b | |
| confidence: high | |
| - name: Fullstory | |
| regex: (?:fullstory).{0,40}\b([a-zA-Z-0-9/+]{88})\b | |
| confidence: high | |
| - name: Fusebill | |
| regex: (?:fusebill).{0,40}\b([a-zA-Z0-9]{88})\b | |
| confidence: high | |
| - name: Fxmarket | |
| regex: (?:fxmarket).{0,40}\b([0-9Aa-zA-Z-_=]{20})\b | |
| confidence: high | |
| - name: Gcp | |
| regex: \{[^{]+auth_provider_x509_cert_url[^}]+\} | |
| confidence: high | |
| - name: Geckoboard | |
| regex: (?:geckoboard).{0,40}\b([a-zA-Z0-9]{44})\b | |
| confidence: high | |
| - name: Generic - 1376 | |
| regex: jdbc:mysql(=| =|:| :) | |
| confidence: high | |
| - name: Generic - 1688 | |
| regex: TOKEN[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10} | |
| confidence: low | |
| - name: Generic - 1689 | |
| regex: API[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10} | |
| confidence: low | |
| - name: Generic - 1691 | |
| regex: SECRET[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10} | |
| confidence: low | |
| - name: Generic - 1692 | |
| regex: AUTHORIZATION[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10} | |
| confidence: low | |
| - name: Generic - 1693 | |
| regex: PASSWORD[\\-|_|A-Z0-9]*(\'|\")?(:|=)(\'|\")?[\\-|_|A-Z0-9]{10} | |
| confidence: low | |
| - name: Generic - 1695 | |
| regex: (A|a)(P|p)(Ii)[\-|_|A-Za-z0-9]*(\''|")?( )*(:|=)( )*(\''|")?[0-9A-Za-z\-_]+(\''|")? | |
| confidence: low | |
| - name: Generic - 1700 | |
| regex: BEGIN OPENSSH PRIVATE KEY | |
| confidence: high | |
| - name: Generic - 1701 | |
| regex: BEGIN PRIVATE KEY | |
| confidence: high | |
| - name: Generic - 1702 | |
| regex: BEGIN RSA PRIVATE KEY | |
| confidence: high | |
| - name: Generic - 1703 | |
| regex: BEGIN DSA PRIVATE KEY | |
| confidence: high | |
| - name: Generic - 1704 | |
| regex: BEGIN EC PRIVATE KEY | |
| confidence: high | |
| - name: Generic - 1705 | |
| regex: BEGIN PGP PRIVATE KEY BLOCK | |
| confidence: high | |
| - name: Generic - 1707 | |
| regex: '[a-z0-9.-]+\.s3-[a-z0-9-]\.amazonaws\.com' | |
| confidence: low | |
| - name: Generic - 1708 | |
| regex: '[a-z0-9.-]+\.s3-website[.-](eu|ap|us|ca|sa|cn)' | |
| confidence: low | |
| - name: Generic - 1710 | |
| regex: algolia_api_key | |
| confidence: high | |
| - name: Generic - 1711 | |
| regex: asana_access_token | |
| confidence: high | |
| - name: Generic - 1713 | |
| regex: azure_tenant | |
| confidence: high | |
| - name: Generic - 1714 | |
| regex: bitly_access_token | |
| confidence: high | |
| - name: Generic - 1715 | |
| regex: branchio_secret | |
| confidence: low | |
| - name: Generic - 1716 | |
| regex: browserstack_access_key | |
| confidence: high | |
| - name: Generic - 1717 | |
| regex: buildkite_access_token | |
| confidence: high | |
| - name: Generic - 1718 | |
| regex: comcast_access_token | |
| confidence: high | |
| - name: Generic - 1719 | |
| regex: datadog_api_key | |
| confidence: high | |
| - name: Generic - 1720 | |
| regex: deviantart_secret | |
| confidence: high | |
| - name: Generic - 1721 | |
| regex: deviantart_access_token | |
| confidence: high | |
| - name: Generic - 1722 | |
| regex: dropbox_api_token | |
| confidence: high | |
| - name: Generic - 1723 | |
| regex: facebook_appsecret | |
| confidence: high | |
| - name: Generic - 1724 | |
| regex: facebook_access_token | |
| confidence: high | |
| - name: Generic - 1725 | |
| regex: firebase_custom_token | |
| confidence: high | |
| - name: Generic - 1726 | |
| regex: firebase_id_token | |
| confidence: high | |
| - name: Generic - 1727 | |
| regex: github_client | |
| confidence: high | |
| - name: Generic - 1728 | |
| regex: github_ssh_key | |
| confidence: high | |
| - name: Generic - 1730 | |
| regex: gitlab_private_token | |
| confidence: high | |
| - name: Generic - 1731 | |
| regex: google_cm | |
| confidence: low | |
| - name: Generic - 1732 | |
| regex: google_maps_key | |
| confidence: low | |
| - name: Generic - 1733 | |
| regex: heroku_api_key | |
| confidence: high | |
| - name: Generic - 1734 | |
| regex: instagram_access_token | |
| confidence: high | |
| - name: Generic - 1735 | |
| regex: mailchimp_api_key | |
| confidence: high | |
| - name: Generic - 1736 | |
| regex: mailgun_api_key | |
| confidence: high | |
| - name: Generic - 1737 | |
| regex: mailjet | |
| confidence: low | |
| - name: Generic - 1738 | |
| regex: mapbox_access_token | |
| confidence: low | |
| - name: Generic - 1739 | |
| regex: pagerduty_api_token | |
| confidence: high | |
| - name: Generic - 1740 | |
| regex: paypal_key_sb | |
| confidence: high | |
| - name: Generic - 1741 | |
| regex: paypal_key_live | |
| confidence: high | |
| - name: Generic - 1742 | |
| regex: paypal_token_sb | |
| confidence: high | |
| - name: Generic - 1743 | |
| regex: paypal_token_live | |
| confidence: high | |
| - name: Generic - 1744 | |
| regex: pendo_integration_key | |
| confidence: high | |
| - name: Generic - 1745 | |
| regex: salesforce_access_token | |
| confidence: high | |
| - name: Generic - 1746 | |
| regex: saucelabs_ukey | |
| confidence: high | |
| - name: Generic - 1747 | |
| regex: sendgrid_api_key | |
| confidence: high | |
| - name: Generic - 1748 | |
| regex: slack_api_token | |
| confidence: high | |
| - name: Generic - 1749 | |
| regex: slack_webhook | |
| confidence: low | |
| - name: Generic - 1750 | |
| regex: square_secret | |
| confidence: low | |
| - name: Generic - 1751 | |
| regex: square_auth_token | |
| confidence: high | |
| - name: Generic - 1752 | |
| regex: travisci_api_token | |
| confidence: high | |
| - name: Generic - 1753 | |
| regex: twilio_sid_token | |
| confidence: low | |
| - name: Generic - 1754 | |
| regex: twitter_api_secret | |
| confidence: high | |
| - name: Generic - 1755 | |
| regex: twitter_bearer_token | |
| confidence: high | |
| - name: Generic - 1756 | |
| regex: spotify_access_token | |
| confidence: high | |
| - name: Generic - 1757 | |
| regex: stripe_key_live | |
| confidence: high | |
| - name: Generic - 1758 | |
| regex: wakatime_api_key | |
| confidence: high | |
| - name: Generic - 1759 | |
| regex: wompi_auth_bearer_sb | |
| confidence: high | |
| - name: Generic - 1760 | |
| regex: wompi_auth_bearer_live | |
| confidence: high | |
| - name: Generic - 1761 | |
| regex: wpengine_api_key | |
| confidence: high | |
| - name: Generic - 1762 | |
| regex: zapier_webhook | |
| confidence: low | |
| - name: Generic - 1763 | |
| regex: zendesk_access_token | |
| confidence: high | |
| - name: Generic - 1764 | |
| regex: ssh-rsa | |
| confidence: high | |
| - name: Generic - 1765 | |
| regex: s3-[a-z0-9-]+\.amazonaws\.com/[a-z0-9._-]+ | |
| confidence: low | |
| - name: Generic Secret | |
| regex: '[sS][eE][cC][rR][eE][tT].*[''|"][0-9a-zA-Z]{32,45}[''|"]' | |
| confidence: low | |
| - name: Generic webhook secret | |
| regex: (webhook).+(secret|token|key).+ | |
| confidence: low | |
| - name: Gengo | |
| regex: (?:gengo).{0,40}([ ]{0,1}[0-9a-zA-Z\[\]\-\(\)\{\}|_^@$=~]{64}[ \r\n]{1}) | |
| confidence: high | |
| - name: Geoapify | |
| regex: (?:geoapify).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Geocode | |
| regex: (?:geocode).{0,40}\b([a-z0-9]{28})\b | |
| confidence: high | |
| - name: Geocodify | |
| regex: (?:geocodify).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Geocodio - 2 | |
| regex: (?:geocod).{0,40}\b([a-z0-9]{39})\b | |
| confidence: high | |
| - name: Geoipifi | |
| regex: (?:ipifi).{0,40}\b([a-z0-9A-Z_]{32})\b | |
| confidence: high | |
| - name: Getemail | |
| regex: (?:getemail).{0,40}\b([a-zA-Z0-9-]{20})\b | |
| confidence: high | |
| - name: Getemails - 1 | |
| regex: (?:getemails).{0,40}\b([a-z0-9-]{26})\b | |
| confidence: high | |
| - name: Getemails - 2 | |
| regex: (?:getemails).{0,40}\b([a-z0-9-]{18})\b | |
| confidence: high | |
| - name: Getgeoapi | |
| regex: (?:getgeoapi).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Getgist | |
| regex: (?:getgist).{0,40}\b([a-z0-9A-Z+=]{68}) | |
| confidence: high | |
| - name: Getsandbox - 1 | |
| regex: (?:getsandbox).{0,40}\b([a-z0-9-]{40})\b | |
| confidence: high | |
| - name: Getsandbox - 2 | |
| regex: (?:getsandbox).{0,40}\b([a-z0-9-]{15,30})\b | |
| confidence: high | |
| - name: GitHub | |
| regex: '[gG][iI][tT][hH][uU][bB].*[''|"][0-9a-zA-Z]{35,40}[''|"]' | |
| confidence: low | |
| - name: Github - 2 | |
| regex: \b((?:ghp|gho|ghu|ghs|ghr)_[a-zA-Z0-9]{36,255}\b) | |
| confidence: high | |
| - name: Github App Token | |
| regex: (ghu|ghs)_[0-9a-zA-Z]{36} | |
| confidence: high | |
| - name: Github OAuth Access Token | |
| regex: gho_[0-9a-zA-Z]{36} | |
| confidence: high | |
| - name: Github Personal Access Token | |
| regex: ghp_[0-9a-zA-Z]{36} | |
| confidence: high | |
| - name: Github Refresh Token | |
| regex: ghr_[0-9a-zA-Z]{76} | |
| confidence: high | |
| - name: Github_old | |
| regex: (?:github)[^\.].{0,40}[ =:'"]+([a-f0-9]{40})\b | |
| confidence: high | |
| - name: Githubapp - 1 | |
| regex: (?:github).{0,40}\b([0-9]{6})\b | |
| confidence: low | |
| - name: Githubapp - 2 | |
| regex: (?:github).{0,40}(-----BEGIN RSA PRIVATE KEY-----\s[A-Za-z0-9+\/\s]*\s-----END | |
| RSA PRIVATE KEY-----) | |
| confidence: high | |
| - name: Gitlab | |
| regex: (?:gitlab).{0,40}\b([a-zA-Z0-9\-=_]{20,22})\b | |
| confidence: low | |
| - name: Gitlabv2 | |
| regex: \b(glpat-[a-zA-Z0-9\-=_]{20,22})\b | |
| confidence: high | |
| - name: Gitter | |
| regex: (?:gitter).{0,40}\b([a-z0-9-]{40})\b | |
| confidence: high | |
| - name: Glassnode | |
| regex: (?:glassnode).{0,40}\b([0-9A-Za-z]{27})\b | |
| confidence: high | |
| - name: Gocanvas - 1 | |
| regex: (?:gocanvas).{0,40}\b([0-9A-Za-z/+]{43}=[ \r\n]{1}) | |
| confidence: high | |
| - name: Gocanvas - 2 | |
| regex: (?:gocanvas).{0,40}\b([\w\.-]+@[\w-]+\.[\w\.-]{2,5})\b | |
| confidence: high | |
| - name: Gocardless | |
| regex: \b(live_[0-9A-Za-z\_\-]{40}[ "'\r\n]{1}) | |
| confidence: high | |
| - name: Goodday | |
| regex: (?:goodday).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Google (GCP) Service Account | |
| regex: '"type": "service_account"' | |
| confidence: high | |
| - name: Google API Key | |
| regex: AIza[0-9a-z-_]{35} | |
| confidence: high | |
| - name: Google Calendar URI | |
| regex: https://www\.google\.com/calendar/embed\?src=[A-Za-z0-9%@&;=\-_\./]+ | |
| confidence: high | |
| - name: Google OAuth Access Token | |
| regex: ya29\.[0-9A-Za-z\-_]+ | |
| confidence: high | |
| - name: Graphcms - 1 | |
| regex: (?:graph).{0,40}\b([a-z0-9]{25})\b | |
| confidence: high | |
| - name: Graphcms - 2 | |
| regex: \b(ey[a-zA-Z0-9]{73}.ey[a-zA-Z0-9]{365}.[a-zA-Z0-9_-]{683})\b | |
| confidence: high | |
| - name: Graphhopper | |
| regex: (?:graphhopper).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Groovehq | |
| regex: (?:groove).{0,40}\b([a-z0-9A-Z]{64}) | |
| confidence: high | |
| - name: Guru - 1 | |
| regex: (?:guru).{0,40}\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b | |
| confidence: high | |
| - name: Guru - 2 | |
| regex: (?:guru).{0,40}\b([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Gyazo | |
| regex: (?:gyazo).{0,40}\b([0-9A-Za-z-]{43})\b | |
| confidence: high | |
| - name: Happi | |
| regex: (?:happi).{0,40}\b([a-zA-Z0-9]{56}) | |
| confidence: high | |
| - name: Happyscribe | |
| regex: (?:happyscribe).{0,40}\b([0-9a-zA-Z]{24})\b | |
| confidence: high | |
| - name: Harvest - 1 | |
| regex: (?:harvest).{0,40}\b([a-z0-9A-Z._]{97})\b | |
| confidence: high | |
| - name: Harvest - 2 | |
| regex: (?:harvest).{0,40}\b([0-9]{4,9})\b | |
| confidence: low | |
| - name: Hellosign | |
| regex: (?:hellosign).{0,40}\b([a-zA-Z-0-9/+]{64})\b | |
| confidence: high | |
| - name: Helpcrunch | |
| regex: (?:helpcrunch).{0,40}\b([a-zA-Z-0-9+/=]{328}) | |
| confidence: high | |
| - name: Helpscout | |
| regex: (?:helpscout).{0,40}\b([A-Za-z0-9]{56})\b | |
| confidence: high | |
| - name: Hereapi | |
| regex: (?:hereapi).{0,40}\b([a-zA-Z0-9\S]{43})\b | |
| confidence: high | |
| - name: Heroku | |
| regex: (?:heroku).{0,40}\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Hive - 1 | |
| regex: (?:hive).{0,40}\b([0-9a-z]{32})\b | |
| confidence: low | |
| - name: Hive - 2 | |
| regex: (?:hive).{0,40}\b([0-9A-Za-z]{17})\b | |
| confidence: high | |
| - name: Hiveage | |
| regex: (?:hiveage).{0,40}\b([0-9A-Za-z\_\-]{20})\b | |
| confidence: high | |
| - name: Holidayapi | |
| regex: (?:holidayapi).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Host | |
| regex: (?:host).{0,40}\b([a-z0-9]{14})\b | |
| confidence: low | |
| - name: Html2pdf | |
| regex: (?:html2pdf).{0,40}\b([a-zA-Z0-9]{64})\b | |
| confidence: high | |
| - name: Hubspotapikey | |
| regex: (?:hubspot).{0,40}\b([A-Za-z0-9]{8}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{12})\b | |
| confidence: high | |
| - name: Humanity | |
| regex: (?:humanity).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Hunter | |
| regex: (?:hunter).{0,40}\b([a-z0-9_-]{40})\b | |
| confidence: low | |
| - name: Hypertrack - 1 | |
| regex: (?:hypertrack).{0,40}\b([0-9a-zA-Z\_\-]{54})\b | |
| confidence: high | |
| - name: Hypertrack - 2 | |
| regex: (?:hypertrack).{0,40}\b([0-9a-zA-Z\_\-]{27})\b | |
| confidence: high | |
| - name: Ibmclouduserkey | |
| regex: (?:ibm).{0,40}\b([A-Za-z0-9_-]{44})\b | |
| confidence: high | |
| - name: Iconfinder | |
| regex: (?:iconfinder).{0,40}\b([a-zA-Z0-9]{64})\b | |
| confidence: high | |
| - name: Iexcloud | |
| regex: (?:iexcloud).{0,40}\b([a-z0-9_]{35})\b | |
| confidence: high | |
| - name: Imagekit | |
| regex: (?:imagekit).{0,40}\b([a-zA-Z0-9_=]{36}) | |
| confidence: high | |
| - name: Imagga | |
| regex: (?:imagga).{0,40}\b([a-z0-9A-Z=]{72}) | |
| confidence: high | |
| - name: Impala | |
| regex: (?:impala).{0,40}\b([0-9A-Za-z_]{46})\b | |
| confidence: high | |
| - name: Insightly | |
| regex: (?:insightly).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Integromat | |
| regex: (?:integromat).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Intercom | |
| regex: (?:intercom).{0,40}\b([a-zA-Z0-9\W\S]{59}\=) | |
| confidence: low | |
| - name: Intrinio | |
| regex: (?:intrinio).{0,40}\b([a-zA-Z0-9]{44})\b | |
| confidence: high | |
| - name: Invoiceocean - 1 | |
| regex: (?:invoiceocean).{0,40}\b([0-9A-Za-z]{20})\b | |
| confidence: high | |
| - name: Invoiceocean - 2 | |
| regex: \b([0-9a-z]{1,}.invoiceocean.com)\b | |
| confidence: high | |
| - name: Ipapi | |
| regex: (?:ipapi).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Ipgeolocation | |
| regex: (?:ipgeolocation).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Ipify | |
| regex: (?:ipify).{0,40}\b([a-zA-Z0-9_-]{32})\b | |
| confidence: high | |
| - name: Ipinfodb | |
| regex: (?:ipinfodb).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Ipquality | |
| regex: (?:ipquality).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Ipstack | |
| regex: (?:ipstack).{0,40}\b([a-fA-f0-9]{32})\b | |
| confidence: high | |
| - name: JDBC Connection String | |
| regex: jdbc:[a-z:]+://[A-Za-z0-9\.\-_:;=/@?,&]+ | |
| confidence: high | |
| - name: Jiratoken - 1 | |
| regex: (?:jira).{0,40}\b([a-zA-Z-0-9]{24})\b | |
| confidence: high | |
| - name: Jiratoken - 2 | |
| regex: (?:jira).{0,40}\b([a-zA-Z-0-9]{5,24}\@[a-zA-Z-0-9]{3,16}\.com)\b | |
| confidence: high | |
| - name: Jiratoken - 3 | |
| regex: (?:jira).{0,40}\b([a-zA-Z-0-9]{5,24}\.[a-zA-Z-0-9]{3,16}\.[a-zA-Z-0-9]{3,16})\b | |
| confidence: low | |
| - name: Jotform | |
| regex: (?:jotform).{0,40}\b([0-9Aa-z]{32})\b | |
| confidence: high | |
| - name: Jumpcloud | |
| regex: (?:jumpcloud).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Juro | |
| regex: (?:juro).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Kanban - 1 | |
| regex: (?:kanban).{0,40}\b([0-9A-Z]{12})\b | |
| confidence: high | |
| - name: Kanban - 2 | |
| regex: \b([0-9a-z]{1,}.kanbantool.com)\b | |
| confidence: high | |
| - name: Karmacrm | |
| regex: (?:karma).{0,40}\b([a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Keenio - 1 | |
| regex: (?:keen).{0,40}\b([0-9a-z]{24})\b | |
| confidence: high | |
| - name: Keenio - 2 | |
| regex: (?:keen).{0,40}\b([0-9A-Z]{64})\b | |
| confidence: high | |
| - name: Kickbox | |
| regex: (?:kickbox).{0,40}\b([a-zA-Z0-9_]+[a-zA-Z0-9]{64})\b | |
| confidence: high | |
| - name: Klipfolio | |
| regex: (?:klipfolio).{0,40}\b([0-9a-f]{40})\b | |
| confidence: high | |
| - name: Kontent | |
| regex: (?:kontent).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Kraken - 1 | |
