diff --git a/docs/rules.md b/docs/rules.md index d6f3750..38b7632 100644 --- a/docs/rules.md +++ b/docs/rules.md @@ -2,17 +2,19 @@ Auto-generated by `make docs` -Total rules: 107 +Total rules: 114 | Name | ID | Description | Tags | Entropy | |------|----|-----------|----|---------| | [Airtable PAT](#ghost.airtable.1) | ghost.airtable.1 | Airtable PAT | api, airtable, pat | 4.1 | | [Anthropic API Key](#ghost.anthropic.1) | ghost.anthropic.1 | Anthropic API key. | api, anthropic | 5.1 | | [Anthropic Admin API Key](#ghost.anthropic.2) | ghost.anthropic.2 | Anthropic admin API key. | api, anthropic, admin | 5.1 | +| [Apify API Token](#ghost.apify.1) | ghost.apify.1 | Apify API Token | api, apify | 4.5 | | [Artifactory Legacy API Key](#ghost.artifactory.1) | ghost.artifactory.1 | Legacy Artifactory API key. | api, artifactory | 4.5 | | [Artifactory Access Token](#ghost.artifactory.2) | ghost.artifactory.2 | Artifactory identity token variable declaration. | api, artifactory, identity, reference, token | 5.1 | | [Artifactory Identity Token](#ghost.artifactory.3) | ghost.artifactory.3 | An Artifactory identity token variable declaration. | api, artifactory, identity, reference, token | 4.1 | | [Atlassian API Token](#ghost.atlassian.1) | ghost.atlassian.1 | Atlassian API token. | api, atlassian, token, jira | 5.2 | +| [Atlassian API Token](#ghost.atlassian.2) | ghost.atlassian.2 | Atlassian API token. | api, atlassian, token, jira | 5.2 | | [Auth0 Client Secret](#ghost.auth0.1) | ghost.auth0.1 | Auth0 client secret. | api, auth0, client, secret | 5.1 | | [AWS Secret Access Key](#ghost.aws.1) | ghost.aws.1 | AWS secret access key variable declaration. | api, aws | 4.1 | | [AWS Session Token](#ghost.aws.2) | ghost.aws.2 | AWS session token variable declaration. | api, aws | 5.5 | @@ -39,6 +41,7 @@ Total rules: 107 | [Docker Hub PAT](#ghost.docker.1) | ghost.docker.1 | Docker Hub Personal Access Token. | docker, api | 4.1 | | [Drata API Key](#ghost.drata.1) | ghost.drata.1 | Drata API key. | api, drata | 3.2 | | [Dynatrace API Token](#ghost.dynatrace.1) | ghost.dynatrace.1 | Dynatrace API token. | api, dynatrace | 4.5 | +| [Eleven Labs API Key](#ghost.elevenlabs.1) | ghost.elevenlabs.1 | Eleven Labs API key. | api, eleven, elevenlabs | 3.4 | | [Fastly API Key](#ghost.fastly.1) | ghost.fastly.1 | Fastly API key. | api, fastly | 4.2 | | [Firecrawl API Key](#ghost.firecrawl.1) | ghost.firecrawl.1 | Firecrawl API key. | api, firecrawl | 3.1 | | [Fly.io API Key](#ghost.flyio.1) | ghost.flyio.1 | Fly.io API key. | api, flyio | 5.5 | @@ -72,6 +75,7 @@ Total rules: 107 | [Mailgun API Key](#ghost.mailgun.1) | ghost.mailgun.1 | Mailgun API key. | api, mailgun | 4.1 | | [Mistral API Key](#ghost.mistral.1) | ghost.mistral.1 | Mistral API key. | api, mistral | 4.5 | | [MySQL Senstive Connection String](#ghost.mysql.1) | ghost.mysql.1 | MySQL connection string with credentials. | api, mysql | 4.1 | +| [Netlify PAT](#ghost.netlify.1) | ghost.netlify.1 | Netlify Personal Access Token. | api, netlify, pat | 4.2 | | [ngrok API Key](#ghost.ngrok.1) | ghost.ngrok.1 | ngrok API key. | api, ngrok, key | 4.5 | | [Notion API