From f59cecb8fc19229db8722477d7c0839c4e440801 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 10:20:17 -0400
Subject: [PATCH 1/8] add general framework secrets
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/framework.yaml | 37 +++++++++++++++++++++++++++++++++++++
2 files changed, 68 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/framework.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 8ac1e46..53aae79 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 127
+Total rules: 128
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -49,6 +49,7 @@ Total rules: 127
| [Fastly API Key](#ghost.fastly.1) | ghost.fastly.1 | Fastly API key. | api, fastly | 4.2 |
| [Firecrawl API Key](#ghost.firecrawl.1) | ghost.firecrawl.1 | Firecrawl API key. | api, firecrawl | 3.1 |
| [Fly.io API Key](#ghost.flyio.1) | ghost.flyio.1 | Fly.io API key. | api, flyio | 5.5 |
+| [Framework Secret Key](#ghost.framework.1) | ghost.framework.1 | Framework Secret key variable declaration | api, framework, symfony, laravel, django, rails | 4.1 |
| [Generic Token](#ghost.generic.1) | ghost.generic.1 | Generic token variable declaration. | generic, token | 3.1 |
| [Generic Secret](#ghost.generic.2) | ghost.generic.2 | Generic secret variable declaration. | generic, secret | 3.1 |
| [Generic Password](#ghost.generic.3) | ghost.generic.3 | Generic password variable declaration. | generic, password | 3.5 |
@@ -1253,6 +1254,35 @@ Total rules: 127
- assert_not: 1 cases
+
+### Framework Secret Key
+
+**ID:** `ghost.framework.1`
+
+**Description:** Framework Secret key variable declaration
+
+**Tags:** api, framework, symfony, laravel, django, rails
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?i)(?:APP_SECRET|APP_KEY|SECRET_KEY|SECRET_KEY_BASE)\w*
+ [\W]{0,40}?
+ [A-Z0-9]{32,}
+ )
+ \b
+
+```
+
+**Min entropy:** 4.1
+
+**Tests:**
+- assert: 4 cases
+- assert_not: 4 cases
+
+
### Generic Token
diff --git a/pkg/rules/framework.yaml b/pkg/rules/framework.yaml
new file mode 100644
index 0000000..ad09f8a
--- /dev/null
+++ b/pkg/rules/framework.yaml
@@ -0,0 +1,37 @@
+rules:
+ - name: Framework Secret Key
+ id: ghost.framework.1
+ description: Framework Secret key variable declaration
+ tags:
+ - api
+ - framework
+ - symfony
+ - laravel
+ - django
+ - rails
+ pattern: |
+ (?x)
+ \b
+ (
+ (?i)(?:APP_SECRET|APP_KEY|SECRET_KEY|SECRET_KEY_BASE)\w*
+ [\W]{0,40}?
+ [A-Z0-9]{32,}
+ )
+ \b
+ redact: [12, 4]
+ entropy: 4.1
+ tests:
+ assert:
+ - "APP_SECRET=95ba3265e4fc9e04b25a4ebe37626490"
+ - "APP_KEY=szJiK1fy6FaEedPWSw8e41kAXTbtArCX5ks7wQP3"
+ - "SECRET_KEY=fVst85KDGHJxfjrXtSJGjwQ27W92ORERq4bV6Ais"
+ - "SECRET_KEY_BASE=0903415147f1253f3cc0d000aab41d9fbfbc037d6acd893f3f27d8a98373d8e9"
+ assert_not:
+ - 9MbXxamGfTkx2cfasR7oUUzylk14gqTAK9GMlSDuX
+ - 9MbXxamGfTkx2cfasR7oUUzylk14gqTAK9GMlSD
+ - 9MbXxamGfTkx2cfasR7o-Uzylk14gqTAK9GMlSD
+ - 0903415147f1253f3cc0d000aab41d9fbfbc037d6acd893f3f27d8a98373d8e9
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://github.com/trufflesecurity/trufflehog/issues/4687
From 5b3fbd705ac59faf8db7881affcb8a29ce38dd65 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 10:30:41 -0400
Subject: [PATCH 2/8] add wireguard
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/wireguard.yaml | 30 ++++++++++++++++++++++++++++++
2 files changed, 61 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/wireguard.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 53aae79..39e8ed4 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 128
+Total rules: 129
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -133,6 +133,7 @@ Total rules: 128
| [Travis Token](#ghost.travisci.1) | ghost.travisci.1 | Travis CI token. | api, travisci | 4.1 |
| [Twilio API Key](#ghost.twilio.1) | ghost.twilio.1 | Twilio API key or. | api, twilio, key | 4.1 |
| [Vercel API Key](#ghost.vercel.1) | ghost.vercel.1 | Vercel API key. | api, vercel | 4.1 |
+| [Wireguard API Key](#ghost.wireguard.1) | ghost.wireguard.1 | Wireguard Private key variable declaration. | api, wireguard | 4.7 |
| [xAI API Key](#ghost.xai.1) | ghost.xai.1 | xAI API key. | xai, api | 4.8 |
## Rule Details
@@ -3466,6 +3467,35 @@ Total rules: 128
- assert_not: 2 cases
+
+### Wireguard API Key
+
+**ID:** `ghost.wireguard.1`
+
+**Description:** Wireguard Private key variable declaration.