| regex: (?:kraken).{0,40}\b([0-9A-Za-z\/\+=]{56}[ "'\r\n]{1}) | |
| confidence: high | |
| - name: Kraken - 2 | |
| regex: (?:kraken).{0,40}\b([0-9A-Za-z\/\+=]{86,88}[ "'\r\n]{1}) | |
| confidence: high | |
| - name: Kucoin - 1 | |
| regex: (?:kucoin).{0,40}([ \r\n]{1}[!-~]{7,32}[ \r\n]{1}) | |
| confidence: high | |
| - name: Kucoin - 2 | |
| regex: (?:kucoin).{0,40}\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Kucoin - 3 | |
| regex: (?:kucoin).{0,40}\b([0-9a-f]{24})\b | |
| confidence: high | |
| - name: Kylas | |
| regex: (?:kylas).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Languagelayer | |
| regex: (?:languagelayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Lastfm | |
| regex: (?:lastfm).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Launchdarkly | |
| regex: (?:launchdarkly).{0,40}\b([a-z0-9-]{40})\b | |
| confidence: high | |
| - name: Leadfeeder | |
| regex: (?:leadfeeder).{0,40}\b([a-zA-Z0-9-]{43})\b | |
| confidence: high | |
| - name: Lendflow | |
| regex: (?:lendflow).{0,40}\b([a-zA-Z0-9]{36}\.[a-zA-Z0-9]{235}\.[a-zA-Z0-9]{32}\-[a-zA-Z0-9]{47}\-[a-zA-Z0-9_]{162}\-[a-zA-Z0-9]{42}\-[a-zA-Z0-9_]{40}\-[a-zA-Z0-9_]{66}\-[a-zA-Z0-9_]{59}\-[a-zA-Z0-9]{7}\-[a-zA-Z0-9_]{220})\b | |
| confidence: high | |
| - name: Lessannoyingcrm | |
| regex: (?:less).{0,40}\b([a-zA-Z0-9-]{57})\b | |
| confidence: low | |
| - name: Lexigram | |
| regex: (?:lexigram).{0,40}\b([a-zA-Z0-9\S]{301})\b | |
| confidence: high | |
| - name: Linearapi | |
| regex: \b(lin_api_[0-9A-Za-z]{40})\b | |
| confidence: high | |
| - name: Linemessaging | |
| regex: (?:line).{0,40}\b([A-Za-z0-9+/]{171,172})\b | |
| confidence: high | |
| - name: Linenotify | |
| regex: (?:linenotify).{0,40}\b([0-9A-Za-z]{43})\b | |
| confidence: high | |
| - name: Linkpreview | |
| regex: (?:linkpreview).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Liveagent | |
| regex: (?:liveagent).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Livestorm | |
| regex: (?:livestorm).{0,40}\b(eyJhbGciOiJIUzI1NiJ9\.eyJhdWQiOiJhcGkubGl2ZXN0b3JtLmNvIiwianRpIjoi[0-9A-Z-a-z]{134}\.[0-9A-Za-z\-\_]{43}[ | |
| \r\n]{1}) | |
| confidence: high | |
| - name: Locationiq | |
| regex: \b(pk\.[a-zA-Z-0-9]{32})\b | |
| confidence: high | |
| - name: Loginradius | |
| regex: (?:loginradius).{0,40}\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Lokalisetoken | |
| regex: (?:lokalise).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: Loyverse | |
| regex: (?:loyverse).{0,40}\b([0-9-a-z]{32})\b | |
| confidence: high | |
| - name: Luno - 1 | |
| regex: (?:luno).{0,40}\b([a-z0-9]{13})\b | |
| confidence: high | |
| - name: Luno - 2 | |
| regex: (?:luno).{0,40}\b([a-zA-Z0-9_-]{43})\b | |
| confidence: high | |
| - name: M3o | |
| regex: (?:m3o).{0,40}\b([0-9A-Za-z]{48})\b | |
| confidence: low | |
| - name: Macaddress | |
| regex: (?:macaddress).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Madkudu | |
| regex: (?:madkudu).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Magnetic | |
| regex: (?:magnetic).{0,40}\b([0-9Aa-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: MailChimp API Key | |
| regex: '[0-9a-f]{32}-us[0-9]{1,2}' | |
| confidence: high | |
| - name: Mailboxlayer | |
| regex: (?:mailboxlayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Mailerlite | |
| regex: (?:mailerlite).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Mailgun - 2 | |
| regex: (?:mailgun).{0,40}\b([a-zA-Z-0-9]{72})\b | |
| confidence: high | |
| - name: Mailgun API Key - 1 | |
| regex: key-[0-9a-zA-Z]{32} | |
| confidence: high | |
| - name: Mailgun API key - 2 | |
| regex: (mailgun|mg)[0-9a-z]{32} | |
| confidence: low | |
| - name: Mailjetbasicauth | |
| regex: (?:mailjet).{0,40}\b([A-Za-z0-9]{87}\=) | |
| confidence: high | |
| - name: Mailjetsms | |
| regex: (?:mailjet).{0,40}\b([A-Za-z0-9]{32})\b | |
| confidence: high | |
| - name: Mailmodo | |
| regex: (?:mailmodo).{0,40}\b([A-Z0-9]{7}-[A-Z0-9]{7}-[A-Z0-9]{7}-[A-Z0-9]{7})\b | |
| confidence: high | |
| - name: Mailsac | |
| regex: (?:mailsac).{0,40}\b(k_[0-9A-Za-z]{36,})\b | |
| confidence: high | |
| - name: Mandrill | |
| regex: (?:mandrill).{0,40}\b([A-Za-z0-9_-]{22})\b | |
| confidence: high | |
| - name: Manifest | |
| regex: (?:manifest).{0,40}\b([a-zA-z0-9]{32})\b | |
| confidence: low | |
| - name: Mapbox - 2 | |
| regex: \b(sk\.[a-zA-Z-0-9\.]{80,240})\b | |
| confidence: high | |
| - name: Mapquest | |
| regex: (?:mapquest).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Marketstack | |
| regex: (?:marketstack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Mattermostpersonaltoken - 1 | |
| regex: (?:mattermost).{0,40}\b([A-Za-z0-9-_]{1,}.cloud.mattermost.com)\b | |
| confidence: high | |
| - name: Mattermostpersonaltoken - 2 | |
| regex: (?:mattermost).{0,40}\b([a-z0-9]{26})\b | |
| confidence: high | |
| - name: Mavenlink | |
| regex: (?:mavenlink).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Maxmindlicense - 1 | |
| regex: (?:maxmind|geoip).{0,40}\b([0-9A-Za-z]{16})\b | |
| confidence: high | |
| - name: Maxmindlicense - 2 | |
| regex: (?:maxmind|geoip).{0,40}\b([0-9]{2,7})\b | |
| confidence: high | |
| - name: Meaningcloud | |
| regex: (?:meaningcloud).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Mediastack | |
| regex: (?:mediastack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Meistertask | |
| regex: (?:meistertask).{0,40}\b([a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Mesibo | |
| regex: (?:mesibo).{0,40}\b([0-9A-Za-z]{64})\b | |
| confidence: high | |
| - name: Messagebird | |
| regex: (?:messagebird).{0,40}\b([A-Za-z0-9_-]{25})\b | |
| confidence: high | |
| - name: Metaapi - 1 | |
| regex: (?:metaapi|meta-api).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Metaapi - 2 | |
| regex: (?:metaapi|meta-api).{0,40}\b([0-9a-f]{24})\b | |
| confidence: high | |
| - name: Metrilo | |
| regex: (?:metrilo).{0,40}\b([a-z0-9]{16})\b | |
| confidence: high | |
| - name: Microsoft Teams Webhook | |
| regex: https://outlook\.office\.com/webhook/[A-Za-z0-9\-@]+/IncomingWebhook/[A-Za-z0-9\-]+/[A-Za-z0-9\-]+ | |
| confidence: low | |
| - name: Microsoftteamswebhook | |
| regex: (https:\/\/[a-zA-Z-0-9]+\.webhook\.office\.com\/webhookb2\/[a-zA-Z-0-9]{8}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{12}\@[a-zA-Z-0-9]{8}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{12}\/IncomingWebhook\/[a-zA-Z-0-9]{32}\/[a-zA-Z-0-9]{8}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{4}-[a-zA-Z-0-9]{12}) | |
| confidence: high | |
| - name: Midise | |
| regex: midi-662b69edd2[a-zA-Z0-9]{54} | |
| confidence: high | |
| - name: Mindmeister | |
| regex: (?:mindmeister).{0,40}\b([a-zA-Z0-9]{43})\b | |
| confidence: high | |
| - name: Mite - 1 | |
| regex: (?:mite).{0,40}\b([0-9a-z]{16})\b | |
| confidence: high | |
| - name: Mite - 2 | |
| regex: \b([0-9a-z-]{1,}.mite.yo.lk)\b | |
| confidence: high | |
| - name: Mixmax | |
| regex: (?:mixmax).{0,40}\b([a-zA-Z0-9_-]{36})\b | |
| confidence: high | |
| - name: Mixpanel - 1 | |
| regex: (?:mixpanel).{0,40}\b([a-zA-Z0-9.-]{30,40})\b | |
| confidence: high | |
| - name: Mixpanel - 2 | |
| regex: (?:mixpanel).{0,40}\b([a-zA-Z0-9-]{32})\b | |
| confidence: high | |
| - name: Moderation | |
| regex: (?:moderation).{0,40}\b([a-zA-Z0-9]{36}\.[a-zA-Z0-9]{115}\.[a-zA-Z0-9_]{43})\b | |
| confidence: high | |
| - name: Monday | |
| regex: (?:monday).{0,40}\b(ey[a-zA-Z0-9_.]{210,225})\b | |
| confidence: high | |
| - name: Moonclerck | |
| regex: (?:moonclerck).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Moonclerk | |
| regex: (?:moonclerk).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Moosend | |
| regex: (?:moosend).{0,40}\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Mrticktock - 1 | |
| regex: (?:mrticktock).{0,40}\b([a-zA-Z0-9!=@#$%()_^]{1,50}) | |
| confidence: high | |
| - name: Myfreshworks - 2 | |
| regex: (?:freshworks).{0,40}\b([a-z0-9A-Z-]{22})\b | |
| confidence: low | |
| - name: Myintervals | |
| regex: (?:myintervals).{0,40}\b([0-9a-z]{11})\b | |
| confidence: high | |
| - name: Nasdaqdatalink | |
| regex: (?:nasdaq).{0,40}\b([a-zA-Z0-9_-]{20})\b | |
| confidence: high | |
| - name: Nethunt - 1 | |
| regex: (?:nethunt).{0,40}\b([a-zA-Z0-9.-@]{25,30})\b | |
| confidence: high | |
| - name: Nethunt - 2 | |
| regex: (?:nethunt).{0,40}\b([a-z0-9-\S]{36})\b | |
| confidence: high | |
| - name: Netlify | |
| regex: (?:netlify).{0,40}\b([A-Za-z0-9_-]{43,45})\b | |
| confidence: high | |
| - name: Neutrinoapi - 1 | |
| regex: (?:neutrinoapi).{0,40}\b([a-zA-Z0-9]{48})\b | |
| confidence: high | |
| - name: Neutrinoapi - 2 | |
| regex: (?:neutrinoapi).{0,40}\b([a-zA-Z0-9]{6,24})\b | |
| confidence: high | |
| - name: Newrelic Admin API Key | |
| regex: NRAA-[a-f0-9]{27} | |
| confidence: high | |
| - name: Newrelic Insights API Key | |
| regex: NRI(?:I|Q)-[A-Za-z0-9\-_]{32} | |
| confidence: high | |
| - name: Newrelic REST API Key | |
| regex: NRRA-[a-f0-9]{42} | |
| confidence: high | |
| - name: Newrelic Synthetics Location Key | |
| regex: NRSP-[a-z]{2}[0-9]{2}[a-f0-9]{31} | |
| confidence: high | |
| - name: Newrelicpersonalapikey | |
| regex: (?:newrelic).{0,40}\b([A-Za-z0-9_\.]{4}-[A-Za-z0-9_\.]{42})\b | |
| confidence: high | |
| - name: Newsapi | |
| regex: (?:newsapi).{0,40}\b([a-z0-9]{32}) | |
| confidence: high | |
| - name: Newscatcher | |
| regex: (?:newscatcher).{0,40}\b([0-9A-Za-z_]{43})\b | |
| confidence: high | |
| - name: Nexmoapikey - 1 | |
| regex: (?:nexmo).{0,40}\b([A-Za-z0-9_-]{8})\b | |
| confidence: high | |
| - name: Nexmoapikey - 2 | |
| regex: (?:nexmo).{0,40}\b([A-Za-z0-9_-]{16})\b | |
| confidence: high | |
| - name: Nftport | |
| regex: (?:nftport).{0,40}\b([a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Nicereply | |
| regex: (?:nicereply).{0,40}\b([0-9a-f]{40})\b | |
| confidence: high | |
| - name: Nimble | |
| regex: (?:nimble).{0,40}\b([a-zA-Z0-9]{30})\b | |
| confidence: high | |
| - name: Nitro | |
| regex: (?:nitro).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Noticeable | |
| regex: (?:noticeable).{0,40}\b([0-9a-zA-Z]{20})\b | |
| confidence: high | |
| - name: Notion | |
| regex: \b(secret_[A-Za-z0-9]{43})\b | |
| confidence: high | |
| - name: Nozbeteams | |
| regex: (?:nozbe|nozbeteams).{0,40}\b([0-9A-Za-z]{16}_[0-9A-Za-z\-_]{64}[ \r\n]{1}) | |
| confidence: high | |
| - name: Numverify | |
| regex: (?:numverify).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Nutritionix - 1 | |
| regex: (?:nutritionix).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Nutritionix - 2 | |
| regex: (?:nutritionix).{0,40}\b([a-z0-9]{8})\b | |
| confidence: high | |
| - name: Nylas | |
| regex: (?:nylas).{0,40}\b([0-9A-Za-z]{30})\b | |
| confidence: high | |
| - name: Nytimes | |
| regex: (?:nytimes).{0,40}\b([a-z0-9A-Z-]{32})\b | |
| confidence: low | |
| - name: Oanda | |
| regex: (?:oanda).{0,40}\b([a-zA-Z0-9]{24})\b | |
| confidence: high | |
| - name: Omnisend | |
| regex: (?:omnisend).{0,40}\b([a-z0-9A-Z-]{75})\b | |
| confidence: high | |
| - name: Onedesk - 1 | |
| regex: (?:onedesk).{0,40}\b([a-zA-Z0-9!=@#$%^]{8,64}) | |
| confidence: high | |
| - name: Onelogin - 2 | |
| regex: secret[a-zA-Z0-9_' "=]{0,20}([a-z0-9]{64}) | |
| confidence: high | |
| - name: Onepagecrm - 1 | |
| regex: (?:onepagecrm).{0,40}\b([a-zA-Z0-9=]{44}) | |
| confidence: high | |
| - name: Onepagecrm - 2 | |
| regex: (?:onepagecrm).{0,40}\b([a-z0-9]{24})\b | |
| confidence: high | |
| - name: Onwaterio | |
| regex: (?:onwater).{0,40}\b([a-zA-Z0-9_-]{20})\b | |
| confidence: high | |
| - name: Oopspam | |
| regex: (?:oopspam).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Opencagedata | |
| regex: (?:opencagedata).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Opengraphr | |
| regex: (?:opengraphr).{0,40}\b([0-9Aa-zA-Z]{80})\b | |
| confidence: high | |
| - name: Openuv | |
| regex: (?:openuv).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Openweather | |
| regex: (?:openweather).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Optimizely | |
| regex: (?:optimizely).{0,40}\b([0-9A-Za-z-:]{54})\b | |
| confidence: high | |
| - name: Owlbot | |
| regex: (?:owlbot).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: PGP private key block | |
| regex: '-----BEGIN PGP PRIVATE KEY BLOCK-----' | |
| confidence: high | |
| - name: Pagerdutyapikey | |
| regex: (?:pagerduty).{0,40}\b([a-z]{1}\+[a-zA-Z]{9}\-[a-z]{2}\-[a-z0-9]{5})\b | |
| confidence: high | |
| - name: Pandadoc | |
| regex: (?:pandadoc).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Pandascore | |
| regex: (?:pandascore).{0,40}([ \r\n]{0,1}[0-9A-Za-z\-\_]{51}[ \r\n]{1}) | |
| confidence: high | |
| - name: Paralleldots | |
| regex: (?:paralleldots).{0,40}\b([0-9A-Za-z]{43})\b | |
| confidence: high | |
| - name: Partnerstack | |
| regex: (?:partnerstack).{0,40}\b([0-9A-Za-z]{64})\b | |
| confidence: high | |
| - name: Passbase | |
| regex: (?:passbase).{0,40}\b([a-zA-Z0-9]{128})\b | |
| confidence: high | |
| - name: Password in URL | |
| regex: '[a-zA-Z]{3,10}://[^/\s:@]{3,20}:[^/\s:@]{3,20}@.{1,100}["''\s]' | |
| confidence: high | |
| - name: Pastebin | |
| regex: (?:pastebin).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: PayPal Braintree access token | |
| regex: access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32} | |
| confidence: high | |
| - name: Paymoapp | |
| regex: (?:paymoapp).{0,40}\b([a-zA-Z0-9]{44})\b | |
| confidence: high | |
| - name: Paymongo | |
| regex: (?:paymongo).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Paypaloauth - 1 | |
| regex: \b([A-Za-z0-9_\.]{7}-[A-Za-z0-9_\.]{72})\b | |
| confidence: low | |
| - name: Paypaloauth - 2 | |
| regex: \b([A-Za-z0-9_\.]{69}-[A-Za-z0-9_\.]{10})\b | |
| confidence: low | |
| - name: Paystack | |
| regex: \b(sk\_[a-z]{1,}\_[A-Za-z0-9]{40})\b | |
| confidence: high | |
| - name: Pdflayer | |
| regex: (?:pdflayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Pdfshift | |
| regex: (?:pdfshift).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Peopledatalabs | |
| regex: (?:peopledatalabs).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Pepipost | |
| regex: (?:pepipost|netcore).{0,40}\b([a-zA-Z-0-9]{32})\b | |
| confidence: high | |
| - name: Picatic API key | |
| regex: sk_live_[0-9a-z]{32} | |
| confidence: high | |
| - name: Pipedream | |
| regex: (?:pipedream).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Pipedrive | |
| regex: (?:pipedrive).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Pivotaltracker | |
| regex: (?:pivotal).{0,40}([a-z0-9]{32}) | |
| confidence: high | |
| - name: Pixabay | |
| regex: (?:pixabay).{0,40}\b([a-z0-9-]{34})\b | |
| confidence: high | |
| - name: Plaidkey - 1 | |
| regex: (?:plaid).{0,40}\b([a-z0-9]{24})\b | |
| confidence: high | |
| - name: Plaidkey - 2 | |
| regex: (?:plaid).{0,40}\b([a-z0-9]{30})\b | |
| confidence: high | |
| - name: Planviewleankit - 1 | |
| regex: (?:planviewleankit|planview).{0,40}\b([0-9a-f]{128})\b | |
| confidence: high | |
| - name: Planviewleankit - 2 | |
| regex: (?:planviewleankit|planview).{0,40}(?:subdomain).\b([a-zA-Z][a-zA-Z0-9.-]{1,23}[a-zA-Z0-9])\b | |
| confidence: high | |
| - name: Planyo | |
| regex: (?:planyo).{0,40}\b([0-9a-z]{62})\b | |
| confidence: high | |
| - name: Plivo - 1 | |
| regex: (?:plivo).{0,40}\b([A-Za-z0-9_-]{40})\b | |
| confidence: high | |
| - name: Plivo - 2 | |
| regex: (?:plivo).{0,40}\b([A-Z]{20})\b | |
| confidence: high | |
| - name: Poloniex - 1 | |
| regex: (?:poloniex).{0,40}\b([0-9a-f]{128})\b | |
| confidence: high | |
| - name: Poloniex - 2 | |
| regex: (?:poloniex).{0,40}\b([0-9A-Z]{8}-[0-9A-Z]{8}-[0-9A-Z]{8}-[0-9A-Z]{8})\b | |
| confidence: high | |
| - name: Polygon | |
| regex: (?:polygon).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Positionstack | |
| regex: (?:positionstack).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Postageapp | |
| regex: (?:postageapp).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Posthog | |
| regex: \b(phc_[a-zA-Z0-9_]{43})\b | |
| confidence: high | |
| - name: Postman | |
| regex: \b(PMAK-[a-zA-Z-0-9]{59})\b | |
| confidence: high | |
| - name: Postmark | |
| regex: (?:postmark).{0,40}\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Powrbot | |
| regex: (?:powrbot).{0,40}\b([a-z0-9A-Z]{40})\b | |
| confidence: high | |
| - name: Privatekey | |
| regex: '-----\s*?BEGIN[ A-Z0-9_-]*?PRIVATE KEY\s*?-----[\s\S]*?----\s*?END[ | |