Client Secret](#ghost.notion.1) | ghost.notion.1 | Notion API client secret. | api, notion | 4.5 | | [Notion API Token](#ghost.notion.2) | ghost.notion.2 | Notion API token. | api, notion | 4.5 | @@ -82,11 +86,13 @@ Total rules: 107 | [OpenAI API Key](#ghost.openai.1) | ghost.openai.1 | Matches an OpenAI API key. | api, openai | 5.1 | | [OpenAI Admin API Key](#ghost.openai.2) | ghost.openai.2 | Matches an OpenAI admin API key. | api, openai, admin | 5.1 | | [OpenAI Legacy API Key](#ghost.openai.3) | ghost.openai.3 | Matches an OpenAI legacy API key. | api, openai, legacy | 5.1 | +| [OpenRouter API Key](#ghost.openrouter.1) | ghost.openrouter.1 | OpenRouter API Key | api, openrouter | 3.5 | | [Perplexity API Key](#ghost.perplexity.1) | ghost.perplexity.1 | Perplexity API key. | api, perplexity | 4.3 | | [PlanetScale API Key](#ghost.planetscale.1) | ghost.planetscale.1 | PlanetScale API key. | api, planetscale | 4.1 | | [PostgreSQL Senstive Connection String](#ghost.postgres.1) | ghost.postgres.1 | PostgreSQL connection string with credentials. | api, postgres, postgresql | 4.1 | | [Pulumi Access Token](#ghost.pulumi.1) | ghost.pulumi.1 | Pulumi access token. | api, pulumi | 3.3 | | [PyPI API Key](#ghost.pypi.1) | ghost.pypi.1 | PyPI API key. | api, pypi | 4.5 | +| [Resend API Key](#ghost.resend.1) | ghost.resend.1 | Resend API key. | api, resend | 4.2 | | [Salesforce App Consumer Secret](#ghost.salesforce.1) | ghost.salesforce.1 | Salesforce App Consumer Secret. | api, salesforce | 4.1 | | [Salesforce App Consumer Key](#ghost.salesforce.2) | ghost.salesforce.2 | Salesforce App Consumer Key. | api, salesforce | 5.1 | | [Salesforce Security Token](#ghost.salesforce.3) | ghost.salesforce.3 | Salesforce Security Token. | api, salesforce, token | 4.1 | @@ -106,6 +112,7 @@ Total rules: 107 | [Stability AI API Key](#ghost.stability.1) | ghost.stability.1 | Stability AI API key. | api, stability | 4.4 | | [Stripe Legacy API Key](#ghost.stripe.1) | ghost.stripe.1 | Stripe legacy API key. | api, stripe | 4.1 | | [Stripe API Key](#ghost.stripe.2) | ghost.stripe.2 | Stripe API key. | api, stripe | 5.1 | +| [Stripe Webhook Secret](#ghost.stripe.3) | ghost.stripe.3 | Stripe Webhook key. | api, stripe, webhook | 4.5 | | [Supabase Sensitive Connection String](#ghost.supabase.1) | ghost.supabase.1 | Supabase connection string with credentials. | api, supabase | 4.1 | | [Supabase API Key](#ghost.supabase.2) | ghost.supabase.2 | Supabase API key. | api, supabase | 4.1 | | [Supabase Personal Access Token](#ghost.supabase.3) | ghost.supabase.3 | Supabase personal access token. | api, supabase, pat | 3.3 | @@ -191,6 +198,31 @@ Total rules: 107 - assert_not: 1 cases + +### Apify API Token + +**ID:** `ghost.apify.1` + +**Description:** Apify API Token + +**Tags:** api, apify + +**Pattern:** +``` +(?x) + \b + (apify_api_(?i)[A-Z0-9]{36}) + \b + +``` + +**Min entropy:** 4.5 + +**Tests:** +- assert: 2 cases +- assert_not: 2 cases + + ### Artifactory Legacy API Key @@ -299,6 +331,31 @@ Total rules: 107 - assert_not: 2 cases + +### Atlassian API Token + +**ID:** `ghost.atlassian.2` + +**Description:** Atlassian API