feat: add rules

docs/rules.md

@@ -2,17 +2,19 @@
 
 Auto-generated by `make docs`
 
-Total rules: 107
+Total rules: 114
 
 | Name | ID | Description | Tags | Entropy |
 |------|----|-----------|----|---------|
 | [Airtable PAT](#ghost.airtable.1) | ghost.airtable.1 | Airtable PAT | api, airtable, pat | 4.1 |
 | [Anthropic API Key](#ghost.anthropic.1) | ghost.anthropic.1 | Anthropic API key. | api, anthropic | 5.1 |
 | [Anthropic Admin API Key](#ghost.anthropic.2) | ghost.anthropic.2 | Anthropic admin API key. | api, anthropic, admin | 5.1 |
+| [Apify API Token](#ghost.apify.1) | ghost.apify.1 | Apify API Token | api, apify | 4.5 |
 | [Artifactory Legacy API Key](#ghost.artifactory.1) | ghost.artifactory.1 | Legacy Artifactory API key. | api, artifactory | 4.5 |
 | [Artifactory Access Token](#ghost.artifactory.2) | ghost.artifactory.2 | Artifactory identity token variable declaration. | api, artifactory, identity, reference, token | 5.1 |
 | [Artifactory Identity Token](#ghost.artifactory.3) | ghost.artifactory.3 | An Artifactory identity token variable declaration. | api, artifactory, identity, reference, token | 4.1 |
 | [Atlassian API Token](#ghost.atlassian.1) | ghost.atlassian.1 | Atlassian API token. | api, atlassian, token, jira | 5.2 |
+| [Atlassian API Token](#ghost.atlassian.2) | ghost.atlassian.2 | Atlassian API token. | api, atlassian, token, jira | 5.2 |
 | [Auth0 Client Secret](#ghost.auth0.1) | ghost.auth0.1 | Auth0 client secret. | api, auth0, client, secret | 5.1 |
 | [AWS Secret Access Key](#ghost.aws.1) | ghost.aws.1 | AWS secret access key variable declaration. | api, aws | 4.1 |
 | [AWS Session Token](#ghost.aws.2) | ghost.aws.2 | AWS session token variable declaration. | api, aws | 5.5 |
@@ -39,6 +41,7 @@ Total rules: 107
 | [Docker Hub PAT](#ghost.docker.1) | ghost.docker.1 | Docker Hub Personal Access Token. | docker, api | 4.1 |
 | [Drata API Key](#ghost.drata.1) | ghost.drata.1 | Drata API key. | api, drata | 3.2 |
 | [Dynatrace API Token](#ghost.dynatrace.1) | ghost.dynatrace.1 | Dynatrace API token. | api, dynatrace | 4.5 |
+| [Eleven Labs API Key](#ghost.elevenlabs.1) | ghost.elevenlabs.1 | Eleven Labs API key. | api, eleven, elevenlabs | 3.4 |
 | [Fastly API Key](#ghost.fastly.1) | ghost.fastly.1 | Fastly API key. | api, fastly | 4.2 |
 | [Firecrawl API Key](#ghost.firecrawl.1) | ghost.firecrawl.1 | Firecrawl API key. | api, firecrawl | 3.1 |
 | [Fly.io API Key](#ghost.flyio.1) | ghost.flyio.1 | Fly.io API key. | api, flyio | 5.5 |
@@ -72,6 +75,7 @@ Total rules: 107
 | [Mailgun API Key](#ghost.mailgun.1) | ghost.mailgun.1 | Mailgun API key. | api, mailgun | 4.1 |
 | [Mistral API Key](#ghost.mistral.1) | ghost.mistral.1 | Mistral API key. | api, mistral | 4.5 |
 | [MySQL Senstive Connection String](#ghost.mysql.1) | ghost.mysql.1 | MySQL connection string with credentials. | api, mysql | 4.1 |
+| [Netlify PAT](#ghost.netlify.1) | ghost.netlify.1 | Netlify Personal Access Token. | api, netlify, pat | 4.2 |
 | [ngrok API Key](#ghost.ngrok.1) | ghost.ngrok.1 | ngrok API key. | api, ngrok, key | 4.5 |
 | [Notion API Client Secret](#ghost.notion.1) | ghost.notion.1 | Notion API client secret. | api, notion | 4.5 |
 | [Notion API Token](#ghost.notion.2) | ghost.notion.2 | Notion API token. | api, notion | 4.5 |
@@ -82,11 +86,13 @@ Total rules: 107
 | [OpenAI API Key](#ghost.openai.1) | ghost.openai.1 | Matches an OpenAI API key. | api, openai | 5.1 |
 | [OpenAI Admin API Key](#ghost.openai.2) | ghost.openai.2 | Matches an OpenAI admin API key. | api, openai, admin | 5.1 |
 | [OpenAI Legacy API Key](#ghost.openai.3) | ghost.openai.3 | Matches an OpenAI legacy API key. | api, openai, legacy | 5.1 |
+| [OpenRouter API Key](#ghost.openrouter.1) | ghost.openrouter.1 | OpenRouter API Key | api, openrouter | 3.5 |
 | [Perplexity API Key](#ghost.perplexity.1) | ghost.perplexity.1 | Perplexity API key. | api, perplexity | 4.3 |
 | [PlanetScale API Key](#ghost.planetscale.1) | ghost.planetscale.1 | PlanetScale API key. | api, planetscale | 4.1 |
 | [PostgreSQL Senstive Connection String](#ghost.postgres.1) | ghost.postgres.1 | PostgreSQL connection string with credentials. | api, postgres, postgresql | 4.1 |
 | [Pulumi Access Token](#ghost.pulumi.1) | ghost.pulumi.1 | Pulumi access token. | api, pulumi | 3.3 |
 | [PyPI API Key](#ghost.pypi.1) | ghost.pypi.1 | PyPI API key. | api, pypi | 4.5 |
+| [Resend API Key](#ghost.resend.1) | ghost.resend.1 | Resend API key. | api, resend | 4.2 |
 | [Salesforce App Consumer Secret](#ghost.salesforce.1) | ghost.salesforce.1 | Salesforce App Consumer Secret. | api, salesforce | 4.1 |
 | [Salesforce App Consumer Key](#ghost.salesforce.2) | ghost.salesforce.2 | Salesforce App Consumer Key. | api, salesforce | 5.1 |
 | [Salesforce Security Token](#ghost.salesforce.3) | ghost.salesforce.3 | Salesforce Security Token. | api, salesforce, token | 4.1 |
@@ -106,6 +112,7 @@ Total rules: 107
 | [Stability AI API Key](#ghost.stability.1) | ghost.stability.1 | Stability AI API key. | api, stability | 4.4 |
 | [Stripe Legacy API Key](#ghost.stripe.1) | ghost.stripe.1 | Stripe legacy API key. | api, stripe | 4.1 |
 | [Stripe API Key](#ghost.stripe.2) | ghost.stripe.2 | Stripe API key. | api, stripe | 5.1 |
+| [Stripe Webhook Secret](#ghost.stripe.3) | ghost.stripe.3 | Stripe Webhook key. | api, stripe, webhook | 4.5 |
 | [Supabase Sensitive Connection String](#ghost.supabase.1) | ghost.supabase.1 | Supabase connection string with credentials. | api, supabase | 4.1 |
 | [Supabase API Key](#ghost.supabase.2) | ghost.supabase.2 | Supabase API key. | api, supabase | 4.1 |
 | [Supabase Personal Access Token](#ghost.supabase.3) | ghost.supabase.3 | Supabase personal access token. | api, supabase, pat | 3.3 |
@@ -191,6 +198,31 @@ Total rules: 107
 - assert_not: 1 cases
 