| A-Z0-9_-]*? PRIVATE KEY\s*?-----' | |
| confidence: high | |
| - name: Prospectcrm | |
| regex: (?:prospect).{0,40}\b([a-z0-9-]{32})\b | |
| confidence: high | |
| - name: Prospectio | |
| regex: (?:prospect).{0,40}\b([a-z0-9A-Z-]{50})\b | |
| confidence: high | |
| - name: Protocolsio | |
| regex: (?:protocols).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Proxycrawl | |
| regex: (?:proxycrawl).{0,40}\b([a-zA-Z0-9_]{22})\b | |
| confidence: high | |
| - name: Pubnubpublishkey - 1 | |
| regex: \b(sub-c-[0-9a-z]{8}-[a-z]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Pubnubpublishkey - 2 | |
| regex: \b(pub-c-[0-9a-z]{8}-[0-9a-z]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Purestake | |
| regex: (?:purestake).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Pushbulletapikey | |
| regex: (?:pushbullet).{0,40}\b([A-Za-z0-9_\.]{34})\b | |
| confidence: high | |
| - name: Pusherchannelkey - 1 | |
| regex: (?:key).{0,40}\b([a-z0-9]{20})\b | |
| confidence: low | |
| - name: Pusherchannelkey - 2 | |
| regex: (?:pusher).{0,40}\b([a-z0-9]{20})\b | |
| confidence: high | |
| - name: Pusherchannelkey - 3 | |
| regex: (?:pusher).{0,40}\b([0-9]{7})\b | |
| confidence: high | |
| - name: PyPI upload token | |
| regex: pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000} | |
| confidence: high | |
| - name: Qualaroo | |
| regex: (?:qualaroo).{0,40}\b([a-z0-9A-Z=]{64}) | |
| confidence: high | |
| - name: Qubole | |
| regex: (?:qubole).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Quickmetrics | |
| regex: (?:quickmetrics).{0,40}\b([a-zA-Z0-9_-]{22})\b | |
| confidence: high | |
| - name: REDIS_URL | |
| regex: (REDIS_URL).+ | |
| confidence: low | |
| - name: RKCS8 | |
| regex: '-----BEGIN PRIVATE KEY-----' | |
| confidence: high | |
| - name: RSA private key | |
| regex: '-----BEGIN RSA PRIVATE KEY-----' | |
| confidence: high | |
| - name: Rapidapi | |
| regex: (?:rapidapi).{0,40}\b([A-Za-z0-9_-]{50})\b | |
| confidence: high | |
| - name: Raven | |
| regex: (?:raven).{0,40}\b([A-Z0-9-]{16})\b | |
| confidence: high | |
| - name: Rawg | |
| regex: (?:rawg).{0,40}\b([0-9Aa-z]{32})\b | |
| confidence: high | |
| - name: Razorpay - 1 | |
| regex: \brzp_\w{2,6}_\w{10,20}\b | |
| confidence: high | |
| - name: Readme | |
| regex: (?:readme).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Reallysimplesystems | |
| regex: \b(ey[a-zA-Z0-9-._]{153}.ey[a-zA-Z0-9-._]{916,1000})\b | |
| confidence: high | |
| - name: Rebrandly | |
| regex: (?:rebrandly).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Refiner | |
| regex: (?:refiner).{0,40}\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Repairshopr - 1 | |
| regex: (?:repairshopr).{0,40}\b([a-zA-Z0-9_.!+$#^*]{3,32})\b | |
| confidence: high | |
| - name: Repairshopr - 2 | |
| regex: (?:repairshopr).{0,40}\b([a-zA-Z0-9-]{51})\b | |
| confidence: high | |
| - name: Restpack | |
| regex: (?:restpack).{0,40}\b([a-zA-Z0-9]{48})\b | |
| confidence: high | |
| - name: Restpackhtmltopdfapi | |
| regex: (?:restpack).{0,40}\b([0-9A-Za-z]{48})\b | |
| confidence: high | |
| - name: Rev - 1 | |
| regex: (?:rev).{0,40}\b([0-9a-zA-Z\/\+]{27}\=[ \r\n]{1}) | |
| confidence: high | |
| - name: Rev - 2 | |
| regex: (?:rev).{0,40}\b([0-9a-zA-Z\-]{27}[ \r\n]{1}) | |
| confidence: low | |
| - name: Revampcrm - 1 | |
| regex: (?:revamp).{0,40}\b([a-zA-Z0-9]{40}\b) | |
| confidence: high | |
| - name: Revampcrm - 2 | |
| regex: (?:revamp).{0,40}\b([a-zA-Z0-9.-@]{25,30})\b | |
| confidence: low | |
| - name: Ringcentral - 1 | |
| regex: (?:ringcentral).{0,40}\b(https://www.[0-9A-Za-z_-]{1,}.com)\b | |
| confidence: high | |
| - name: Ringcentral - 2 | |
| regex: (?:ringcentral).{0,40}\b([0-9A-Za-z_-]{22})\b | |
| confidence: high | |
| - name: Ritekit | |
| regex: (?:ritekit).{0,40}\b([0-9a-f]{44})\b | |
| confidence: high | |
| - name: Roaring | |
| regex: (?:roaring).{0,40}\b([0-9A-Za-z_-]{28})\b | |
| confidence: high | |
| - name: Rocketreach | |
| regex: (?:rocketreach).{0,40}\b([a-z0-9-]{39})\b | |
| confidence: high | |
| - name: Roninapp - 1 | |
| regex: (?:ronin).{0,40}\b([0-9Aa-zA-Z]{3,32})\b | |
| confidence: low | |
| - name: Roninapp - 2 | |
| regex: (?:ronin).{0,40}\b([0-9a-zA-Z]{26})\b | |
| confidence: high | |
| - name: Route4me | |
| regex: (?:route4me).{0,40}\b([0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Rownd - 1 | |
| regex: (?:rownd).{0,40}\b([a-z0-9]{8}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Rownd - 2 | |
| regex: (?:rownd).{0,40}\b([a-z0-9]{48})\b | |
| confidence: high | |
| - name: Rownd - 3 | |
| regex: (?:rownd).{0,40}\b([0-9]{18})\b | |
| confidence: high | |
| - name: Rubygems | |
| regex: \b(rubygems_[a-zA0-9]{48})\b | |
| confidence: high | |
| - name: Runrunit - 1 | |
| regex: (?:runrunit).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Runrunit - 2 | |
| regex: (?:runrunit).{0,40}\b([0-9A-Za-z]{18,20})\b | |
| confidence: high | |
| - name: SSH | |
| regex: '-----BEGIN OPENSSH PRIVATE KEY-----' | |
| confidence: high | |
| - name: SSH (DSA) private key | |
| regex: '-----BEGIN DSA PRIVATE KEY-----' | |
| confidence: high | |
| - name: Salesblink | |
| regex: (?:salesblink).{0,40}\b([a-zA-Z]{16})\b | |
| confidence: high | |
| - name: Salescookie | |
| regex: (?:salescookie).{0,40}\b([a-zA-z0-9]{32})\b | |
| confidence: high | |
| - name: Salesflare | |
| regex: (?:salesflare).{0,40}\b([a-zA-Z0-9_]{45})\b | |
| confidence: high | |
| - name: Satismeterprojectkey - 1 | |
| regex: (?:satismeter).{0,40}\b([a-zA-Z0-9]{4,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,12})\b | |
| confidence: high | |
| - name: Satismeterprojectkey - 2 | |
| regex: (?:satismeter).{0,40}\b([a-zA-Z0-9]{24})\b | |
| confidence: high | |
| - name: Satismeterprojectkey - 3 | |
| regex: (?:satismeter).{0,40}\b([a-zA-Z0-9!=@#$%^]{6,32}) | |
| confidence: high | |
| - name: Satismeterwritekey | |
| regex: (?:satismeter).{0,40}\b([a-z0-9A-Z]{16})\b | |
| confidence: high | |
| - name: Saucelabs - 1 | |
| regex: \b(oauth\-[a-z0-9]{8,}\-[a-z0-9]{5})\b | |
| confidence: high | |
| - name: Saucelabs - 2 | |
| regex: (?:saucelabs).{0,40}\b([a-z0-9]{8}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{4}\-[a-z0-9]{12})\b | |
| confidence: high | |
| - name: Scalewaykey | |
| regex: (?:scaleway).{0,40}\b([0-9a-z]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Scrapeowl | |
| regex: (?:scrapeowl).{0,40}\b([0-9a-z]{30})\b | |
| confidence: high | |
| - name: Scraperapi | |
| regex: (?:scraperapi).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Scraperbox | |
| regex: (?:scraperbox).{0,40}\b([A-Z0-9]{32})\b | |
| confidence: high | |
| - name: Scrapersite | |
| regex: (?:scrapersite).{0,40}\b([a-zA-Z0-9]{45})\b | |
| confidence: high | |
| - name: Scrapestack | |
| regex: (?:scrapestack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Scrapfly | |
| regex: (?:scrapfly).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Scrapingant | |
| regex: (?:scrapingant).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Scrapingbee | |
| regex: (?:scrapingbee).{0,40}\b([A-Z0-9]{80})\b | |
| confidence: high | |
| - name: Screenshotapi | |
| regex: (?:screenshotapi).{0,40}\b([0-9A-Z]{7}\-[0-9A-Z]{7}\-[0-9A-Z]{7}\-[0-9A-Z]{7})\b | |
| confidence: high | |
| - name: Screenshotlayer | |
| regex: (?:screenshotlayer).{0,40}\b([a-zA-Z0-9_]{32})\b | |
| confidence: high | |
| - name: Securitytrails | |
| regex: (?:securitytrails).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Segmentapikey | |
| regex: (?:segment).{0,40}\b([A-Za-z0-9_\-a-zA-Z]{43}\.[A-Za-z0-9_\-a-zA-Z]{43})\b | |
| confidence: high | |
| - name: Selectpdf | |
| regex: (?:selectpdf).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Semaphore | |
| regex: (?:semaphore).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: SendGrid API Key | |
| regex: SG\.[\w_]{16,32}\.[\w_]{16,64} | |
| confidence: high | |
| - name: Sendbird - 1 | |
| regex: (?:sendbird).{0,40}\b([0-9a-f]{40})\b | |
| confidence: high | |
| - name: Sendbird - 2 | |
| regex: (?:sendbird).{0,40}\b([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})\b | |
| confidence: high | |
| - name: Sendbirdorganizationapi | |
| regex: (?:sendbird).{0,40}\b([0-9a-f]{24})\b | |
| confidence: high | |
| - name: Sendgrid | |
| regex: (?:sendgrid).{0,40}(SG\.[\w\-_]{20,24}\.[\w\-_]{39,50})\b | |
| confidence: high | |
| - name: Sendinbluev2 | |
| regex: \b(xkeysib\-[A-Za-z0-9_-]{81})\b | |
| confidence: high | |
| - name: Sentiment - 1 | |
| regex: (?:sentiment).{0,40}\b([0-9]{17})\b | |
| confidence: high | |
| - name: Sentiment - 2 | |
| regex: (?:sentiment).{0,40}\b([a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Sentrytoken | |
| regex: (?:sentry).{0,40}\b([a-f0-9]{64})\b | |
| confidence: high | |
| - name: Serphouse | |
| regex: (?:serphouse).{0,40}\b([0-9A-Za-z]{60})\b | |
| confidence: high | |
| - name: Serpstack | |
| regex: (?:serpstack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Sheety - 1 | |
| regex: (?:sheety).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Sheety - 2 | |
| regex: (?:sheety).{0,40}\b([0-9a-z]{64})\b | |
| confidence: high | |
| - name: Sherpadesk | |
| regex: (?:sherpadesk).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Shipday | |
| regex: (?:shipday).{0,40}\b([a-zA-Z0-9.]{11}[a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Shodankey | |
| regex: (?:shodan).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Shopify access token | |
| regex: shpat_[a-fA-F0-9]{32} | |
| confidence: high | |
| - name: Shopify custom app access token | |
| regex: shpca_[a-fA-F0-9]{32} | |
| confidence: high | |
| - name: Shopify private app access token | |
| regex: shppa_[a-fA-F0-9]{32} | |
| confidence: high | |
| - name: Shopify shared secret | |
| regex: shpss_[a-fA-F0-9]{32} | |
| confidence: high | |
| - name: Shoppable Service Auth | |
| regex: data-shoppable-auth-token.+ | |
| confidence: low | |
| - name: Shortcut | |
| regex: (?:shortcut).{0,40}\b([0-9a-f-]{36})\b | |
| confidence: high | |
| - name: Shotstack | |
| regex: (?:shotstack).{0,40}\b([a-zA-Z0-9]{40})\b | |
| confidence: high | |
| - name: Shutterstock - 1 | |
| regex: (?:shutterstock).{0,40}\b([0-9a-zA-Z]{32})\b | |
| confidence: low | |
| - name: Shutterstock - 2 | |
| regex: (?:shutterstock).{0,40}\b([0-9a-zA-Z]{16})\b | |
| confidence: low | |
| - name: Shutterstockoauth | |
| regex: (?:shutterstock).{0,40}\b(v2/[0-9A-Za-z]{388})\b | |
| confidence: high | |
| - name: Signalwire - 1 | |
| regex: \b([0-9a-z-]{3,64}.signalwire.com)\b | |
| confidence: high | |
| - name: Signalwire - 2 | |
| regex: (?:signalwire).{0,40}\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: Signalwire - 3 | |
| regex: (?:signalwire).{0,40}\b([0-9A-Za-z]{50})\b | |
| confidence: high | |
| - name: Signaturit | |
| regex: (?:signaturit).{0,40}\b([0-9A-Za-z]{86})\b | |
| confidence: high | |
| - name: Signupgenius | |
| regex: (?:signupgenius).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Sigopt | |
| regex: (?:sigopt).{0,40}\b([A-Z0-9]{48})\b | |
| confidence: high | |
| - name: Simplesat | |
| regex: (?:simplesat).{0,40}\b([a-z0-9]{40}) | |
| confidence: high | |
| - name: Simplynoted | |
| regex: (?:simplynoted).{0,40}\b([a-zA-Z0-9\S]{340,360})\b | |
| confidence: high | |
| - name: Simvoly | |
| regex: (?:simvoly).{0,40}\b([a-z0-9]{33})\b | |
| confidence: high | |
| - name: Sinchmessage | |
| regex: (?:sinch).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Sirv - 1 | |
| regex: (?:sirv).{0,40}\b([a-zA-Z0-9\S]{88}) | |
| confidence: high | |
| - name: Sirv - 2 | |
| regex: (?:sirv).{0,40}\b([a-zA-Z0-9]{26})\b | |
| confidence: high | |
| - name: Siteleaf | |
| regex: (?:siteleaf).{0,40}\b([0-9Aa-z]{32})\b | |
| confidence: high | |
| - name: Skrappio | |
| regex: (?:skrapp).{0,40}\b([a-z0-9A-Z]{42})\b | |
| confidence: high | |
| - name: Skybiometry | |
| regex: (?:skybiometry).{0,40}\b([0-9a-z]{25,26})\b | |
| confidence: high | |
| - name: Slack | |
| regex: xox[baprs]-[0-9a-zA-Z]{10,48} | |
| confidence: high | |
| - name: Slack Token | |
| regex: (xox[pborsa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}) | |
| confidence: high | |
| - name: Slack User token | |
| regex: xoxp-[0-9A-Za-z\-]{72} | |
| confidence: low | |
| - name: Slack Webhook | |
| regex: https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{23,24} | |
| confidence: high | |
| - name: Slack access token | |
| regex: xoxb-[0-9A-Za-z\-]{51} | |
| confidence: high | |
| - name: Slackwebhook | |
| regex: (https:\/\/hooks.slack.com\/services\/[A-Za-z0-9+\/]{44,46}) | |
| confidence: high | |
| - name: Smartsheets | |
| regex: (?:smartsheets).{0,40}\b([a-zA-Z0-9]{37})\b | |
| confidence: high | |
| - name: Smartystreets - 1 | |
| regex: (?:smartystreets).{0,40}\b([a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Smartystreets - 2 | |
| regex: (?:smartystreets).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Smooch - 1 | |
| regex: (?:smooch).{0,40}\b(act_[0-9a-z]{24})\b | |
| confidence: high | |
| - name: Smooch - 2 | |
| regex: (?:smooch).{0,40}\b([0-9a-zA-Z_-]{86})\b | |
| confidence: high | |
| - name: Snipcart | |
| regex: (?:snipcart).{0,40}\b([0-9A-Za-z_]{75})\b | |
| confidence: high | |
| - name: Snykkey | |
| regex: (?:snyk).{0,40}\b([0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b | |
| confidence: high | |
| - name: SonarQube Token | |
| regex: sonar.{0,50}(?:"|'|`)?[0-9a-f]{40}(?:"|'|`)? | |
| confidence: high | |
| - name: Splunkobservabilitytoken | |
| regex: (?:splunk).{0,40}\b([a-z0-9A-Z]{22})\b | |
| confidence: high | |
| - name: Spoonacular | |
| regex: (?:spoonacular).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Sportsmonk | |
| regex: (?:sportsmonk).{0,40}\b([0-9a-zA-Z]{60})\b | |
| confidence: high | |
| - name: Square | |
| regex: (?:square).{0,40}(EAAA[a-zA-Z0-9\-\+\=]{60}) | |
| confidence: high | |
| - name: Square API Key | |
| regex: sq0(atp|csp)-[0-9a-z-_]{22,43} | |
| confidence: low | |
| - name: Square OAuth Secret | |
| regex: sq0csp-[0-9A-Za-z\-_]{43} | |
| confidence: high | |
| - name: Square access token | |
| regex: sq0atp-[0-9A-Za-z\-_]{22} | |
| confidence: high | |
| - name: Squareapp - 1 | |
| regex: '[\w\-]*sq0i[a-z]{2}-[0-9A-Za-z\-_]{22,43}' | |
| confidence: high | |
| - name: Squareapp - 2 | |
| regex: '[\w\-]*sq0c[a-z]{2}-[0-9A-Za-z\-_]{40,50}' | |
| confidence: high | |
| - name: Squarespace | |
| regex: (?:squarespace).{0,40}\b([0-9Aa-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Squareup | |
| regex: \b(sq0idp-[0-9A-Za-z]{22})\b | |
| confidence: high | |
| - name: Sslmate | |
| regex: (?:sslmate).{0,40}\b([a-zA-Z0-9]{36})\b | |
| confidence: high | |
| - name: Stitchdata | |
| regex: (?:stitchdata).{0,40}\b([0-9a-z_]{35})\b | |
| confidence: high | |
| - name: Stockdata | |
| regex: (?:stockdata).{0,40}\b([0-9A-Za-z]{40})\b | |
| confidence: high | |
| - name: Storecove | |
| regex: (?:storecove).{0,40}\b([a-zA-Z0-9_-]{43})\b | |
| confidence: high | |
| - name: Stormglass | |
| regex: (?:stormglass).{0,40}\b([0-9Aa-z-]{73})\b | |
| confidence: high | |
| - name: Storyblok | |
| regex: (?:storyblok).{0,40}\b([0-9A-Za-z]{22}t{2})\b | |
| confidence: high | |
| - name: Storychief | |
| regex: (?:storychief).{0,40}\b([a-zA-Z0-9_\-.]{940,1000}) | |
| confidence: high | |
| - name: Strava - 1 | |
| regex: (?:strava).{0,40}\b([0-9]{5})\b | |
| confidence: high | |
| - name: Strava - 2 | |
| regex: (?:strava).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Streak | |
| regex: (?:streak).{0,40}\b([0-9Aa-f]{32})\b | |
| confidence: high | |
| - name: Stripe | |
| regex: '[rs]k_live_[a-zA-Z0-9]{20,30}' | |
| confidence: high | |
| - name: Stripe API Key - 1 | |
| regex: sk_live_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe API key - 2 | |
| regex: stripe[sr]k_live_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe API key - 3 | |
| regex: stripe[sk|rk]_live_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe Public Live Key | |
| regex: pk_live_[0-9a-z]{24} | |
| confidence: high | |
| - name: Stripe Public Test Key | |
| regex: pk_test_[0-9a-z]{24} | |
| confidence: high | |
| - name: Stripe Restriced Key | |
| regex: rk_(?:live|test)_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe Restricted API Key | |
| regex: rk_live_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe Secret Key | |
| regex: sk_(?:live|test)_[0-9a-zA-Z]{24} | |
| confidence: high | |