token. + +**Tags:** api, atlassian, token, jira + +**Pattern:** +``` +(?x) + \b + (ATATT3xFfGF(?i)[A-Z0-9_-]{172}\=[A-F0-9]{8}) + \b + +``` + +**Min entropy:** 5.2 + +**Tests:** +- assert: 3 cases +- assert_not: 4 cases + + ### Auth0 Client Secret @@ -975,6 +1032,31 @@ Total rules: 107 - assert_not: 3 cases + +### Eleven Labs API Key + +**ID:** `ghost.elevenlabs.1` + +**Description:** Eleven Labs API key. + +**Tags:** api, eleven, elevenlabs + +**Pattern:** +``` +(?x) + \b + (sk_(?i)[A-F0-9]{48}) + \b + +``` + +**Min entropy:** 3.4 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### Fastly API Key @@ -1836,6 +1918,31 @@ Total rules: 107 - assert_not: 1 cases + +### Netlify PAT + +**ID:** `ghost.netlify.1` + +**Description:** Netlify Personal Access Token. + +**Tags:** api, netlify, pat + +**Pattern:** +``` +(?x) + \b + (nfp_(?i)[A-Z0-9]{36}) + \b + +``` + +**Min entropy:** 4.2 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### ngrok API Key @@ -2108,6 +2215,31 @@ Total rules: 107 - assert_not: 2 cases + +### OpenRouter API Key + +**ID:** `ghost.openrouter.1` + +**Description:** OpenRouter API Key + +**Tags:** api, openrouter + +**Pattern:** +``` +(?x) + \b + (sk-or-v1-(?i)[A-F0-9]{64}) + \b + +``` + +**Min entropy:** 3.5 + +**Tests:** +- assert: 2 cases +- assert_not: 2 cases + + ### Perplexity API Key @@ -2235,6 +2367,31 @@ Total rules: 107 - assert_not: 2 cases + +### Resend API Key + +**ID:** `ghost.resend.1` + +**Description:** Resend API key. + +**Tags:** api, resend + +**Pattern:** +``` +(?x) + \b + (re_(?i)[A-Z0-9]{8}_[A-Z0-9]{24}) + \b + +``` + +**Min entropy:** 4.2 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### Salesforce App Consumer Secret @@ -2724,7 +2881,7 @@ Total rules: 107 ``` (?x) \b - ([sr]k_live_[a-zA-Z0-9]{25,250}) + ([sr]k_live_(?i)[A-Z0-9]{25,250}) \b ``` @@ -2736,6 +2893,31 @@ Total rules: 107 - assert_not: 3 cases + +### Stripe Webhook Secret + +**ID:** `ghost.stripe.3` + +**Description:** Stripe Webhook key. + +**Tags:** api, stripe, webhook + +**Pattern:** +``` +(?x) + \b + (whsec_(?i)[A-Z0-9]{32}) + \b + +``` + +**Min entropy:** 4.5 + +**Tests:** +- assert: 2 cases +- assert_not: 4 cases + + ### Supabase Sensitive Connection String diff --git a/pkg/rules/apify.yaml b/pkg/rules/apify.yaml new file mode 100644 index 0000000..0d37254 --- /dev/null +++ b/pkg/rules/apify.yaml @@ -0,0 +1,25 @@ +rules: + - name: Apify API Token + id: ghost.apify.1 + description: Apify API Token + tags: + - api + - apify + pattern: | + (?x) + \b + (apify_api_(?i)[A-Z0-9]{36}) + \b + entropy: 4.5 + redact: [13, 4] + tests: + assert: + - apify_api_UWlpshXStPbAWKJjO0Dsioww6fVick29MyZf + - apify_api_2gqmbisMLp5zuEH2UzjTjx9fX0SCx21HEBU6 + assert_not: + - apify_api_UWlpshXStPbAWKJjO0Dsioww6fVick29MyZfx + - apify_api_2gqmbisMLp5zuEH2UzTjx9fX0SCx21HEBU6 + history: + - 2026-03-23 initial version + refs: + - https://docs.apify.com/platform/integrations/api diff --git a/pkg/rules/atlassian.yaml b/pkg/rules/atlassian.yaml index 6de9401..4cee0b9 100644 --- a/pkg/rules/atlassian.yaml +++ b/pkg/rules/atlassian.yaml @@ -25,8 +25,37 @@ rules: - 'export