 
+<a id="ghost.apify.1"></a>
+### Apify API Token
+
+**ID:** `ghost.apify.1`
+
+**Description:** Apify API Token
+
+**Tags:** api, apify
+
+**Pattern:**
+```
+(?x)
+  \b
+    (apify_api_(?i)[A-Z0-9]{36})
+  \b
+
+```
+
+**Min entropy:** 4.5
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 2 cases
+
+
 <a id="ghost.artifactory.1"></a>
 ### Artifactory Legacy API Key
 
@@ -299,6 +331,31 @@ Total rules: 107
 - assert_not: 2 cases
 
 
+<a id="ghost.atlassian.2"></a>
+### Atlassian API Token
+
+**ID:** `ghost.atlassian.2`
+
+**Description:** Atlassian API token.
+
+**Tags:** api, atlassian, token, jira
+
+**Pattern:**
+```
+(?x)
+  \b
+    (ATATT3xFfGF(?i)[A-Z0-9_-]{172}\=[A-F0-9]{8})
+  \b
+
+```
+
+**Min entropy:** 5.2
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 4 cases
+
+
 <a id="ghost.auth0.1"></a>
 ### Auth0 Client Secret
 
@@ -975,6 +1032,31 @@ Total rules: 107
 - assert_not: 3 cases
 
 
+<a id="ghost.elevenlabs.1"></a>
+### Eleven Labs API Key
+
+**ID:** `ghost.elevenlabs.1`
+
+**Description:** Eleven Labs API key.
+
+**Tags:** api, eleven, elevenlabs
+
+**Pattern:**
+```
+(?x)
+  \b
+    (sk_(?i)[A-F0-9]{48})
+  \b
+
+```
+
+**Min entropy:** 3.4
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
 <a id="ghost.fastly.1"></a>
 ### Fastly API Key
 