| - name: Stripe Secret Live Key | |
| regex: (sk|rk)_live_[0-9a-z]{24} | |
| confidence: high | |
| - name: Stripe Secret Test Key | |
| regex: (sk|rk)_test_[0-9a-z]{24} | |
| confidence: high | |
| - name: Stytch - 1 | |
| regex: (?:stytch).{0,40}\b([a-zA-Z0-9-_]{47}=) | |
| confidence: high | |
| - name: Stytch - 2 | |
| regex: (?:stytch).{0,40}\b([a-z0-9-]{49})\b | |
| confidence: high | |
| - name: Sugester - 1 | |
| regex: (?:sugester).{0,40}\b([a-zA-Z0-9_.!+$#^*%]{3,32})\b | |
| confidence: high | |
| - name: Sugester - 2 | |
| regex: (?:sugester).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Sumologickey - 1 | |
| regex: (?:sumo).{0,40}\b([A-Za-z0-9]{14})\b | |
| confidence: high | |
| - name: Sumologickey - 2 | |
| regex: (?:sumo).{0,40}\b([A-Za-z0-9]{64})\b | |
| confidence: high | |
| - name: Supernotesapi | |
| regex: (?:supernotes).{0,40}([ \r\n]{0,1}[0-9A-Za-z\-_]{43}[ \r\n]{1}) | |
| confidence: high | |
| - name: Surveyanyplace - 1 | |
| regex: (?:survey).{0,40}\b([a-z0-9A-Z-]{36})\b | |
| confidence: low | |
| - name: Surveyanyplace - 2 | |
| regex: (?:survey).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: low | |
| - name: Surveybot | |
| regex: (?:surveybot).{0,40}\b([A-Za-z0-9-]{80})\b | |
| confidence: high | |
| - name: Surveysparrow | |
| regex: (?:surveysparrow).{0,40}\b([a-zA-Z0-9-_]{88})\b | |
| confidence: high | |
| - name: Survicate | |
| regex: (?:survicate).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Swell - 1 | |
| regex: (?:swell).{0,40}\b([a-zA-Z0-9]{6,24})\b | |
| confidence: low | |
| - name: Swell - 2 | |
| regex: (?:swell).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Swiftype | |
| regex: (?:swiftype).{0,40}\b([a-zA-z-0-9]{6}\_[a-zA-z-0-9]{6}\-[a-zA-z-0-9]{6})\b | |
| confidence: high | |
| - name: Tallyfy | |
| regex: (?:tallyfy).{0,40}\b([0-9A-Za-z]{36}\.[0-9A-Za-z]{264}\.[0-9A-Za-z\-\_]{683})\b | |
| confidence: high | |
| - name: Tatumio | |
| regex: (?:tatum).{0,40}\b([0-9a-z-]{36})\b | |
| confidence: high | |
| - name: Taxjar | |
| regex: (?:taxjar).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Teamgate - 1 | |
| regex: (?:teamgate).{0,40}\b([a-z0-9]{40})\b | |
| confidence: high | |
| - name: Teamgate - 2 | |
| regex: (?:teamgate).{0,40}\b([a-zA-Z0-9]{80})\b | |
| confidence: high | |
| - name: Teamworkcrm | |
| regex: (?:teamwork|teamworkcrm).{0,40}\b(tkn\.v1_[0-9A-Za-z]{71}=[ \r\n]{1}) | |
| confidence: high | |
| - name: Teamworkdesk | |
| regex: (?:teamwork|teamworkdesk).{0,40}\b(tkn\.v1_[0-9A-Za-z]{71}=[ \r\n]{1}) | |
| confidence: high | |
| - name: Teamworkspaces | |
| regex: (?:teamwork|teamworkspaces).{0,40}\b(tkn\.v1_[0-9A-Za-z]{71}=[ \r\n]{1}) | |
| confidence: high | |
| - name: Technicalanalysisapi | |
| regex: (?:technicalanalysisapi).{0,40}\b([A-Z0-9]{48})\b | |
| confidence: high | |
| - name: Telegram Bot API Key | |
| regex: '[0-9]+:AA[0-9A-Za-z\-_]{33}' | |
| confidence: high | |
| - name: Telegram Secret | |
| regex: d{5,}:A[0-9a-z_-]{34,34} | |
| confidence: high | |
| - name: Telegrambottoken | |
| regex: (?:telegram).{0,40}\b([0-9]{8,10}:[a-zA-Z0-9_-]{35})\b | |
| confidence: high | |
| - name: Telnyx | |
| regex: (?:telnyx).{0,40}\b(KEY[0-9A-Za-z_-]{55})\b | |
| confidence: high | |
| - name: Terraformcloudpersonaltoken | |
| regex: \b([A-Za-z0-9]{14}.atlasv1.[A-Za-z0-9]{67})\b | |
| confidence: high | |
| - name: Text2data | |
| regex: (?:text2data).{0,40}\b([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})\b | |
| confidence: high | |
| - name: Textmagic - 1 | |
| regex: (?:textmagic).{0,40}\b([0-9A-Za-z]{30})\b | |
| confidence: high | |
| - name: Textmagic - 2 | |
| regex: (?:textmagic).{0,40}\b([0-9A-Za-z]{1,25})\b | |
| confidence: high | |
| - name: Theoddsapi | |
| regex: (?:theoddsapi|the-odds-api).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Thinkific - 1 | |
| regex: (?:thinkific).{0,40}\b([0-9a-f]{32})\b | |
| confidence: high | |
| - name: Thinkific - 2 | |
| regex: (?:thinkific).{0,40}\b([0-9A-Za-z]{4,40})\b | |
| confidence: high | |
| - name: Thousandeyes - 1 | |
| regex: (?:thousandeyes).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Thousandeyes - 2 | |
| regex: (?:thousandeyes).{0,40}\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\b | |
| confidence: high | |
| - name: Ticketmaster | |
| regex: (?:ticketmaster).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Tiingo | |
| regex: (?:tiingo).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Timezoneapi | |
| regex: (?:timezoneapi).{0,40}\b([a-zA-Z0-9]{20})\b | |
| confidence: high | |
| - name: Tly | |
| regex: (?:tly).{0,40}\b([0-9A-Za-z]{60})\b | |
| confidence: high | |
| - name: Tmetric | |
| regex: (?:tmetric).{0,40}\b([0-9A-Z]{64})\b | |
| confidence: high | |
| - name: Todoist | |
| regex: (?:todoist).{0,40}\b([0-9a-z]{40})\b | |
| confidence: high | |
| - name: Toggltrack | |
| regex: (?:toggl).{0,40}\b([0-9Aa-z]{32})\b | |
| confidence: high | |
| - name: Tomorrowio | |
| regex: (?:tomorrow).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Tomtom | |
| regex: (?:tomtom).{0,40}\b([0-9Aa-zA-Z]{32})\b | |
| confidence: high | |
| - name: Tradier | |
| regex: (?:tradier).{0,40}\b([a-zA-Z0-9]{28})\b | |
| confidence: high | |
| - name: Travelpayouts | |
| regex: (?:travelpayouts).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Travisci | |
| regex: (?:travis).{0,40}\b([a-zA-Z0-9A-Z_]{22})\b | |
| confidence: high | |
| - name: Trello URL | |
| regex: https://trello.com/b/[0-9a-z]/[0-9a-z_-]+ | |
| confidence: high | |
| - name: Trelloapikey - 2 | |
| regex: (?:trello).{0,40}\b([a-zA-Z-0-9]{32})\b | |
| confidence: high | |
| - name: Twelvedata | |
| regex: (?:twelvedata).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Twilio - 1 | |
| regex: \bAC[0-9a-f]{32}\b | |
| confidence: high | |
| - name: Twilio API Key | |
| regex: SK[0-9a-fA-F]{32} | |
| confidence: high | |
| - name: Twitter Access Token | |
| regex: '[tT][wW][iI][tT][tT][eE][rR].*[1-9][0-9]+-[0-9a-zA-Z]{40}' | |
| confidence: low | |
| - name: Twitter Client ID | |
| regex: twitter[0-9a-z]{18,25} | |
| confidence: high | |
| - name: Twitter OAuth | |
| regex: '[tT][wW][iI][tT][tT][eE][rR].*[''|"][0-9a-zA-Z]{35,44}[''|"]' | |
| confidence: low | |
| - name: Twitter Secret Key | |
| regex: twitter[0-9a-z]{35,44} | |
| confidence: high | |
| - name: Tyntec | |
| regex: (?:tyntec).{0,40}\b([a-zA-Z0-9]{32})\b | |
| confidence: high | |
| - name: Typeform | |
| regex: (?:typeform).{0,40}\b([0-9A-Za-z]{44})\b | |
| confidence: high | |
| - name: Ubidots | |
| regex: \b(BBFF-[0-9a-zA-Z]{30})\b | |
| confidence: high | |
| - name: Unifyid | |
| regex: (?:unify).{0,40}\b([0-9A-Za-z_=-]{44}) | |
| confidence: high | |
| - name: Unplugg | |
| regex: (?:unplu).{0,40}\b([a-z0-9]{64})\b | |
| confidence: high | |
| - name: Unsplash | |
| regex: (?:unsplash).{0,40}\b([0-9A-Za-z_]{43})\b | |
| confidence: high | |
| - name: Upcdatabase | |
| regex: (?:upcdatabase).{0,40}\b([A-Z0-9]{32})\b | |
| confidence: high | |
| - name: Uplead | |
| regex: (?:uplead).{0,40}\b([a-z0-9-]{32})\b | |
| confidence: high | |
| - name: Uploadcare | |
| regex: (?:uploadcare).{0,40}\b([a-z0-9]{20})\b | |
| confidence: high | |
| - name: Upwave | |
| regex: (?:upwave).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Uri | |
| regex: \b[a-zA-Z]{1,10}:?\/\/[-.%\w{}]{1,50}:([-.%\S]{3,50})@[-.%\w\/:]+\b | |
| confidence: low | |
| - name: Urlscan | |
| regex: (?:urlscan).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Userstack | |
| regex: (?:userstack).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Vatlayer | |
| regex: (?:vatlayer).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Vercel | |
| regex: (?:vercel).{0,40}\b([a-zA-Z0-9]{24})\b | |
| confidence: high | |
| - name: Verifier - 1 | |
| regex: (?:verifier).{0,40}\b([a-zA-Z-0-9-]{5,16}\@[a-zA-Z-0-9]{4,16}\.[a-zA-Z-0-9]{3,6})\b | |
| confidence: high | |
| - name: Verifier - 2 | |
| regex: (?:verifier).{0,40}\b([a-z0-9]{96})\b | |
| confidence: high | |
| - name: Verimail | |
| regex: (?:verimail).{0,40}\b([A-Z0-9]{32})\b | |
| confidence: high | |
| - name: Veriphone | |
| regex: (?:veriphone).{0,40}\b([0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Versioneye | |
| regex: (?:versioneye).{0,40}\b([a-zA-Z0-9-]{40})\b | |
| confidence: high | |
| - name: Viewneo | |
| regex: (?:viewneo).{0,40}\b([a-z0-9A-Z]{120,300}.[a-z0-9A-Z]{150,300}.[a-z0-9A-Z-_]{600,800}) | |
| confidence: high | |
| - name: Virustotal | |
| regex: (?:virustotal).{0,40}\b([a-f0-9]{64})\b | |
| confidence: high | |
| - name: Visualcrossing | |
| regex: (?:visualcrossing).{0,40}\b([0-9A-Z]{25})\b | |
| confidence: high | |
| - name: Voicegain | |
| regex: (?:voicegain).{0,40}\b(ey[0-9a-zA-Z_-]{34}.ey[0-9a-zA-Z_-]{108}.[0-9a-zA-Z_-]{43})\b | |
| confidence: high | |
| - name: Vouchery - 1 | |
| regex: (?:vouchery).{0,40}\b([a-z0-9-]{36})\b | |
| confidence: high | |
| - name: Vouchery - 2 | |
| regex: (?:vouchery).{0,40}\b([a-zA-Z0-9-\S]{2,20})\b | |
| confidence: high | |
| - name: Vpnapi | |
| regex: (?:vpnapi).{0,40}\b([a-z0-9A-Z]{32})\b | |
| confidence: high | |
| - name: Vultrapikey | |
| regex: (?:vultr).{0,40} \b([A-Z0-9]{36})\b | |
| confidence: high | |
| - name: Vyte | |
| regex: (?:vyte).{0,40}\b([0-9a-z]{50})\b | |
| confidence: high | |
| - name: Walkscore | |
| regex: (?:walkscore).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Weatherbit | |
| regex: (?:weatherbit).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Weatherstack | |
| regex: (?:weatherstack).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Webex - 1 | |
| regex: (?:error).{0,40}(redirect_uri_mismatch) | |
| confidence: high | |
| - name: Webex - 2 | |
| regex: (?:webex).{0,40}\b([A-Za-z0-9_-]{65})\b | |
| confidence: high | |
| - name: Webex - 3 | |
| regex: (?:webex).{0,40}\b([A-Za-z0-9_-]{64})\b | |
| confidence: high | |
| - name: Webflow | |
| regex: (?:webflow).{0,40}\b([a-zA0-9]{64})\b | |
| confidence: high | |
| - name: Webscraper | |
| regex: (?:webscraper).{0,40}\b([a-zA-Z0-9]{60})\b | |
| confidence: high | |
| - name: Webscraping | |
| regex: (?:webscraping).{0,40}\b([0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Wepay - 2 | |
| regex: (?:wepay).{0,40}\b([a-zA-Z0-9_?]{62})\b | |
| confidence: high | |
| - name: Whoxy | |
| regex: (?:whoxy).{0,40}\b([0-9a-z]{33})\b | |
| confidence: high | |
| - name: Worksnaps | |
| regex: (?:worksnaps).{0,40}\b([0-9A-Za-z]{40})\b | |
| confidence: high | |
| - name: Workstack | |
| regex: (?:workstack).{0,40}\b([0-9Aa-zA-Z]{60})\b | |
| confidence: high | |
| - name: Worldcoinindex | |
| regex: (?:worldcoinindex).{0,40}\b([a-zA-Z0-9]{35})\b | |
| confidence: high | |
| - name: Worldweather | |
| regex: (?:worldweather).{0,40}\b([0-9a-z]{31})\b | |
| confidence: high | |
| - name: Wrike | |
| regex: (?:wrike).{0,40}\b(ey[a-zA-Z0-9-._]{333})\b | |
| confidence: high | |
| - name: Yandex | |
| regex: (?:yandex).{0,40}\b([a-z0-9A-Z.]{83})\b | |
| confidence: high | |
| - name: Youneedabudget | |
| regex: (?:youneedabudget).{0,40}\b([0-9a-f]{64})\b | |
| confidence: high | |
| - name: Yousign | |
| regex: (?:yousign).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Youtubeapikey - 1 | |
| regex: (?:youtube).{0,40}\b([a-zA-Z-0-9_]{39})\b | |
| confidence: low | |
| - name: Zapier Webhook | |
| regex: https://(?:www.)?hooks\.zapier\.com/hooks/catch/[A-Za-z0-9]+/[A-Za-z0-9]+/ | |
| confidence: low | |
| - name: Zapierwebhook | |
| regex: (https:\/\/hooks.zapier.com\/hooks\/catch\/[A-Za-z0-9\/]{16}) | |
| confidence: high | |
| - name: Zendeskapi - 3 | |
| regex: (?:zendesk).{0,40}([A-Za-z0-9_-]{40}) | |
| confidence: high | |
| - name: Zenkitapi | |
| regex: (?:zenkit).{0,40}\b([0-9a-z]{8}\-[0-9A-Za-z]{32})\b | |
| confidence: high | |
| - name: Zenscrape | |
| regex: (?:zenscrape).{0,40}\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b | |
| confidence: high | |
| - name: Zenserp | |
| regex: (?:zenserp).{0,40}\b([0-9a-z-]{36})\b | |
| confidence: high | |
| - name: Zeplin | |
| regex: (?:zeplin).{0,40}\b([a-zA-Z0-9-.]{350,400})\b | |
| confidence: high | |
| - name: Zerobounce | |
| regex: (?:zerobounce).{0,40}\b([a-z0-9]{32})\b | |
| confidence: high | |
| - name: Zipapi - 1 | |
| regex: (?:zipapi).{0,40}\b([a-zA-Z0-9!=@#$%^]{7,}) | |
| confidence: high | |
| - name: Zipapi - 3 | |
| regex: (?:zipapi).{0,40}\b([0-9a-z]{32})\b | |
| confidence: high | |
| - name: Zipcodeapi | |
| regex: (?:zipcodeapi).{0,40}\b([a-zA-Z0-9]{64})\b | |
| confidence: high | |
| - name: Zoho Webhook | |
| regex: https://creator\.zoho\.com/api/[A-Za-z0-9/\-_\.]+\?authtoken=[A-Za-z0-9]+ | |
| confidence: low | |
| - name: Zonkafeedback | |
| regex: (?:zonka).{0,40}\b([A-Za-z0-9]{36})\b | |
| confidence: high | |
| - name: access_key_secret | |
| regex: access[_-]?key[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: access_secret | |
| regex: access[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: access_token | |
| regex: access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: account_sid | |
| regex: account[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: admin_email | |
| regex: admin[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: adzerk_api_key | |
| regex: adzerk[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: algolia_admin_key_1 | |
| regex: algolia[_-]?admin[_-]?key[_-]?1(=| =|:| :) | |
| confidence: low | |
| - name: algolia_admin_key_2 | |
| regex: algolia[_-]?admin[_-]?key[_-]?2(=| =|:| :) | |
| confidence: low | |
| - name: algolia_admin_key_mcm | |
| regex: algolia[_-]?admin[_-]?key[_-]?mcm(=| =|:| :) | |
| confidence: low | |
| - name: algolia_api_key | |
| regex: algolia[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: algolia_api_key_mcm | |
| regex: algolia[_-]?api[_-]?key[_-]?mcm(=| =|:| :) | |
| confidence: low | |
| - name: algolia_api_key_search | |
| regex: algolia[_-]?api[_-]?key[_-]?search(=| =|:| :) | |
| confidence: low | |
| - name: algolia_search_api_key | |
| regex: algolia[_-]?search[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: algolia_search_key | |
| regex: algolia[_-]?search[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: algolia_search_key_1 | |
| regex: algolia[_-]?search[_-]?key[_-]?1(=| =|:| :) | |
| confidence: low | |
| - name: alias_pass | |
| regex: alias[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: alicloud_access_key | |
| regex: alicloud[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: alicloud_secret_key | |
| regex: alicloud[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: amazon_bucket_name | |
| regex: amazon[_-]?bucket[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: amazon_secret_access_key | |
| regex: amazon[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: anaconda_token | |
| regex: anaconda[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: android_docs_deploy_token | |
| regex: android[_-]?docs[_-]?deploy[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: ansible_vault_password | |
| regex: ansible[_-]?vault[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: aos_key | |
| regex: aos[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aos_sec | |
| regex: aos[_-]?sec(=| =|:| :) | |
| confidence: low | |
| - name: api_key | |
| regex: api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: api_key_secret | |
| regex: api[_-]?key[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: api_key_sid | |
| regex: api[_-]?key[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: api_secret | |
| regex: api[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: apiary_api_key | |
| regex: apiary[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: apigw_access_token | |
| regex: apigw[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: apikey_patterns | |
| regex: apikey[:](?:['"]?[a-zA-Z0-9-_|]+['"]?) | |
| confidence: low | |
| - name: app_bucket_perm | |
| regex: app[_-]?bucket[_-]?perm(=| =|:| :) | |
| confidence: low | |
| - name: app_report_token_key | |
| regex: app[_-]?report[_-]?token[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: app_secrete | |
| regex: app[_-]?secrete(=| =|:| :) | |
| confidence: low | |
| - name: app_token | |
| regex: app[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: appclientsecret | |
| regex: appclientsecret(=| =|:| :) | |
| confidence: low | |
| - name: apple_id_password | |
| regex: apple[_-]?id[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: argos_token | |