BITBUCKET_TOKEN="ATATT3xFfGF02FT44VPlyet-CmNO5AIXd3fMmEOaORwcyoadVytsKNH4EUAFR2rbr4c4zJCZ_Vl74N17gL5fQ4MbN0cE4uNaUZXDF3GoDx2cXt_PBdKqrUSDtQqnqHANyVlHJzltPDetMY0Z_rvm-yQUV2CRyF2fxJMj8N1S_6g2YbgbdTr3xhA=CB050D44"' assert_not: - 'export BITBUCKET_TOKEN="AZATT3xFfGF02FT44VPlyet-CmNO5AIXd3fMmEOaORwcyoadVytsKNH4EUAFR2rbr4c4zJCZ_Vl74N17gL5fQ4MbN0cE4uNaUZXDF3GoDx2cXt_PBdKqrUSDtQqnqHANyVlHJzltPDetMY0Z_rvm-yQUV2CRyF2fxJMj8N1S_6g2YbgbdTr3xhA=CB050D44"' - - 'BITBUCKET_TOKEN=1234567890123456789012345' + - "BITBUCKET_TOKEN=1234567890123456789012345" history: - 2025-08-13 initial version refs: - https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/ + - name: Atlassian API Token + id: ghost.atlassian.2 + description: Atlassian API token. + tags: + - api + - atlassian + - token + - jira + pattern: | + (?x) + \b + (ATATT3xFfGF(?i)[A-Z0-9_-]{172}\=[A-F0-9]{8}) + \b + entropy: 5.2 + redact: [16, 4] + tests: + assert: + - ATATT3xFfGF0e4B4OMjMS-SGlCl7JAgLXoc7LW6PYrDUUnQo2IQ7ZRObr69h9XgDudve019Iwt-WTqAUPVP327u9cQRjQVHfNIMOQemq3AMDIa6yXmEPr-B5dI990wAetltPGZKzPcMXWbNUZGRT58Cuh_Vn7FAStr3vB9MWFxhlKzCvLDfWgCQ=3917DDB4 + - ATATT3xFfGF0XV6HgfqtVaCN7FGnVtONwnRSIssan940Or9w05qcHjXbxdRHC_-c5C908faZCziguBqZa7CwNySDoBC7yF8rG0eGGfgLJQbl4HmuqRjy7YBLpnTnyw6mLWlW--y4q_OP-0eoB5rTDRdYJwhl6t1uHlihuWPxhJymCq1ezzxiFbU=D517AD64 + - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE=1BF68EF5 + assert_not: + - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE+1BF68EF5 + - ATATT4xFfGF0e4B4OMjMS-SGlCl7JAgLXoc7LW6PYrDUUnQo2IQ7ZRObr69h9XgDudve019Iwt-WTqAUPVP327u9cQRjQVHfNIMOQemq3AMDIa6yXmEPr-B5dI990wAetltPGZKzPcMXWbNUZGRT58Cuh_Vn7FAStr3vB9MWFxhlKzCvLDfWgCQ=3917DDB4 + - ATATT3xFfGF0XV6HgfqtVaCN7FGnVtONwnRSIssan940Or9w05qcHjXbxdRHC_-c5C908faZCziguBqZa7CwNySDoBC7yF8rG0eGGfgLJQbl4HmuqRjy7YBLpnTnyw6mLWlW--y4q_OP-0eoB5rTDRdYJwhl6t1uHlihuWPxhJymCq1ezzxiFbUx=D517AD64 + - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE=21BF68EF5 + history: + - 2026-03-23 initial version + refs: + - https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/ diff --git a/pkg/rules/elevenlabs.yaml b/pkg/rules/elevenlabs.yaml new file mode 100644 index 0000000..13dbf99 --- /dev/null +++ b/pkg/rules/elevenlabs.yaml @@ -0,0 +1,28 @@ +rules: + - name: Eleven Labs API Key + id: ghost.elevenlabs.1 + description: Eleven Labs API key. + tags: + - api + - eleven + - elevenlabs + pattern: | + (?x) + \b + (sk_(?i)[A-F0-9]{48}) + \b + entropy: 3.4 + redact: [6, 4] + tests: + assert: + - sk_15579ddb10e53098e649b00f4c11c5c0fd18def0f5ca0b2c + - sk_f1460d7c38ad7fe67f745447ee1a1f53d97f369eed8d0e9f + - sk_c6c3ddc6f136150e7c71c3a4cb012ee5cc25e17f26719a17 + assert_not: + - sk_15579ddb10e53098e649b00f4c11c5c0fd18def0f5ca0b2cx + - sk_f1460d7c38ad7fe67f745447ee1a1f53d97f369eed8d0e9 + - sk_c6c3ddc6f136150e7c71c3a4gb012ee5cc25e17f26719a17 + history: + - 2026-03-23 initial version + refs: + - https://elevenlabs.io/docs/api-reference/service-accounts/api-keys/create diff --git a/pkg/rules/netlify.yaml b/pkg/rules/netlify.yaml new file mode 100644 index 0000000..c7109e7 --- /dev/null +++ b/pkg/rules/netlify.yaml @@ -0,0 +1,28 @@ +rules: + - name: Netlify PAT + id: ghost.netlify.1 + description: Netlify Personal