@@ -1836,6 +1918,31 @@ Total rules: 107
 - assert_not: 1 cases
 
 
+<a id="ghost.netlify.1"></a>
+### Netlify PAT
+
+**ID:** `ghost.netlify.1`
+
+**Description:** Netlify Personal Access Token.
+
+**Tags:** api, netlify, pat
+
+**Pattern:**
+```
+(?x)
+  \b
+    (nfp_(?i)[A-Z0-9]{36})
+  \b
+
+```
+
+**Min entropy:** 4.2
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
 <a id="ghost.ngrok.1"></a>
 ### ngrok API Key
 
@@ -2108,6 +2215,31 @@ Total rules: 107
 - assert_not: 2 cases
 
 
+<a id="ghost.openrouter.1"></a>
+### OpenRouter API Key
+
+**ID:** `ghost.openrouter.1`
+
+**Description:** OpenRouter API Key
+
+**Tags:** api, openrouter
+
+**Pattern:**
+```
+(?x)
+  \b
+    (sk-or-v1-(?i)[A-F0-9]{64})
+  \b
+
+```
+
+**Min entropy:** 3.5
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 2 cases
+
+
 <a id="ghost.perplexity.1"></a>
 ### Perplexity API Key
 
@@ -2235,6 +2367,31 @@ Total rules: 107
 - assert_not: 2 cases
 
 
+<a id="ghost.resend.1"></a>
+### Resend API Key
+
+**ID:** `ghost.resend.1`
+
+**Description:** Resend API key.
+
+**Tags:** api, resend
+
+**Pattern:**
+```
+(?x)
+  \b
+    (re_(?i)[A-Z0-9]{8}_[A-Z0-9]{24})
+  \b
+
+```
+
+**Min entropy:** 4.2
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
 <a id="ghost.salesforce.1"></a>
 ### Salesforce App Consumer Secret
 
@@ -2724,7 +2881,7 @@ Total rules: 107
 ```
 (?x)
   \b
-    ([sr]k_live_[a-zA-Z0-9]{25,250})
+    ([sr]k_live_(?i)[A-Z0-9]{25,250})
   \b
 
 ```
@@ -2736,6 +2893,31 @@ Total rules: 107
 - assert_not: 3 cases
 
 
+<a id="ghost.stripe.3"></a>
+### Stripe Webhook Secret
+
+**ID:** `ghost.stripe.3`
+
+**Description:** Stripe Webhook key.
+
+**Tags:** api, stripe, webhook
+
+**Pattern:**
+```
+(?x)
+  \b
+    (whsec_(?i)[A-Z0-9]{32})
+  \b
+
+```
+
+**Min entropy:** 4.5
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 4 cases
+
+
 <a id="ghost.supabase.1"></a>
 ### Supabase Sensitive Connection String
 

pkg/rules/apify.yaml

@@ -0,0 +1,25 @@
+rules:
+  - name: Apify API Token
+    id: ghost.apify.1
+    description: Apify API Token
+    tags:
+      - api
+      - apify
+    pattern: |
+      (?x)
+        \b
+          (apify_api_(?i)[A-Z0-9]{36})
+        \b
+    entropy: 4.5
+    redact: [13, 4]
+    tests:
+      assert:
+        - apify_api_UWlpshXStPbAWKJjO0Dsioww6fVick29MyZf
+        - apify_api_2gqmbisMLp5zuEH2UzjTjx9fX0SCx21HEBU6
+      assert_not:
+        - apify_api_UWlpshXStPbAWKJjO0Dsioww6fVick29MyZfx
+        - apify_api_2gqmbisMLp5zuEH2UzTjx9fX0SCx21HEBU6
+    history:
+      - 2026-03-23 initial version
+    refs:
+      - https://docs.apify.com/platform/integrations/api