+
+**Tags:** api, wireguard
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?:PrivateKey)\w*
+ [\W]{0,40}?
+ (?i)[A-Z0-9]{43}
+ )
+ \b
+
+```
+
+**Min entropy:** 4.7
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 3 cases
+
+
### xAI API Key
diff --git a/pkg/rules/wireguard.yaml b/pkg/rules/wireguard.yaml
new file mode 100644
index 0000000..8573046
--- /dev/null
+++ b/pkg/rules/wireguard.yaml
@@ -0,0 +1,30 @@
+rules:
+ - name: Wireguard API Key
+ id: ghost.wireguard.1
+ description: Wireguard Private key variable declaration.
+ tags:
+ - api
+ - wireguard
+ pattern: |
+ (?x)
+ \b
+ (
+ (?:PrivateKey)\w*
+ [\W]{0,40}?
+ (?i)[A-Z0-9]{43}
+ )
+ \b
+ redact: [16, 4]
+ entropy: 4.7
+ tests:
+ assert:
+ - PrivateKey = aTrSVNtdex4QRqTMENnkwdIAzPUxQTXJO852vBVlmAk
+ - PrivateKey=aTrSVNtdex4QRqTMENnkwdIAzPUxQTXJO852vBVlmAk
+ assert_not:
+ - PrivateKey=aTrSVNtdex4QRqTMENnkwdIAzPUxQTXJO852vBVlmA
+ - PrivateKey=aTrSVNtdex4QRqTMENnkwdIAzPUxQTXJO852vBVlmAkx
+ - PrivateKey=aTrSVNtdex4QRqTMENnkw-IAzPUxQTXJO852vBVlmAk
+ history:
+ - 2026-03-23 initial version
+ refs:
+ - https://www.wireguard.com/quickstart/
From 4c955df72f604870d3d84e296c13ab6283f2d3a9 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 10:42:31 -0400
Subject: [PATCH 3/8] add rapidapi
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/rapidapi.yaml | 33 +++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/rapidapi.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 39e8ed4..f3dbdba 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 129
+Total rules: 130
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -104,6 +104,7 @@ Total rules: 129
| [PostHog OAuth Access Token](#ghost.posthog.5) | ghost.posthog.5 | PostHog OAuth Refresh Token | api, posthog, oauth | 4.5 |
| [Pulumi Access Token](#ghost.pulumi.1) | ghost.pulumi.1 | Pulumi access token. | api, pulumi | 3.3 |
| [PyPI API Key](#ghost.pypi.1) | ghost.pypi.1 | PyPI API key. | api, pypi | 4.5 |
+| [RapiAPI API Key](#ghost.rapidapi.1) | ghost.rapidapi.1 | RapidAPI API Key | api, rapidapi | 3.5 |
| [ReCaptcha API Key](#ghost.recaptcha.1) | ghost.recaptcha.1 | ReCaptcha API key variable declaration. | api, recaptcha | 3.5 |
| [Resend API Key](#ghost.resend.1) | ghost.resend.1 | Resend API key. | api, resend | 4.2 |
| [Salesforce App Consumer Secret](#ghost.salesforce.1) | ghost.salesforce.1 | Salesforce App Consumer Secret. | api, salesforce | 4.1 |
@@ -2694,6 +2695,35 @@ Total rules: 129
- assert_not: 2 cases
+
+### RapiAPI API Key
+
+**ID:** `ghost.rapidapi.1`
+
+**Description:** RapidAPI API Key
+
+**Tags:** api, rapidapi
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?i)(?:rapid)\w*
+ [\W]{0,40}?