Access Token. + tags: + - api + - netlify + - pat + pattern: | + (?x) + \b + (nfp_(?i)[A-Z0-9]{36}) + \b + entropy: 4.2 + redact: [8, 4] + tests: + assert: + - nfp_j4w8o3ww2TE3boJm8rmYWm8Qdbezqx5N14e5 + - nfp_5LZHXQ6aq5SpMjSdQBMyAfSjxpAnVTeB03a6 + - nfp_rGoqiDzcvC94KinnmcK9pr8rxcdmD89Sf3a9 + assert_not: + - nfp_j4w8o3ww2TE3boJm8rmYWm8Qdbezqx5N14e5x + - nfp_5LZHXQ6aq5SpMjSdQBMyAfSjxpAnVTeB03a + - nfp_rGoqiDzcvC94Kin-mcK9pr8rxcdmD89Sf3a9 + history: + - 2026-03-23 initial version + refs: + - https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/#authentication diff --git a/pkg/rules/openrouter.yaml b/pkg/rules/openrouter.yaml new file mode 100644 index 0000000..cb15ce8 --- /dev/null +++ b/pkg/rules/openrouter.yaml @@ -0,0 +1,25 @@ +rules: + - name: OpenRouter API Key + id: ghost.openrouter.1 + description: OpenRouter API Key + tags: + - api + - openrouter + pattern: | + (?x) + \b + (sk-or-v1-(?i)[A-F0-9]{64}) + \b + entropy: 3.5 + redact: [13, 4] + tests: + assert: + - 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 + - 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 + assert_not: + - sk-or-v1-c96055918aabbdc0954660544c2f07889890ab9b4cd1b22a5636fd5add437b80x + - sk-or-v1-2d31c06cb6c37d0dc7f123b112dc06797528f613cc94a13694d133a0a0a43b7x + history: + - 2026-03-23 initial version + refs: + - https://openrouter.ai/docs/api/reference/authentication diff --git a/pkg/rules/resend.yaml b/pkg/rules/resend.yaml new file mode 100644 index 0000000..377aa1c --- /dev/null +++ b/pkg/rules/resend.yaml @@ -0,0 +1,27 @@ +rules: + - name: Resend API Key + id: ghost.resend.1 + description: Resend API key. + tags: + - api + - resend + pattern: | + (?x) + \b + (re_(?i)[A-Z0-9]{8}_[A-Z0-9]{24}) + \b + entropy: 4.2 + redact: [6, 4] + tests: + assert: + - re_BauAchpc_FLWcTwzGrY44a5vU2c6mzq6P + - re_Vqmks8SC_5dVXwFGhugb2AdBBnhrU3UmB + - re_fJWNrDyx_JN39UA81ZfQLAQYQeGKm686T + assert_not: + - re_BauAchpc_FLWcTwzGrY44a5vU2c6mzq6Px + - re_Vqmks8SC_5dVXwFGhugb2AdBBnhrU3Um + - res_fJWNrDyx_JN39UA81ZfQLAQYQeGKm686T + history: + - 2026-03-23 initial version + refs: + - https://resend.com/docs/dashboard/api-keys/introduction diff --git a/pkg/rules/stripe.yaml b/pkg/rules/stripe.yaml index 1323073..2864a1c 100644 --- a/pkg/rules/stripe.yaml +++ b/pkg/rules/stripe.yaml @@ -33,7 +33,7 @@ rules: pattern: | (?x) \b - ([sr]k_live_[a-zA-Z0-9]{25,250}) + ([sr]k_live_(?i)[A-Z0-9]{25,250}) \b entropy: 5.1 redact: [11, 4] @@ -50,3 +50,30 @@ rules: - 2025-08-12 initial version refs: - https://stripe.com/docs/api/authentication + - name: Stripe Webhook Secret + id: ghost.stripe.3 + description: Stripe Webhook key. + tags: + - api + - stripe + - webhook + pattern: | + (?x) + \b + (whsec_(?i)[A-Z0-9]{32}) + \b + entropy: 4.5 + redact: [10, 4] + tests: + assert: + - whsec_bnwoMdok8DLWLoVxbUiMmZqw6jceyoHE + - whsec_wZ1Us1WWow0OPcqBUmWBZ0V58G6LvPxe + assert_not: + - whsec_bnwoMdok8DLWLoVxbUiMmZqw6jceyoHEx + - whsec_wZ1Us1WWow0OPcqBUmWBZ0V58G6LvPx + - whsec_bnwoMdok8DLWL^VxbUiMmZqw6jceyoHE + - whsec_wZ1Us1WWow%OPcqBUmWBZ0V58G6LvPe + history: + - 2026-03-23 initial version + refs: + - https://stripe.com/docs/api/authentication