pkg/rules/atlassian.yaml

@@ -25,8 +25,37 @@ rules:
         - 'export BITBUCKET_TOKEN="ATATT3xFfGF02FT44VPlyet-CmNO5AIXd3fMmEOaORwcyoadVytsKNH4EUAFR2rbr4c4zJCZ_Vl74N17gL5fQ4MbN0cE4uNaUZXDF3GoDx2cXt_PBdKqrUSDtQqnqHANyVlHJzltPDetMY0Z_rvm-yQUV2CRyF2fxJMj8N1S_6g2YbgbdTr3xhA=CB050D44"'
       assert_not:
         - 'export BITBUCKET_TOKEN="AZATT3xFfGF02FT44VPlyet-CmNO5AIXd3fMmEOaORwcyoadVytsKNH4EUAFR2rbr4c4zJCZ_Vl74N17gL5fQ4MbN0cE4uNaUZXDF3GoDx2cXt_PBdKqrUSDtQqnqHANyVlHJzltPDetMY0Z_rvm-yQUV2CRyF2fxJMj8N1S_6g2YbgbdTr3xhA=CB050D44"'
-        - 'BITBUCKET_TOKEN=1234567890123456789012345'
+        - "BITBUCKET_TOKEN=1234567890123456789012345"
     history:
       - 2025-08-13 initial version
     refs:
       - https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/
+  - name: Atlassian API Token
+    id: ghost.atlassian.2
+    description: Atlassian API token.
+    tags:
+      - api
+      - atlassian
+      - token
+      - jira
+    pattern: |
+      (?x)
+        \b
+          (ATATT3xFfGF(?i)[A-Z0-9_-]{172}\=[A-F0-9]{8})
+        \b
+    entropy: 5.2
+    redact: [16, 4]
+    tests:
+      assert:
+        - ATATT3xFfGF0e4B4OMjMS-SGlCl7JAgLXoc7LW6PYrDUUnQo2IQ7ZRObr69h9XgDudve019Iwt-WTqAUPVP327u9cQRjQVHfNIMOQemq3AMDIa6yXmEPr-B5dI990wAetltPGZKzPcMXWbNUZGRT58Cuh_Vn7FAStr3vB9MWFxhlKzCvLDfWgCQ=3917DDB4
+        - ATATT3xFfGF0XV6HgfqtVaCN7FGnVtONwnRSIssan940Or9w05qcHjXbxdRHC_-c5C908faZCziguBqZa7CwNySDoBC7yF8rG0eGGfgLJQbl4HmuqRjy7YBLpnTnyw6mLWlW--y4q_OP-0eoB5rTDRdYJwhl6t1uHlihuWPxhJymCq1ezzxiFbU=D517AD64
+        - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE=1BF68EF5
+      assert_not:
+        - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE+1BF68EF5
+        - ATATT4xFfGF0e4B4OMjMS-SGlCl7JAgLXoc7LW6PYrDUUnQo2IQ7ZRObr69h9XgDudve019Iwt-WTqAUPVP327u9cQRjQVHfNIMOQemq3AMDIa6yXmEPr-B5dI990wAetltPGZKzPcMXWbNUZGRT58Cuh_Vn7FAStr3vB9MWFxhlKzCvLDfWgCQ=3917DDB4
+        - ATATT3xFfGF0XV6HgfqtVaCN7FGnVtONwnRSIssan940Or9w05qcHjXbxdRHC_-c5C908faZCziguBqZa7CwNySDoBC7yF8rG0eGGfgLJQbl4HmuqRjy7YBLpnTnyw6mLWlW--y4q_OP-0eoB5rTDRdYJwhl6t1uHlihuWPxhJymCq1ezzxiFbUx=D517AD64
+        - ATATT3xFfGF0jloNk53nk0TOI0gqoseNHGl8-z6t7X083LpsEpmVs1jj4TGIkJlye3UMWCBYR6t_yKX15eL9-an6Fa2XSLQXs7VIJ5Yh7eqtli9GmuskDtoiI74lHggR1T4yXHDRUX05uy2mcev4YHdv1aR_EnX7M4Qf13V6zNZxQpPOHDsHTEE=21BF68EF5
+    history:
+      - 2026-03-23 initial version
+    refs:
+      - https://support.atlassian.com/bitbucket-cloud/docs/api-tokens/

pkg/rules/elevenlabs.yaml

@@ -0,0 +1,28 @@
+rules:
+  - name: Eleven Labs API Key
+    id: ghost.elevenlabs.1
+    description: Eleven Labs API key.
+    tags:
+      - api
+      - eleven
+      - elevenlabs
+    pattern: |
+      (?x)
+        \b
+          (sk_(?i)[A-F0-9]{48})
+        \b
+    entropy: 3.4
+    redact: [6, 4]
+    tests:
+      assert:
+        - sk_15579ddb10e53098e649b00f4c11c5c0fd18def0f5ca0b2c
+        - sk_f1460d7c38ad7fe67f745447ee1a1f53d97f369eed8d0e9f
+        - sk_c6c3ddc6f136150e7c71c3a4cb012ee5cc25e17f26719a17
+      assert_not:
+        - sk_15579ddb10e53098e649b00f4c11c5c0fd18def0f5ca0b2cx
+        - sk_f1460d7c38ad7fe67f745447ee1a1f53d97f369eed8d0e9
+        - sk_c6c3ddc6f136150e7c71c3a4gb012ee5cc25e17f26719a17
+    history:
+      - 2026-03-23 initial version
+    refs:
+      - https://elevenlabs.io/docs/api-reference/service-accounts/api-keys/create