| regex: argos[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: artifactory | |
| regex: (artifactory.{0,50}("|')?[a-zA-Z0-9=]{112}("|')?) | |
| confidence: low | |
| - name: artifactory_key | |
| regex: artifactory[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: artifacts_aws_access_key_id | |
| regex: artifacts[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: artifacts_aws_secret_access_key | |
| regex: artifacts[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: artifacts_bucket | |
| regex: artifacts[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: artifacts_key | |
| regex: artifacts[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: artifacts_secret | |
| regex: artifacts[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: assistant_iam_apikey | |
| regex: assistant[_-]?iam[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: auth0_api_clientsecret | |
| regex: auth0[_-]?api[_-]?clientsecret(=| =|:| :) | |
| confidence: low | |
| - name: auth0_client_secret | |
| regex: auth0[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: auth_token | |
| regex: auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: author_email_addr | |
| regex: author[_-]?email[_-]?addr(=| =|:| :) | |
| confidence: low | |
| - name: author_npm_api_key | |
| regex: author[_-]?npm[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aws_access | |
| regex: aws[_-]?access(=| =|:| :) | |
| confidence: low | |
| - name: aws_access_key | |
| regex: aws[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aws_access_key_id - 1 | |
| regex: aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: aws_config_accesskeyid | |
| regex: aws[_-]?config[_-]?accesskeyid(=| =|:| :) | |
| confidence: low | |
| - name: aws_config_secretaccesskey | |
| regex: aws[_-]?config[_-]?secretaccesskey(=| =|:| :) | |
| confidence: low | |
| - name: aws_key | |
| regex: aws[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aws_patterns | |
| regex: (?:accesskeyid|secretaccesskey|aws_access_key_id|aws_secret_access_key) | |
| confidence: low | |
| - name: aws_secret | |
| regex: aws[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: aws_secret_access_key | |
| regex: aws[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aws_secret_key | |
| regex: aws[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: aws_secrets | |
| regex: aws[_-]?secrets(=| =|:| :) | |
| confidence: low | |
| - name: aws_ses_access_key_id | |
| regex: aws[_-]?ses[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: aws_ses_secret_access_key | |
| regex: aws[_-]?ses[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: awsaccesskeyid | |
| regex: awsaccesskeyid(=| =|:| :) | |
| confidence: low | |
| - name: awscn_access_key_id | |
| regex: awscn[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: awscn_secret_access_key | |
| regex: awscn[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: awssecretkey | |
| regex: awssecretkey(=| =|:| :) | |
| confidence: low | |
| - name: b2_app_key | |
| regex: b2[_-]?app[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: b2_bucket | |
| regex: b2[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: bintray_api_key | |
| regex: bintray[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: bintray_apikey | |
| regex: bintray[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: bintray_gpg_password | |
| regex: bintray[_-]?gpg[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: bintray_key | |
| regex: bintray[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: bintray_token | |
| regex: bintray[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: bintraykey | |
| regex: bintraykey(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_api_key | |
| regex: bluemix[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_auth | |
| regex: bluemix[_-]?auth(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_pass | |
| regex: bluemix[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_pass_prod | |
| regex: bluemix[_-]?pass[_-]?prod(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_password | |
| regex: bluemix[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_pwd | |
| regex: bluemix[_-]?pwd(=| =|:| :) | |
| confidence: low | |
| - name: bluemix_username | |
| regex: bluemix[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: brackets_repo_oauth_token | |
| regex: brackets[_-]?repo[_-]?oauth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: browser_stack_access_key | |
| regex: browser[_-]?stack[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: browserstack_access_key | |
| regex: browserstack[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: bucketeer_aws_access_key_id | |
| regex: bucketeer[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: bucketeer_aws_secret_access_key | |
| regex: bucketeer[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: built_branch_deploy_key | |
| regex: built[_-]?branch[_-]?deploy[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: bundlesize_github_token | |
| regex: bundlesize[_-]?github[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: bx_password | |
| regex: bx[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: bx_username | |
| regex: bx[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: cache_s3_secret_key | |
| regex: cache[_-]?s3[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: cargo_token | |
| regex: cargo[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: cattle_access_key | |
| regex: cattle[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: cattle_agent_instance_auth | |
| regex: cattle[_-]?agent[_-]?instance[_-]?auth(=| =|:| :) | |
| confidence: low | |
| - name: cattle_secret_key | |
| regex: cattle[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: censys_secret | |
| regex: censys[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: certificate_password | |
| regex: certificate[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: cf_password | |
| regex: cf[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: cheverny_token | |
| regex: cheverny[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: chrome_client_secret | |
| regex: chrome[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: chrome_refresh_token | |
| regex: chrome[_-]?refresh[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: ci_deploy_password | |
| regex: ci[_-]?deploy[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: ci_project_url | |
| regex: ci[_-]?project[_-]?url(=| =|:| :) | |
| confidence: high | |
| - name: ci_registry_user | |
| regex: ci[_-]?registry[_-]?user(=| =|:| :) | |
| confidence: high | |
| - name: ci_server_name | |
| regex: ci[_-]?server[_-]?name(=| =|:| :) | |
| confidence: high | |
| - name: ci_user_token | |
| regex: ci[_-]?user[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: claimr_database | |
| regex: claimr[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: claimr_db | |
| regex: claimr[_-]?db(=| =|:| :) | |
| confidence: low | |
| - name: claimr_superuser | |
| regex: claimr[_-]?superuser(=| =|:| :) | |
| confidence: low | |
| - name: claimr_token | |
| regex: claimr[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: cli_e2e_cma_token | |
| regex: cli[_-]?e2e[_-]?cma[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: client_secret | |
| regex: client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: clojars_password | |
| regex: clojars[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: cloud_api_key | |
| regex: cloud[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: cloudant_archived_database | |
| regex: cloudant[_-]?archived[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_audited_database | |
| regex: cloudant[_-]?audited[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_database | |
| regex: cloudant[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_instance | |
| regex: cloudant[_-]?instance(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_order_database | |
| regex: cloudant[_-]?order[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_parsed_database | |
| regex: cloudant[_-]?parsed[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_password | |
| regex: cloudant[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_processed_database | |
| regex: cloudant[_-]?processed[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudant_service_database | |
| regex: cloudant[_-]?service[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: cloudflare_api_key | |
| regex: cloudflare[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: cloudflare_auth_email | |
| regex: cloudflare[_-]?auth[_-]?email(=| =|:| :) | |
| confidence: high | |
| - name: cloudflare_auth_key | |
| regex: cloudflare[_-]?auth[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: cloudflare_email | |
| regex: cloudflare[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: cloudinary_url | |
| regex: cloudinary[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: cloudinary_url_staging | |
| regex: cloudinary[_-]?url[_-]?staging(=| =|:| :) | |
| confidence: low | |
| - name: clu_repo_url | |
| regex: clu[_-]?repo[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: clu_ssh_private_key_base64 | |
| regex: clu[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :) | |
| confidence: low | |
| - name: cn_access_key_id | |
| regex: cn[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: cn_secret_access_key | |
| regex: cn[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: cocoapods_trunk_email | |
| regex: cocoapods[_-]?trunk[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: cocoapods_trunk_token | |
| regex: cocoapods[_-]?trunk[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: codacy_project_token | |
| regex: codacy[_-]?project[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: codeclimate | |
| regex: (codeclima.{0,50}("|')?[0-9a-f]{64}("|')?) | |
| confidence: low | |
| - name: codeclimate_repo_token | |
| regex: codeclimate[_-]?repo[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: codecov_token | |
| regex: codecov[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: coding_token | |
| regex: coding[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: conekta_apikey | |
| regex: conekta[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: consumer_key | |
| regex: consumer[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: consumerkey | |
| regex: consumerkey(=| =|:| :) | |
| confidence: low | |
| - name: contentful_access_token | |
| regex: contentful[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: contentful_cma_test_token | |
| regex: contentful[_-]?cma[_-]?test[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: contentful_integration_management_token | |
| regex: contentful[_-]?integration[_-]?management[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: contentful_php_management_test_token | |
| regex: contentful[_-]?php[_-]?management[_-]?test[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: contentful_test_org_cma_token | |
| regex: contentful[_-]?test[_-]?org[_-]?cma[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: contentful_v2_access_token | |
| regex: contentful[_-]?v2[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: conversation_password | |
| regex: conversation[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: conversation_username | |
| regex: conversation[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: cos_secrets | |
| regex: cos[_-]?secrets(=| =|:| :) | |
| confidence: low | |
| - name: coveralls_api_token | |
| regex: coveralls[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: coveralls_repo_token | |
| regex: coveralls[_-]?repo[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: coveralls_token | |
| regex: coveralls[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: coverity_scan_token | |
| regex: coverity[_-]?scan[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: cypress_record_key | |
| regex: cypress[_-]?record[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: danger_github_api_token | |
| regex: danger[_-]?github[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: database_host | |
| regex: database[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: database_name | |
| regex: database[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: database_password | |
| regex: database[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: database_port | |
| regex: database[_-]?port(=| =|:| :) | |
| confidence: low | |
| - name: database_user | |
| regex: database[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: database_username | |
| regex: database[_-]?username(=| =|:| :) | |
| confidence: high | |
| - name: datadog_api_key | |
| regex: datadog[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: datadog_app_key | |
| regex: datadog[_-]?app[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: db_connection | |
| regex: db[_-]?connection(=| =|:| :) | |
| confidence: low | |
| - name: db_database | |
| regex: db[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: db_host | |
| regex: db[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: db_password | |
| regex: db[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: db_pw | |
| regex: db[_-]?pw(=| =|:| :) | |
| confidence: high | |
| - name: db_user | |
| regex: db[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: db_username | |
| regex: db[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: ddg_test_email | |
| regex: ddg[_-]?test[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: ddg_test_email_pw | |
| regex: ddg[_-]?test[_-]?email[_-]?pw(=| =|:| :) | |
| confidence: low | |
| - name: ddgc_github_token | |
| regex: ddgc[_-]?github[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: deploy_password | |
| regex: deploy[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: deploy_secure | |
| regex: deploy[_-]?secure(=| =|:| :) | |
| confidence: low | |
| - name: deploy_token | |
| regex: deploy[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: deploy_user | |
| regex: deploy[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: dgpg_passphrase | |
| regex: dgpg[_-]?passphrase(=| =|:| :) | |
| confidence: low | |
| - name: digitalocean_access_token | |
| regex: digitalocean[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: digitalocean_ssh_key_body | |
| regex: digitalocean[_-]?ssh[_-]?key[_-]?body(=| =|:| :) | |
| confidence: low | |
| - name: digitalocean_ssh_key_ids | |
| regex: digitalocean[_-]?ssh[_-]?key[_-]?ids(=| =|:| :) | |
| confidence: low | |
| - name: docker_hub_password | |
| regex: docker[_-]?hub[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: docker_key | |
| regex: docker[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: docker_pass | |
| regex: docker[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: docker_passwd | |
| regex: docker[_-]?passwd(=| =|:| :) | |
| confidence: high | |
| - name: docker_password | |
| regex: docker[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: docker_postgres_url | |
| regex: docker[_-]?postgres[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: docker_token | |
| regex: docker[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: dockerhub_password | |
| regex: dockerhub[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: dockerhubpassword | |
| regex: dockerhubpassword(=| =|:| :) | |
| confidence: low | |
| - name: doordash_auth_token | |
| regex: doordash[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: dropbox_oauth_bearer | |
| regex: dropbox[_-]?oauth[_-]?bearer(=| =|:| :) | |
| confidence: high | |
| - name: droplet_travis_password | |
| regex: droplet[_-]?travis[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: dsonar_login | |
| regex: dsonar[_-]?login(=| =|:| :) | |
| confidence: low | |
| - name: dsonar_projectkey | |
| regex: dsonar[_-]?projectkey(=| =|:| :) | |
| confidence: low | |
| - name: elastic_cloud_auth | |
| regex: elastic[_-]?cloud[_-]?auth(=| =|:| :) | |
| confidence: low | |
| - name: elasticsearch_password | |
| regex: elasticsearch[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: encryption_password | |
| regex: encryption[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: end_user_password | |
| regex: end[_-]?user[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: env_github_oauth_token | |