+ [a-f0-9]{10}[a-z0-9]{40}
+ )
+ \b
+
+```
+
+**Min entropy:** 3.5
+
+**Tests:**
+- assert: 4 cases
+- assert_not: 3 cases
+
+
### ReCaptcha API Key
diff --git a/pkg/rules/rapidapi.yaml b/pkg/rules/rapidapi.yaml
new file mode 100644
index 0000000..5dcbe29
--- /dev/null
+++ b/pkg/rules/rapidapi.yaml
@@ -0,0 +1,33 @@
+rules:
+ - name: RapiAPI API Key
+ id: ghost.rapidapi.1
+ description: RapidAPI API Key
+ tags:
+ - api
+ - rapidapi
+ pattern: |
+ (?x)
+ \b
+ (
+ (?i)(?:rapid)\w*
+ [\W]{0,40}?
+ [a-f0-9]{10}[a-z0-9]{40}
+ )
+ \b
+ entropy: 3.5
+ redact: [14, 4]
+ tests:
+ assert:
+ - RAPIDAPI_KEY=969fcbc7b0gho47dbffee523e95ap197d50jsn9752cc4adcb3
+ - RAPID=b3481a1310ghoc937b2cb9770de9p178c21jsn306be784b131
+ - RAPIDAPI=e524dea763ghoa5b5b87e948db5ap193acejsnf75124eecb24
+ - RAPID_KEY=e4ca2f9861gho0928229e749f352p1515b5jsnb0868000af6f
+ assert_not:
+ - RAPID_KEY=969fcbc7b0gho47dbffee523e95ap197d50jsn9752cc4adcb3x
+ - RAPID_KEY=969fcbc7b0gho47dbffee523e95ap197d50jsn9752cc4adcb
+ - RAPID_KEY=969fcbc7b0gho47dbffee523e95ap197d50js-9752cc4adcb3
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://docs.rapidapi.com/docs/keys-and-key-rotation
+ - https://docs.rapidapi.com/docs/configuring-api-security
From cfddd0343d12c05cf78e89864bbb0cd81b1ef042 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 10:47:07 -0400
Subject: [PATCH 4/8] add coze
---
docs/rules.md | 28 +++++++++++++++++++++++++++-
pkg/rules/coze.yaml | 25 +++++++++++++++++++++++++
2 files changed, 52 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/coze.yaml
diff --git a/docs/rules.md b/docs/rules.md
index f3dbdba..ea23ed7 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 130
+Total rules: 131
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -37,6 +37,7 @@ Total rules: 130
| [Cloudflare API Key](#ghost.cloudflare.1) | ghost.cloudflare.1 | Cloudflare API key. | api, cloudflare | 4.2 |
| [Cohere API Key](#ghost.cohere.1) | ghost.cohere.1 | Cohere API key variable declaration. | api, cohere | 4.1 |
| [Confluent API Key](#ghost.confluent.1) | ghost.confluent.1 | Confluent API Key | api, confluent | 4.7 |
+| [Coze API Key](#ghost.coze.1) | ghost.coze.1 | Coze API Key | api, coze | 4.7 |
| [Crates.io API Key](#ghost.crates.1) | ghost.crates.1 | Crates.io API key. | api, crates | 3.8 |
| [Crew.ai PAT](#ghost.crewai.1) | ghost.crewai.1 | Crew AI PAT | api, crewai | 4.3 |
| [Crew.ai Auth Token](#ghost.crewai.2) | ghost.crewai.2 | Crew AI Enterprise Action Auth Token | api, crewai, auth, token | 3.5 |
@@ -948,6 +949,31 @@ Total rules: 130
- assert_not: 4 cases
+
+### Coze API Key
+
+**ID:** `ghost.coze.1`
+
+**Description:** Coze API Key
+
+**Tags:** api, coze
+
+**Pattern:**
+```
+(?x)
+ \b
+ (pat_(?i)[A-Z0-9]{64})
+ \b
+
+```
+
+**Min entropy:** 4.7
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 2 cases
+
+
### Crates.io API Key
diff --git a/pkg/rules/coze.yaml b/pkg/rules/coze.yaml