| regex: env[_-]?github[_-]?oauth[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: env_heroku_api_key | |
| regex: env[_-]?heroku[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: env_key | |
| regex: env[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: env_secret | |
| regex: env[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: env_secret_access_key | |
| regex: env[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: env_sonatype_password | |
| regex: env[_-]?sonatype[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: eureka_awssecretkey | |
| regex: eureka[_-]?awssecretkey(=| =|:| :) | |
| confidence: low | |
| - name: exp_password | |
| regex: exp[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: facebook_access_token | |
| regex: (EAACEdEose0cBA[0-9A-Za-z]+) | |
| confidence: high | |
| - name: facebook_oauth | |
| regex: '[f|F][a|A][c|C][e|E][b|B][o|O][o|O][k|K].*[''|"][0-9a-f]{32}[''|"]' | |
| confidence: low | |
| - name: file_password | |
| regex: file[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: firebase_api_json | |
| regex: firebase[_-]?api[_-]?json(=| =|:| :) | |
| confidence: high | |
| - name: firebase_api_token | |
| regex: firebase[_-]?api[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: firebase_key | |
| regex: firebase[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: firebase_project_develop | |
| regex: firebase[_-]?project[_-]?develop(=| =|:| :) | |
| confidence: low | |
| - name: firebase_token | |
| regex: firebase[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: firefox_secret | |
| regex: firefox[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: flask_secret_key | |
| regex: flask[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: flickr_api_key | |
| regex: flickr[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: flickr_api_secret | |
| regex: flickr[_-]?api[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: fossa_api_key | |
| regex: fossa[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: ftp_host | |
| regex: ftp[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: ftp_login | |
| regex: ftp[_-]?login(=| =|:| :) | |
| confidence: low | |
| - name: ftp_password | |
| regex: ftp[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ftp_pw | |
| regex: ftp[_-]?pw(=| =|:| :) | |
| confidence: high | |
| - name: ftp_user | |
| regex: ftp[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: ftp_username | |
| regex: ftp[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: gcloud_bucket | |
| regex: gcloud[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: gcloud_project | |
| regex: gcloud[_-]?project(=| =|:| :) | |
| confidence: low | |
| - name: gcloud_service_key | |
| regex: gcloud[_-]?service[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: gcr_password | |
| regex: gcr[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: gcs_bucket | |
| regex: gcs[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: gh_api_key | |
| regex: gh[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: gh_email | |
| regex: gh[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: gh_next_oauth_client_secret | |
| regex: gh[_-]?next[_-]?oauth[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: gh_next_unstable_oauth_client_id | |
| regex: gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: gh_next_unstable_oauth_client_secret | |
| regex: gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: gh_oauth_client_secret | |
| regex: gh[_-]?oauth[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: gh_oauth_token | |
| regex: gh[_-]?oauth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: gh_repo_token | |
| regex: gh[_-]?repo[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: gh_token | |
| regex: gh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: gh_unstable_oauth_client_secret | |
| regex: gh[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: ghb_token | |
| regex: ghb[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: ghost_api_key | |
| regex: ghost[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: git_author_email | |
| regex: git[_-]?author[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: git_author_name | |
| regex: git[_-]?author[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: git_committer_email | |
| regex: git[_-]?committer[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: git_committer_name | |
| regex: git[_-]?committer[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: git_email | |
| regex: git[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: git_name | |
| regex: git[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: git_token | |
| regex: git[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_access_token - 1 | |
| regex: github[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_access_token - 2 | |
| regex: '[a-zA-Z0-9_-]*:[a-zA-Z0-9_-][email protected]*' | |
| confidence: low | |
| - name: github_api_key | |
| regex: github[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: github_api_token | |
| regex: github[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_auth | |
| regex: github[_-]?auth(=| =|:| :) | |
| confidence: low | |
| - name: github_auth_token | |
| regex: github[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_client_secret | |
| regex: github[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: github_deploy_hb_doc_pass | |
| regex: github[_-]?deploy[_-]?hb[_-]?doc[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: github_deployment_token | |
| regex: github[_-]?deployment[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_hunter_token | |
| regex: github[_-]?hunter[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_hunter_username | |
| regex: github[_-]?hunter[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: github_key | |
| regex: github[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: github_oauth | |
| regex: github[_-]?oauth(=| =|:| :) | |
| confidence: high | |
| - name: github_oauth_token | |
| regex: github[_-]?oauth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_password | |
| regex: github[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: github_pwd | |
| regex: github[_-]?pwd(=| =|:| :) | |
| confidence: low | |
| - name: github_release_token | |
| regex: github[_-]?release[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: github_repo | |
| regex: github[_-]?repo(=| =|:| :) | |
| confidence: low | |
| - name: github_token | |
| regex: github[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: github_tokens | |
| regex: github[_-]?tokens(=| =|:| :) | |
| confidence: high | |
| - name: gitlab_user_email | |
| regex: gitlab[_-]?user[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: gogs_password | |
| regex: gogs[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: google_account_type | |
| regex: google[_-]?account[_-]?type(=| =|:| :) | |
| confidence: low | |
| - name: google_client_email | |
| regex: google[_-]?client[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: google_client_id | |
| regex: google[_-]?client[_-]?id(=| =|:| :) | |
| confidence: high | |
| - name: google_client_secret | |
| regex: google[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: google_maps_api_key | |
| regex: google[_-]?maps[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: google_oauth | |
| regex: (ya29.[0-9A-Za-z-_]+) | |
| confidence: high | |
| - name: google_patterns | |
| regex: (?:google_client_id|google_client_secret|google_client_token) | |
| confidence: low | |
| - name: google_private_key | |
| regex: google[_-]?private[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: google_url | |
| regex: ([0-9]{12}-[a-z0-9]{32}.apps.googleusercontent.com) | |
| confidence: low | |
| - name: gpg_key_name | |
| regex: gpg[_-]?key[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: gpg_keyname | |
| regex: gpg[_-]?keyname(=| =|:| :) | |
| confidence: low | |
| - name: gpg_ownertrust | |
| regex: gpg[_-]?ownertrust(=| =|:| :) | |
| confidence: low | |
| - name: gpg_passphrase | |
| regex: gpg[_-]?passphrase(=| =|:| :) | |
| confidence: low | |
| - name: gpg_private_key | |
| regex: gpg[_-]?private[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: gpg_secret_keys | |
| regex: gpg[_-]?secret[_-]?keys(=| =|:| :) | |
| confidence: low | |
| - name: gradle_publish_key | |
| regex: gradle[_-]?publish[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: gradle_publish_secret | |
| regex: gradle[_-]?publish[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: gradle_signing_key_id | |
| regex: gradle[_-]?signing[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: gradle_signing_password | |
| regex: gradle[_-]?signing[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: gren_github_token | |
| regex: gren[_-]?github[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: grgit_user | |
| regex: grgit[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: hab_auth_token | |
| regex: hab[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: hab_key | |
| regex: hab[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: hb_codesign_gpg_pass | |
| regex: hb[_-]?codesign[_-]?gpg[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: hb_codesign_key_pass | |
| regex: hb[_-]?codesign[_-]?key[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: heroku_api_key | |
| regex: heroku[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: heroku_api_key_api_key | |
| regex: ([h|H][e|E][r|R][o|O][k|K][u|U].{0,30}[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}) | |
| confidence: low | |
| - name: heroku_email | |
| regex: heroku[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: heroku_token | |
| regex: heroku[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: hockeyapp | |
| regex: hockey.{0,50}("|')?[0-9a-f]{32}("|')? | |
| confidence: low | |
| - name: hockeyapp_token | |
| regex: hockeyapp[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: homebrew_github_api_token | |
| regex: homebrew[_-]?github[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: hub_dxia2_password | |
| regex: hub[_-]?dxia2[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ij_repo_password | |
| regex: ij[_-]?repo[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ij_repo_username | |
| regex: ij[_-]?repo[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: index_name | |
| regex: index[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: integration_test_api_key | |
| regex: integration[_-]?test[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: integration_test_appid | |
| regex: integration[_-]?test[_-]?appid(=| =|:| :) | |
| confidence: low | |
| - name: internal_secrets | |
| regex: internal[_-]?secrets(=| =|:| :) | |
| confidence: low | |
| - name: ios_docs_deploy_token | |
| regex: ios[_-]?docs[_-]?deploy[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: itest_gh_token | |
| regex: itest[_-]?gh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: jdbc | |
| regex: 'mysql: jdbc:mysql(=| =|:| :)' | |
| confidence: low | |
| - name: jdbc_databaseurl | |
| regex: jdbc[_-]?databaseurl(=| =|:| :) | |
| confidence: low | |
| - name: jdbc_host | |
| regex: jdbc[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: jwt_secret | |
| regex: jwt[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: kafka_admin_url | |
| regex: kafka[_-]?admin[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: kafka_instance_name | |
| regex: kafka[_-]?instance[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: kafka_rest_url | |
| regex: kafka[_-]?rest[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: keystore_pass | |
| regex: keystore[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: kovan_private_key | |
| regex: kovan[_-]?private[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: kubecfg_s3_path | |
| regex: kubecfg[_-]?s3[_-]?path(=| =|:| :) | |
| confidence: low | |
| - name: kubeconfig | |
| regex: kubeconfig(=| =|:| :) | |
| confidence: low | |
| - name: kxoltsn3vogdop92m | |
| regex: kxoltsn3vogdop92m(=| =|:| :) | |
| confidence: low | |
| - name: leanplum_key | |
| regex: leanplum[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: lektor_deploy_password | |
| regex: lektor[_-]?deploy[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: lektor_deploy_username | |
| regex: lektor[_-]?deploy[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: lighthouse_api_key | |
| regex: lighthouse[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: linux_signing_key | |
| regex: linux[_-]?signing[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: ll_publish_url | |
| regex: ll[_-]?publish[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: ll_shared_key | |
| regex: ll[_-]?shared[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: looker_test_runner_client_secret | |
| regex: looker[_-]?test[_-]?runner[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: lottie_happo_api_key | |
| regex: lottie[_-]?happo[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: lottie_happo_secret_key | |
| regex: lottie[_-]?happo[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: lottie_s3_secret_key | |
| regex: lottie[_-]?s3[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: lottie_upload_cert_key_password | |
| regex: lottie[_-]?upload[_-]?cert[_-]?key[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: lottie_upload_cert_key_store_password | |
| regex: lottie[_-]?upload[_-]?cert[_-]?key[_-]?store[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: magento_auth_password | |
| regex: magento[_-]?auth[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: magento_auth_username | |
| regex: magento[_-]?auth[_-]?username (=| =|:| :) | |
| confidence: low | |
| - name: magento_password | |
| regex: magento[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mail_password | |
| regex: mail[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mailchimp | |
| regex: (W(?:[a-f0-9]{32}(-us[0-9]{1,2}))a-zA-Z0-9) | |
| confidence: high | |
| - name: mailchimp_api_key | |
| regex: mailchimp[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mailchimp_key | |
| regex: mailchimp[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mailer_password | |
| regex: mailer[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mailgun | |
| regex: (key-[0-9a-f]{32}) | |
| confidence: low | |
| - name: mailgun_api_key | |
| regex: mailgun[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mailgun_apikey | |
| regex: mailgun[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: mailgun_password | |
| regex: mailgun[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mailgun_priv_key | |
| regex: mailgun[_-]?priv[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: mailgun_pub_apikey | |
| regex: mailgun[_-]?pub[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: mailgun_pub_key | |
| regex: mailgun[_-]?pub[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mailgun_secret_api_key | |
| regex: mailgun[_-]?secret[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: manage_key | |
| regex: manage[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: manage_secret | |
| regex: manage[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: management_token | |
| regex: management[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: managementapiaccesstoken | |
| regex: managementapiaccesstoken(=| =|:| :) | |
| confidence: low | |
| - name: mandrill_api_key | |
| regex: mandrill[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: manifest_app_token | |
| regex: manifest[_-]?app[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: manifest_app_url | |
| regex: manifest[_-]?app[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: mapbox_access_token | |
| regex: mapbox[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: mapbox_api_token | |
| regex: mapbox[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: mapbox_aws_access_key_id | |
| regex: mapbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: mapbox_aws_secret_access_key | |
| regex: mapbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mapboxaccesstoken | |
| regex: mapboxaccesstoken(=| =|:| :) | |
| confidence: low | |
| - name: master_password | |
| regex: (master_password).+ | |
| confidence: high | |
| - name: mg_api_key | |
| regex: mg[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: mg_public_api_key | |
| regex: mg[_-]?public[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: mh_apikey | |
| regex: mh[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: mh_password | |
| regex: mh[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mile_zero_key | |
| regex: mile[_-]?zero[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: minio_access_key | |
| regex: minio[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: minio_secret_key | |
| regex: minio[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: multi_bob_sid | |
| regex: multi[_-]?bob[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: multi_connect_sid | |
| regex: multi[_-]?connect[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: multi_disconnect_sid | |
| regex: multi[_-]?disconnect[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: multi_workflow_sid | |
| regex: multi[_-]?workflow[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: multi_workspace_sid | |
| regex: multi[_-]?workspace[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: my_secret_env | |
| regex: my[_-]?secret[_-]?env(=| =|:| :) | |
| confidence: low | |
| - name: mysql_database | |
| regex: mysql[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: mysql_hostname | |
| regex: mysql[_-]?hostname(=| =|:| :) | |
| confidence: low | |
| - name: mysql_password | |
| regex: mysql[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: mysql_root_password | |
| regex: mysql[_-]?root[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: mysql_user | |
| regex: mysql[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: mysql_username | |
| regex: mysql[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: mysqlmasteruser | |
| regex: mysqlmasteruser(=| =|:| :) | |
| confidence: low | |
| - name: mysqlsecret | |
| regex: mysqlsecret(=| =|:| :) | |
| confidence: low | |
| - name: nativeevents | |
| regex: nativeevents(=| =|:| :) | |
| confidence: low | |
| - name: netlify_api_key | |
| regex: netlify[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: new_relic_beta_token | |
| regex: new[_-]?relic[_-]?beta[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: nexus_password | |
| regex: nexus[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: nexuspassword | |
| regex: nexuspassword(=| =|:| :) | |
| confidence: low | |
| - name: ngrok_auth_token | |
| regex: ngrok[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: ngrok_token | |
| regex: ngrok[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: node_env | |
| regex: node[_-]?env(=| =|:| :) | |
| confidence: low | |
| - name: node_pre_gyp_accesskeyid | |
| regex: node[_-]?pre[_-]?gyp[_-]?accesskeyid(=| =|:| :) | |
| confidence: low | |
| - name: node_pre_gyp_github_token | |
| regex: node[_-]?pre[_-]?gyp[_-]?github[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: node_pre_gyp_secretaccesskey | |
| regex: node[_-]?pre[_-]?gyp[_-]?secretaccesskey(=| =|:| :) | |
| confidence: low | |
| - name: non_token | |
| regex: non[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: now_token | |
| regex: now[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: npm_api_key | |
| regex: npm[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: npm_api_token | |
| regex: npm[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: npm_auth_token | |
| regex: npm[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: npm_email | |
| regex: npm[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: npm_password | |
| regex: npm[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: npm_secret_key | |
| regex: npm[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: npm_token - 1 | |
| regex: npm[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: nuget_api_key - 1 | |
| regex: (oy2[a-z0-9]{43}) | |
| confidence: low | |
| - name: nuget_api_key - 2 | |
| regex: nuget[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: numbers_service_pass | |
| regex: numbers[_-]?service[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: oauth_token | |
| regex: oauth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: object_storage_password | |
| regex: object[_-]?storage[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: object_storage_region_name | |
| regex: object[_-]?storage[_-]?region[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: object_store_bucket | |
| regex: object[_-]?store[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: object_store_creds | |
| regex: object[_-]?store[_-]?creds(=| =|:| :) | |
| confidence: low | |
| - name: oc_pass | |
| regex: oc[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: octest_app_password | |
| regex: octest[_-]?app[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: octest_app_username | |
| regex: octest[_-]?app[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: octest_password | |
| regex: octest[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ofta_key | |
| regex: ofta[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: ofta_region | |
| regex: ofta[_-]?region(=| =|:| :) | |
| confidence: low | |
| - name: ofta_secret | |
| regex: ofta[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: okta_client_token | |
| regex: okta[_-]?client[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: okta_oauth2_client_secret | |
| regex: okta[_-]?oauth2[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: okta_oauth2_clientsecret | |
| regex: okta[_-]?oauth2[_-]?clientsecret(=| =|:| :) | |
| confidence: low | |
| - name: omise_key | |
| regex: omise[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: omise_pkey | |
| regex: omise[_-]?pkey(=| =|:| :) | |
| confidence: low | |
| - name: omise_pubkey | |
| regex: omise[_-]?pubkey(=| =|:| :) | |
| confidence: low | |
| - name: omise_skey | |
| regex: omise[_-]?skey(=| =|:| :) | |
| confidence: low | |
| - name: onesignal_api_key | |
| regex: onesignal[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: onesignal_user_auth_key | |
| regex: onesignal[_-]?user[_-]?auth[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: open_whisk_key | |
| regex: open[_-]?whisk[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: openwhisk_key | |
| regex: openwhisk[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: os_auth_url | |
| regex: os[_-]?auth[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: os_password | |
| regex: os[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ossrh_jira_password | |
| regex: ossrh[_-]?jira[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ossrh_pass | |
| regex: ossrh[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: ossrh_password | |
| regex: ossrh[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: ossrh_secret | |
| regex: ossrh[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: ossrh_username | |
| regex: ossrh[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: outlook_team | |
| regex: (https://outlook.office.com/webhook/[0-9a-f-]{36}@) | |
| confidence: low | |
| - name: packagecloud_token | |
| regex: packagecloud[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: pagerduty_apikey | |
| regex: pagerduty[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: parse_js_key | |
| regex: parse[_-]?js[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: passwordtravis | |
| regex: passwordtravis(=| =|:| :) | |
| confidence: low | |
| - name: paypal_braintree_access_token | |
| regex: (access_token$production$[0-9a-z]{16}$[0-9a-f]{32}) | |
| confidence: low | |
| - name: paypal_client_secret | |
| regex: paypal[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: percy_project | |
| regex: percy[_-]?project(=| =|:| :) | |
| confidence: low | |
| - name: percy_token | |
| regex: percy[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: personal_key | |
| regex: personal[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: personal_secret | |
| regex: personal[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: pg_database | |
| regex: pg[_-]?database(=| =|:| :) | |
| confidence: low | |
| - name: pg_host | |
| regex: pg[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: places_api_key | |
| regex: places[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: places_apikey | |
| regex: places[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: plotly_apikey | |
| regex: plotly[_-]?apikey(=| =|:| :) | |
| confidence: low | |
| - name: plugin_password | |
| regex: plugin[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: postgres_env_postgres_db | |
| regex: postgres[_-]?env[_-]?postgres[_-]?db(=| =|:| :) | |
| confidence: low | |
| - name: postgres_env_postgres_password | |
| regex: postgres[_-]?env[_-]?postgres[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: postgresql_db | |
| regex: postgresql[_-]?db(=| =|:| :) | |
| confidence: low | |
| - name: postgresql_pass | |
| regex: postgresql[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: prebuild_auth | |
| regex: prebuild[_-]?auth(=| =|:| :) | |
| confidence: low | |
| - name: preferred_username | |
| regex: preferred[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: pring_mail_username | |
| regex: pring[_-]?mail[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: private_key | |
| regex: '-----(?:(?:BEGIN|END) )(?:(?:EC|PGP|DSA|RSA|OPENSSH).)?PRIVATE.KEY(.BLOCK)?-----' | |
| confidence: low | |
| - name: private_signing_password | |
| regex: private[_-]?signing[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: prod_access_key_id | |
| regex: prod[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: prod_password | |
| regex: prod[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: prod_secret_key | |
| regex: prod[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: project_config | |
| regex: project[_-]?config(=| =|:| :) | |
| confidence: low | |
| - name: publish_access | |
| regex: publish[_-]?access(=| =|:| :) | |
| confidence: low | |
| - name: publish_key | |
| regex: publish[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: publish_secret | |
| regex: publish[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: pushover_token | |
| regex: pushover[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: pypi_passowrd | |
| regex: pypi[_-]?passowrd(=| =|:| :) | |
| confidence: low | |
| - name: qiita_token | |
| regex: qiita[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: quip_token | |
| regex: quip[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: rabbitmq_password | |
| regex: rabbitmq[_-]?password(=| =|:| :) | |
| confidence: high | |
| - name: randrmusicapiaccesstoken | |
| regex: randrmusicapiaccesstoken(=| =|:| :) | |
| confidence: low | |
| - name: redis_stunnel_urls | |
| regex: redis[_-]?stunnel[_-]?urls(=| =|:| :) | |
| confidence: low | |
| - name: rediscloud_url | |
| regex: rediscloud[_-]?url(=| =|:| :) | |
| confidence: high | |
| - name: refresh_token | |
| regex: refresh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: registry_pass | |
| regex: registry[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: registry_secure | |
| regex: registry[_-]?secure(=| =|:| :) | |
| confidence: low | |
| - name: release_gh_token | |
| regex: release[_-]?gh[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: release_token | |
| regex: release[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: reporting_webdav_pwd | |
| regex: reporting[_-]?webdav[_-]?pwd(=| =|:| :) | |
| confidence: low | |
| - name: reporting_webdav_url | |
| regex: reporting[_-]?webdav[_-]?url(=| =|:| :) | |
| confidence: low | |
| - name: repotoken | |
| regex: repotoken(=| =|:| :) | |
| confidence: low | |
| - name: rest_api_key | |
| regex: rest[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: rinkeby_private_key | |
| regex: rinkeby[_-]?private[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: ropsten_private_key | |
| regex: ropsten[_-]?private[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: route53_access_key_id | |
| regex: route53[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: rtd_key_pass | |
| regex: rtd[_-]?key[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: rtd_store_pass | |
| regex: rtd[_-]?store[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: rubygems_auth_token | |
| regex: rubygems[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: s3_access_key | |
| regex: s3[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: s3_access_key_id | |
| regex: s3[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: s3_bucket_name_app_logs | |
| regex: s3[_-]?bucket[_-]?name[_-]?app[_-]?logs(=| =|:| :) | |
| confidence: low | |
| - name: s3_bucket_name_assets | |
| regex: s3[_-]?bucket[_-]?name[_-]?assets(=| =|:| :) | |
| confidence: low | |
| - name: s3_external_3_amazonaws_com | |
| regex: s3[_-]?external[_-]?3[_-]?amazonaws[_-]?com(=| =|:| :) | |
| confidence: low | |
| - name: s3_key | |
| regex: s3[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: s3_key_app_logs | |
| regex: s3[_-]?key[_-]?app[_-]?logs(=| =|:| :) | |
| confidence: low | |
| - name: s3_key_assets | |
| regex: s3[_-]?key[_-]?assets(=| =|:| :) | |
| confidence: low | |
| - name: s3_secret_app_logs | |
| regex: s3[_-]?secret[_-]?app[_-]?logs(=| =|:| :) | |
| confidence: low | |
| - name: s3_secret_assets | |
| regex: s3[_-]?secret[_-]?assets(=| =|:| :) | |
| confidence: low | |
| - name: s3_secret_key | |
| regex: s3[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: s3_user_secret | |
| regex: s3[_-]?user[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: sacloud_access_token | |
| regex: sacloud[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sacloud_access_token_secret | |
| regex: sacloud[_-]?access[_-]?token[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: sacloud_api | |
| regex: sacloud[_-]?api(=| =|:| :) | |
| confidence: low | |
| - name: salesforce_bulk_test_password | |
| regex: salesforce[_-]?bulk[_-]?test[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: salesforce_bulk_test_security_token | |
| regex: salesforce[_-]?bulk[_-]?test[_-]?security[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sandbox_access_token | |
| regex: sandbox[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sandbox_aws_access_key_id | |
| regex: sandbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: sandbox_aws_secret_access_key | |
| regex: sandbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sauce_access_key | |
| regex: sauce[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sauce_token | |
| regex: (sauce.{0,50}("|')?[0-9a-f-]{36}("|')?) | |
| confidence: low | |
| - name: scrutinizer_token | |
| regex: scrutinizer[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sdr_token | |
| regex: sdr[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: secret_0 | |
| regex: secret[_-]?0(=| =|:| :) | |
| confidence: low | |
| - name: secret_1 | |
| regex: secret[_-]?1(=| =|:| :) | |
| confidence: low | |
| - name: secret_10 | |
| regex: secret[_-]?10(=| =|:| :) | |
| confidence: low | |
| - name: secret_11 | |
| regex: secret[_-]?11(=| =|:| :) | |
| confidence: low | |
| - name: secret_2 | |
| regex: secret[_-]?2(=| =|:| :) | |
| confidence: low | |
| - name: secret_3 | |
| regex: secret[_-]?3(=| =|:| :) | |
| confidence: low | |
| - name: secret_4 | |
| regex: secret[_-]?4(=| =|:| :) | |
| confidence: low | |
| - name: secret_5 | |
| regex: secret[_-]?5(=| =|:| :) | |
| confidence: low | |
| - name: secret_6 | |
| regex: secret[_-]?6(=| =|:| :) | |
| confidence: low | |
| - name: secret_7 | |
| regex: secret[_-]?7(=| =|:| :) | |
| confidence: low | |
| - name: secret_8 | |
| regex: secret[_-]?8(=| =|:| :) | |
| confidence: low | |
| - name: secret_9 | |
| regex: secret[_-]?9(=| =|:| :) | |
| confidence: low | |
| - name: secret_key_base | |
| regex: secret[_-]?key[_-]?base(=| =|:| :) | |
| confidence: low | |
| - name: secretaccesskey | |
| regex: secretaccesskey(=| =|:| :) | |
| confidence: low | |
| - name: secretkey | |
| regex: secretkey(=| =|:| :) | |
| confidence: low | |
| - name: segment_api_key | |
| regex: segment[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: selion_log_level_dev | |
| regex: selion[_-]?log[_-]?level[_-]?dev(=| =|:| :) | |
| confidence: low | |
| - name: selion_selenium_host | |
| regex: selion[_-]?selenium[_-]?host(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid - 2 | |
| regex: sendgrid(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid_api_key - 1 | |