new file mode 100644
index 0000000..849a133
--- /dev/null
+++ b/pkg/rules/coze.yaml
@@ -0,0 +1,25 @@
+rules:
+ - name: Coze API Key
+ id: ghost.coze.1
+ description: Coze API Key
+ tags:
+ - api
+ - coze
+ pattern: |
+ (?x)
+ \b
+ (pat_(?i)[A-Z0-9]{64})
+ \b
+ entropy: 4.7
+ redact: [7, 4]
+ tests:
+ assert:
+ - pat_dcQ8TSQWiH8lFXj261kF37DClSEWuWNPIXLRxHwpXz705XxvLhXohWcJSpRe1SlW
+ - pat_i5LCLq2AiiT0FN32FOdUGxFkQOMxNF7a5SwcsZHIckfOgOurRuxIy9IrJ8SVYgkd
+ assert_not:
+ - pat_dcQ8TSQWiH8lFXj261kF37DClSEWuWNPIXLRxHwpXz705XxvLhXohWcJSpRe1SlWx
+ - pat_i5LCLq2AiiT0FN32FOdUGxFkQOMxNF7a5SwcsZHIckfOgOurRuxIy9IrJ8SVYgk
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://www.coze.com/open/docs/developer_guides
From d9283bcc18b5d89a6791540a5a091b0bede50c74 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 10:59:25 -0400
Subject: [PATCH 5/8] add spotify
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/spotify.yaml | 33 +++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/spotify.yaml
diff --git a/docs/rules.md b/docs/rules.md
index ea23ed7..4a1c401 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 131
+Total rules: 132
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -122,6 +122,7 @@ Total rules: 131
| [Slack Workflow Webhook Secret](#ghost.slack.7) | ghost.slack.7 | Slack workflow webhook secret. | api, slack | 4.1 |
| [Sourcegraph Legacy Token](#ghost.sourcegraph.1) | ghost.sourcegraph.1 | Sourcegraph legacy token. | api, sourcegraph | 4.1 |
| [Sourcegraph Workspace Token](#ghost.sourcegraph.2) | ghost.sourcegraph.2 | Sourcegraph workspace token. | api, sourcegraph | 3.5 |
+| [Spotify Access Token](#ghost.spotify.1) | ghost.spotify.1 | Spotify Access Token variable declaration. | api, spotify, token | 4.1 |
| [SSH Private Key](#ghost.ssh.1) | ghost.ssh.1 | Matches an SSH private key on a single line. | ssh, private, key | 5.1 |
| [SSH Private Key](#ghost.ssh.2) | ghost.ssh.2 | Matches the beginning of a multi-line SSH private key. | ssh, private, key | 2.1 |
| [Stability AI API Key](#ghost.stability.1) | ghost.stability.1 | Stability AI API key. | api, stability | 4.4 |
@@ -3186,6 +3187,35 @@ Total rules: 131
- assert_not: 1 cases
+
+### Spotify Access Token
+
+**ID:** `ghost.spotify.1`
+
+**Description:** Spotify Access Token variable declaration.
+
+**Tags:** api, spotify, token
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?i)(?:spotify)\w*
+ [\W]{0,40}?
+ [A-Z0-9]{44}
+ )
+ \b
+
+```
+
+**Min entropy:** 4.1
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 4 cases
+
+
### SSH Private Key
diff --git a/pkg/rules/spotify.yaml b/pkg/rules/spotify.yaml
new file mode 100644
index 0000000..a8846ab
--- /dev/null
+++ b/pkg/rules/spotify.yaml
@@ -0,0 +1,33 @@
+rules:
+ - name: Spotify Access Token
+ id: ghost.spotify.1
+ description: Spotify Access Token variable declaration.
+ tags:
+ - api
+ - spotify
+ - token
+ pattern: |
+ (?x)
+ \b
+ (
+ (?i)(?:spotify)\w*
+ [\W]{0,40}?
+ [A-Z0-9]{44}
+ )
+ \b
+ redact: [12, 4]
+ entropy: 4.1
+ tests:
+ assert:
+ - let spotify=NjgxNjViYzI1MGIyNGE4OGI3NTNmNDVlZjI2Y2U5NWYK
+ - SPOTIFY_TOKEN=MWY4YTA4NGI1NzU5OTFmMTdlNzVjYjZmZGNhZDRiYWQK
+ - SPOTIFY_ACCESS_TOKEN=ZDI4YTA2ZDRlZGQwMzE0YjNiNzM4NWI5ODExNzZmMGEK
+ assert_not:
+ - let spotify=4a22734a2c7847809d017640f267bba7x
+ - SPOTIFY_TOKEN=4b9bfc03ffed40f7b4acc97ac60c5b3
+ - SPOTIFY_TOKEN=N2MxMDZjN2FlY2Y5MTVkNWQwOWU5NmM0M2QxODVlY2UKx
+ - SPOTIFY_TOKEN=N2MxMDZjN2FlY2Y5MTVkNWQwOWU5NmM0M2QxODVlY2U
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://developer.spotify.com/documentation/web-api/concepts/access-token
From e23044462c1f95e0384fde8f21b9fb76967a3353 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 11:12:28 -0400
Subject: [PATCH 6/8] add plaid
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/plaid.yaml | 33 +++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/plaid.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 4a1c401..49070e3 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 132
+Total rules: 133
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -96,6 +96,7 @@ Total rules: 132
| [OpenRouter API Key](#ghost.openrouter.1) | ghost.openrouter.1 | OpenRouter API Key | api, openrouter | 3.5 |
| [OpenWeather API Key](#ghost.openweather.1) | ghost.openweather.1 | OpenWeather API key variable declaration. | api, openweather | 3.5 |
| [Perplexity API Key](#ghost.perplexity.1) | ghost.perplexity.1 | Perplexity API key. | api, perplexity | 4.3 |
+| [Plaid API Key](#ghost.plaid.1) | ghost.plaid.1 | Plaid API Key variable declaration. | api, plaid | 3.5 |
| [PlanetScale API Key](#ghost.planetscale.1) | ghost.planetscale.1 | PlanetScale API key. | api, planetscale | 4.1 |
| [PostgreSQL Senstive Connection String](#ghost.postgres.1) | ghost.postgres.1 | PostgreSQL connection string with credentials. | api, postgres, postgresql | 4.1 |
| [PostHog Project Token](#ghost.posthog.1) | ghost.posthog.1 | PostHog Project Token | api, posthog, project | 4.5 |
@@ -2495,6 +2496,35 @@ Total rules: 132
- assert_not: 2 cases
+
+### Plaid API Key
+
+**ID:** `ghost.plaid.1`
+
+**Description:** Plaid API Key variable declaration.
+
+**Tags:** api, plaid
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?i)(?:plaid)\w*
+ [\W]{0,40}?
+ [A-F0-9]{30}
+ )
+ \b
+
+```
+
+**Min entropy:** 3.5
+
+**Tests:**
+- assert: 4 cases
+- assert_not: 4 cases
+
+
### PlanetScale API Key
diff --git a/pkg/rules/plaid.yaml b/pkg/rules/plaid.yaml
new file mode 100644
index 0000000..f244b3f
--- /dev/null
+++ b/pkg/rules/plaid.yaml
@@ -0,0 +1,33 @@
+rules:
+ - name: Plaid API Key
+ id: ghost.plaid.1
+ description: Plaid API Key variable declaration.
+ tags:
+ - api
+ - plaid
+ pattern: |
+ (?x)
+ \b
+ (
+ (?i)(?:plaid)\w*
+ [\W]{0,40}?
+ [A-F0-9]{30}
+ )
+ \b
+ redact: [12, 4]
+ entropy: 3.5
+ tests:
+ assert:
+ - let plaid=1bbf4a686175a7075d569ac77db0bf
+ - PLAID_TOKEN=0d94363d99e52c7ed023d2fdfddcf2
+ - PLAID_ACCESS_TOKEN=06342265952033fb07aa018bcd64e3
+ - PLAID_ACCESS_TOKEN=4a5dfbe6f4f9091242abb1840d3af1
+ assert_not:
+ - let plaid=4a22734a2c7847809d017640f267bba7x
+ - PLAID_TOKEN=4b9bfc03ffed40f7b4acc97ac60c5b3
+ - PLAID_TOKEN=N2MxMDZjN2FlY2Y5MTVkNWQwOWU5NmM0M2QxODVlY2UKx
+ - PLAID_TOKEN=N2MxMDZjN2FlY2Y5MTVkNWQwOWU5NmM0M2QxODVlY2U
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://plaid.com/docs/api/
From 54e8d7db4197a95f3b4f59b9a57a1c1f98cd2b32 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 11:22:50 -0400
Subject: [PATCH 7/8] add cloudinary
---
docs/rules.md | 32 +++++++++++++++++++++++++++++++-
pkg/rules/cloudinary.yaml | 33 +++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/cloudinary.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 49070e3..8b9aec0 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 133
+Total rules: 134
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -35,6 +35,7 @@ Total rules: 133
| [Clerk API Key](#ghost.clerk.1) | ghost.clerk.1 | Clerk API key. | api, clerk | 4.5 |
| [ClickHouse API Key](#ghost.clickhouse.1) | ghost.clickhouse.1 | ClickHouse API key. | api, clickhouse | 4.2 |
| [Cloudflare API Key](#ghost.cloudflare.1) | ghost.cloudflare.1 | Cloudflare API key. | api, cloudflare | 4.2 |
+| [Cloudinary API Key](#ghost.cloudinary.1) | ghost.cloudinary.1 | Cloudinary API Key variable declaration. | api, cloudinary | 4.5 |
| [Cohere API Key](#ghost.cohere.1) | ghost.cohere.1 | Cohere API key variable declaration. | api, cohere | 4.1 |
| [Confluent API Key](#ghost.confluent.1) | ghost.confluent.1 | Confluent API Key | api, confluent | 4.7 |
| [Coze API Key](#ghost.coze.1) | ghost.coze.1 | Coze API Key | api, coze | 4.7 |
@@ -897,6 +898,35 @@ Total rules: 133
- assert_not: 1 cases
+
+### Cloudinary API Key
+
+**ID:** `ghost.cloudinary.1`
+
+**Description:** Cloudinary API Key variable declaration.
+
+**Tags:** api, cloudinary
+
+**Pattern:**
+```
+(?x)
+ \b
+ (
+ (?i)(?:cloudinary)\w*
+ [\W]{0,40}?
+ [A-Z0-9_-]{27}
+ )
+ \b
+
+```
+
+**Min entropy:** 4.5
+
+**Tests:**
+- assert: 4 cases
+- assert_not: 4 cases
+
+
### Cohere API Key
diff --git a/pkg/rules/cloudinary.yaml b/pkg/rules/cloudinary.yaml
new file mode 100644
index 0000000..8a5a793
--- /dev/null
+++ b/pkg/rules/cloudinary.yaml
@@ -0,0 +1,33 @@
+rules:
+ - name: Cloudinary API Key
+ id: ghost.cloudinary.1
+ description: Cloudinary API Key variable declaration.
+ tags:
+ - api
+ - cloudinary
+ pattern: |
+ (?x)
+ \b
+ (
+ (?i)(?:cloudinary)\w*
+ [\W]{0,40}?
+ [A-Z0-9_-]{27}
+ )
+ \b
+ redact: [12, 4]
+ entropy: 4.5
+ tests:
+ assert:
+ - let cloudinary=LVr_i_vaatAbxdQ28o-jLOxprMM
+ - CLOUDINARY_SECRET=k2WmPZmFUSoybYvmz9THXXJRpHc
+ - CLOUDINARY_SECRET=XEQ7PdwGInfoYRAmUIcGIhTjlJU
+ - CLOUDINARY_SECRET=_2pvZlfWP2nKqqndkhzpj9dNgso
+ assert_not:
+ - let cloudinary=LVr_i_vaatAbxdQ28o-jLOxprMMM
+ - CLOUDINARY_SECRET=k2WmPZmFUSoybYvmz9THXXJRpH
+ - CLOUDINARY_SECRET=XEQ7%dwGInfoYRAmUIcGIhTjlJU
+ - CLOUDINARY_SECRET=2pvZlfWP2nKqqndkhzpj9dNgso
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://cloudinary.com/documentation/cloudinary_references
From 5d2619e1019abc8b95971638f84ee52d1f359ab7 Mon Sep 17 00:00:00 2001
From: Josh Larsen <2565382+joshlarsen@users.noreply.github.com>
Date: Wed, 25 Mar 2026 11:27:51 -0400
Subject: [PATCH 8/8] add wandb
---
docs/rules.md | 28 +++++++++++++++++++++++++++-
pkg/rules/wandb.yaml | 27 +++++++++++++++++++++++++++
2 files changed, 54 insertions(+), 1 deletion(-)
create mode 100644 pkg/rules/wandb.yaml
diff --git a/docs/rules.md b/docs/rules.md
index 8b9aec0..b6d0f66 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 134
+Total rules: 135
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -138,6 +138,7 @@ Total rules: 134
| [Travis Token](#ghost.travisci.1) | ghost.travisci.1 | Travis CI token. | api, travisci | 4.1 |
| [Twilio API Key](#ghost.twilio.1) | ghost.twilio.1 | Twilio API key or. | api, twilio, key | 4.1 |
| [Vercel API Key](#ghost.vercel.1) | ghost.vercel.1 | Vercel API key. | api, vercel | 4.1 |
+| [Weights & Biases API Key](#ghost.wandb.1) | ghost.wandb.1 | Weights & Biases API Key | api, wandb | 5.1 |
| [Wireguard API Key](#ghost.wireguard.1) | ghost.wireguard.1 | Wireguard Private key variable declaration. | api, wireguard | 4.7 |
| [xAI API Key](#ghost.xai.1) | ghost.xai.1 | xAI API key. | xai, api | 4.8 |
@@ -3613,6 +3614,31 @@ Total rules: 134
- assert_not: 2 cases
+
+### Weights & Biases API Key
+
+**ID:** `ghost.wandb.1`
+
+**Description:** Weights & Biases API Key
+
+**Tags:** api, wandb
+
+**Pattern:**
+```
+(?x)
+ \b
+ (wandb_v1_(?i)[A-Z0-9]{27}_[A-Z0-9]{49})
+ \b
+
+```
+
+**Min entropy:** 5.1
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
### Wireguard API Key
diff --git a/pkg/rules/wandb.yaml b/pkg/rules/wandb.yaml
new file mode 100644
index 0000000..14df6e2
--- /dev/null
+++ b/pkg/rules/wandb.yaml
@@ -0,0 +1,27 @@
+rules:
+ - name: Weights & Biases API Key
+ id: ghost.wandb.1
+ description: Weights & Biases API Key
+ tags:
+ - api
+ - wandb
+ pattern: |
+ (?x)
+ \b
+ (wandb_v1_(?i)[A-Z0-9]{27}_[A-Z0-9]{49})
+ \b
+ entropy: 5.1
+ redact: [12, 4]
+ tests:
+ assert:
+ - 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
+ - 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
+ - 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
+ assert_not:
+ - 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
+ - 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
+ - wandb_v2_8tlnrKSJbYWbWNIeDtb2JZCjVNB_KyJvO7GvXtZCroa1HVs9fuVNUkByWvSOPxTwfqeYKEZ2rejbK
+ history:
+ - 2026-03-25 initial version
+ refs:
+ - https://docs.wandb.ai/support/models/articles/how-do-i-find-my-api-key