| regex: sendgrid[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid_key | |
| regex: sendgrid[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid_password | |
| regex: sendgrid[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid_user | |
| regex: sendgrid[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: sendgrid_username | |
| regex: sendgrid[_-]?username(=| =|:| :) | |
| confidence: low | |
| - name: sendwithus_key | |
| regex: sendwithus[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sentry_auth_token | |
| regex: sentry[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sentry_default_org | |
| regex: sentry[_-]?default[_-]?org(=| =|:| :) | |
| confidence: low | |
| - name: sentry_endpoint | |
| regex: sentry[_-]?endpoint(=| =|:| :) | |
| confidence: low | |
| - name: sentry_key | |
| regex: sentry[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: service_account_secret | |
| regex: service[_-]?account[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: ses_access_key | |
| regex: ses[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: ses_secret_key | |
| regex: ses[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: setdstaccesskey | |
| regex: setdstaccesskey(=| =|:| :) | |
| confidence: low | |
| - name: setdstsecretkey | |
| regex: setdstsecretkey(=| =|:| :) | |
| confidence: low | |
| - name: setsecretkey | |
| regex: setsecretkey(=| =|:| :) | |
| confidence: low | |
| - name: signing_key | |
| regex: signing[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: signing_key_password | |
| regex: signing[_-]?key[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: signing_key_secret | |
| regex: signing[_-]?key[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: signing_key_sid | |
| regex: signing[_-]?key[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: slack_webhook_url | |
| regex: (hooks.slack.com/services/T[A-Z0-9]{8}/B[A-Z0-9]{8}/[a-zA-Z0-9]{1,}) | |
| confidence: low | |
| - name: slash_developer_space | |
| regex: slash[_-]?developer[_-]?space(=| =|:| :) | |
| confidence: low | |
| - name: slash_developer_space_key | |
| regex: slash[_-]?developer[_-]?space[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: slate_user_email | |
| regex: slate[_-]?user[_-]?email(=| =|:| :) | |
| confidence: low | |
| - name: snoowrap_client_secret | |
| regex: snoowrap[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: snoowrap_password | |
| regex: snoowrap[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: snoowrap_refresh_token | |
| regex: snoowrap[_-]?refresh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: snyk_api_token | |
| regex: snyk[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: snyk_token | |
| regex: snyk[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: socrata_app_token | |
| regex: socrata[_-]?app[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: socrata_password | |
| regex: socrata[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sonar_organization_key | |
| regex: sonar[_-]?organization[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sonar_project_key | |
| regex: sonar[_-]?project[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: sonar_token | |
| regex: sonar[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: sonarqube_docs_api_key | |
| regex: (sonar.{0,50}("|')?[0-9a-f]{40}("|')?) | |
| confidence: low | |
| - name: sonatype_gpg_key_name | |
| regex: sonatype[_-]?gpg[_-]?key[_-]?name(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_gpg_passphrase | |
| regex: sonatype[_-]?gpg[_-]?passphrase(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_nexus_password | |
| regex: sonatype[_-]?nexus[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_pass | |
| regex: sonatype[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_password | |
| regex: sonatype[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_token_password | |
| regex: sonatype[_-]?token[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sonatype_token_user | |
| regex: sonatype[_-]?token[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: sonatypepassword | |
| regex: sonatypepassword(=| =|:| :) | |
| confidence: low | |
| - name: soundcloud_client_secret | |
| regex: soundcloud[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: soundcloud_password | |
| regex: soundcloud[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: spaces_access_key_id | |
| regex: spaces[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: spaces_secret_access_key | |
| regex: spaces[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: spotify_api_access_token | |
| regex: spotify[_-]?api[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: spotify_api_client_secret | |
| regex: spotify[_-]?api[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: spring_mail_password | |
| regex: spring[_-]?mail[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: sqsaccesskey | |
| regex: sqsaccesskey(=| =|:| :) | |
| confidence: low | |
| - name: sqssecretkey | |
| regex: sqssecretkey(=| =|:| :) | |
| confidence: low | |
| - name: square_app_secret | |
| regex: (sq0[a-z]{3}-[0-9A-Za-z-_]{20,50}) | |
| confidence: low | |
| - name: square_reader_sdk_repository_password | |
| regex: square[_-]?reader[_-]?sdk[_-]?repository[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: srcclr_api_token | |
| regex: srcclr[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: ssh_password | |
| regex: (sshpass -p.*['|"]) | |
| confidence: low | |
| - name: sshpass | |
| regex: sshpass(=| =|:| :) | |
| confidence: low | |
| - name: ssmtp_config | |
| regex: ssmtp[_-]?config(=| =|:| :) | |
| confidence: low | |
| - name: staging_base_url_runscope | |
| regex: staging[_-]?base[_-]?url[_-]?runscope(=| =|:| :) | |
| confidence: low | |
| - name: star_test_aws_access_key_id | |
| regex: star[_-]?test[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: star_test_bucket | |
| regex: star[_-]?test[_-]?bucket(=| =|:| :) | |
| confidence: low | |
| - name: star_test_location | |
| regex: star[_-]?test[_-]?location(=| =|:| :) | |
| confidence: low | |
| - name: star_test_secret_access_key | |
| regex: star[_-]?test[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: starship_account_sid | |
| regex: starship[_-]?account[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: starship_auth_token | |
| regex: starship[_-]?auth[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: stormpath_api_key_id | |
| regex: stormpath[_-]?api[_-]?key[_-]?id(=| =|:| :) | |
| confidence: low | |
| - name: stormpath_api_key_secret | |
| regex: stormpath[_-]?api[_-]?key[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: strip_publishable_key | |
| regex: strip[_-]?publishable[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: strip_secret_key | |
| regex: strip[_-]?secret[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: stripe_private | |
| regex: stripe[_-]?private(=| =|:| :) | |
| confidence: low | |
| - name: stripe_public | |
| regex: stripe[_-]?public(=| =|:| :) | |
| confidence: low | |
| - name: stripe_restricted_api | |
| regex: (rk_live_[0-9a-zA-Z]{24,34}) | |
| confidence: low | |
| - name: stripe_standard_api | |
| regex: (sk_live_[0-9a-zA-Z]{24,34}) | |
| confidence: low | |
| - name: surge_login | |
| regex: surge[_-]?login(=| =|:| :) | |
| confidence: low | |
| - name: surge_token | |
| regex: surge[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: svn_pass | |
| regex: svn[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: tesco_api_key | |
| regex: tesco[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: test_github_token | |
| regex: test[_-]?github[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: test_test | |
| regex: test[_-]?test(=| =|:| :) | |
| confidence: low | |
| - name: tester_keys_password | |
| regex: tester[_-]?keys[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: thera_oss_access_key | |
| regex: thera[_-]?oss[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: token_core_java | |
| regex: token[_-]?core[_-]?java(=| =|:| :) | |
| confidence: low | |
| - name: travis_access_token | |
| regex: travis[_-]?access[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: travis_api_token | |
| regex: travis[_-]?api[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: travis_branch | |
| regex: travis[_-]?branch(=| =|:| :) | |
| confidence: low | |
| - name: travis_com_token | |
| regex: travis[_-]?com[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: travis_e2e_token | |
| regex: travis[_-]?e2e[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: travis_gh_token | |
| regex: travis[_-]?gh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: travis_pull_request | |
| regex: travis[_-]?pull[_-]?request(=| =|:| :) | |
| confidence: low | |
| - name: travis_secure_env_vars | |
| regex: travis[_-]?secure[_-]?env[_-]?vars(=| =|:| :) | |
| confidence: high | |
| - name: travis_token | |
| regex: travis[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: trex_client_token | |
| regex: trex[_-]?client[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: trex_okta_client_token | |
| regex: trex[_-]?okta[_-]?client[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: twilio_api_key | |
| regex: twilio[_-]?api[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: twilio_api_secret | |
| regex: twilio[_-]?api[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: twilio_chat_account_api_service | |
| regex: twilio[_-]?chat[_-]?account[_-]?api[_-]?service(=| =|:| :) | |
| confidence: high | |
| - name: twilio_configuration_sid | |
| regex: twilio[_-]?configuration[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: twilio_sid | |
| regex: twilio[_-]?sid(=| =|:| :) | |
| confidence: low | |
| - name: twilio_token | |
| regex: twilio[_-]?token(=| =|:| :) | |
| confidence: high | |
| - name: twine_password | |
| regex: twine[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: twitter_consumer_key | |
| regex: twitter[_-]?consumer[_-]?key(=| =|:| :) | |
| confidence: high | |
| - name: twitter_consumer_secret | |
| regex: twitter[_-]?consumer[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: twitteroauthaccesssecret | |
| regex: twitteroauthaccesssecret(=| =|:| :) | |
| confidence: high | |
| - name: twitteroauthaccesstoken | |
| regex: twitteroauthaccesstoken(=| =|:| :) | |
| confidence: high | |
| - name: unity_password | |
| regex: unity[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: unity_serial | |
| regex: unity[_-]?serial(=| =|:| :) | |
| confidence: low | |
| - name: urban_key | |
| regex: urban[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: urban_master_secret | |
| regex: urban[_-]?master[_-]?secret(=| =|:| :) | |
| confidence: high | |
| - name: urban_secret | |
| regex: urban[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: us_east_1_elb_amazonaws_com | |
| regex: us[_-]?east[_-]?1[_-]?elb[_-]?amazonaws[_-]?com(=| =|:| :) | |
| confidence: low | |
| - name: use_ssh | |
| regex: use[_-]?ssh(=| =|:| :) | |
| confidence: high | |
| - name: user_assets_access_key_id | |
| regex: user[_-]?assets[_-]?access[_-]?key[_-]?id(=| =|:| :) | |
| confidence: high | |
| - name: user_assets_secret_access_key | |
| regex: user[_-]?assets[_-]?secret[_-]?access[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: usertravis | |
| regex: usertravis(=| =|:| :) | |
| confidence: low | |
| - name: v_sfdc_client_secret | |
| regex: v[_-]?sfdc[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: v_sfdc_password | |
| regex: v[_-]?sfdc[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: vip_github_build_repo_deploy_key | |
| regex: vip[_-]?github[_-]?build[_-]?repo[_-]?deploy[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: vip_github_deploy_key | |
| regex: vip[_-]?github[_-]?deploy[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: vip_github_deploy_key_pass | |
| regex: vip[_-]?github[_-]?deploy[_-]?key[_-]?pass(=| =|:| :) | |
| confidence: low | |
| - name: virustotal_apikey | |
| regex: virustotal[_-]?apikey(=| =|:| :) | |
| confidence: high | |
| - name: visual_recognition_api_key | |
| regex: visual[_-]?recognition[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: vscetoken | |
| regex: vscetoken(=| =|:| :) | |
| confidence: low | |
| - name: wakatime_api_key | |
| regex: wakatime[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: watson_conversation_password | |
| regex: watson[_-]?conversation[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: watson_device_password | |
| regex: watson[_-]?device[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: watson_password | |
| regex: watson[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: widget_basic_password | |
| regex: widget[_-]?basic[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: widget_basic_password_2 | |
| regex: widget[_-]?basic[_-]?password[_-]?2(=| =|:| :) | |
| confidence: low | |
| - name: widget_basic_password_3 | |
| regex: widget[_-]?basic[_-]?password[_-]?3(=| =|:| :) | |
| confidence: low | |
| - name: widget_basic_password_4 | |
| regex: widget[_-]?basic[_-]?password[_-]?4(=| =|:| :) | |
| confidence: low | |
| - name: widget_basic_password_5 | |
| regex: widget[_-]?basic[_-]?password[_-]?5(=| =|:| :) | |
| confidence: low | |
| - name: widget_fb_password | |
| regex: widget[_-]?fb[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: widget_fb_password_2 | |
| regex: widget[_-]?fb[_-]?password[_-]?2(=| =|:| :) | |
| confidence: low | |
| - name: widget_fb_password_3 | |
| regex: widget[_-]?fb[_-]?password[_-]?3(=| =|:| :) | |
| confidence: low | |
| - name: widget_test_server | |
| regex: widget[_-]?test[_-]?server(=| =|:| :) | |
| confidence: low | |
| - name: wincert_password | |
| regex: wincert[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: wordpress_db_password | |
| regex: wordpress[_-]?db[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: wordpress_db_user | |
| regex: wordpress[_-]?db[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: wpjm_phpunit_google_geocode_api_key | |
| regex: wpjm[_-]?phpunit[_-]?google[_-]?geocode[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: wporg_password | |
| regex: wporg[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: wpt_db_password | |
| regex: wpt[_-]?db[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: wpt_db_user | |
| regex: wpt[_-]?db[_-]?user(=| =|:| :) | |
| confidence: low | |
| - name: wpt_prepare_dir | |
| regex: wpt[_-]?prepare[_-]?dir(=| =|:| :) | |
| confidence: low | |
| - name: wpt_report_api_key | |
| regex: wpt[_-]?report[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: wpt_ssh_connect | |
| regex: wpt[_-]?ssh[_-]?connect(=| =|:| :) | |
| confidence: low | |
| - name: wpt_ssh_private_key_base64 | |
| regex: wpt[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :) | |
| confidence: low | |
| - name: www_googleapis_com | |
| regex: www[_-]?googleapis[_-]?com(=| =|:| :) | |
| confidence: low | |
| - name: yangshun_gh_password | |
| regex: yangshun[_-]?gh[_-]?password(=| =|:| :) | |
| confidence: low | |
| - name: yangshun_gh_token | |
| regex: yangshun[_-]?gh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: yt_account_client_secret | |
| regex: yt[_-]?account[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: yt_account_refresh_token | |
| regex: yt[_-]?account[_-]?refresh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: yt_api_key | |
| regex: yt[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: yt_client_secret | |
| regex: yt[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: yt_partner_client_secret | |
| regex: yt[_-]?partner[_-]?client[_-]?secret(=| =|:| :) | |
| confidence: low | |
| - name: yt_partner_refresh_token | |
| regex: yt[_-]?partner[_-]?refresh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: yt_server_api_key | |
| regex: yt[_-]?server[_-]?api[_-]?key(=| =|:| :) | |
| confidence: low | |
| - name: zendesk_travis_github | |
| regex: zendesk[_-]?travis[_-]?github(=| =|:| :) | |
| confidence: low | |
| - name: zensonatypepassword | |
| regex: zensonatypepassword(=| =|:| :) | |
| confidence: low | |
| - name: zhuliang_gh_token | |
| regex: zhuliang[_-]?gh[_-]?token(=| =|:| :) | |
| confidence: low | |
| - name: zopim_account_key | |
| regex: zopim[_-]?account[_-]?key(=| =|:| :)ls | |
| confidence: low |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment