Skip to content

feat: add more rules #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joshlarsen merged 8 commits into from
Mar 25, 2026
Merged

feat: add more rules #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
f59cecb
add general framework secrets
joshlarsen Mar 25, 2026
5b3fbd7
add wireguard
joshlarsen Mar 25, 2026
4c955df
add rapidapi
joshlarsen Mar 25, 2026
cfddd03
add coze
joshlarsen Mar 25, 2026
d9283bc
add spotify
joshlarsen Mar 25, 2026
e230444
add plaid
joshlarsen Mar 25, 2026
54e8d7d
add cloudinary
joshlarsen Mar 25, 2026
5d2619e
add wandb
joshlarsen Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
234 changes: 233 additions & 1 deletion docs/rules.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

Auto-generated by `make docs`

Total rules: 127
Total rules: 135

| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
Expand Down Expand Up @@ -35,8 +35,10 @@ Total rules: 127
| [Clerk API Key](#ghost.clerk.1) | ghost.clerk.1 | Clerk API key. | api, clerk | 4.5 |
| [ClickHouse API Key](#ghost.clickhouse.1) | ghost.clickhouse.1 | ClickHouse API key. | api, clickhouse | 4.2 |
| [Cloudflare API Key](#ghost.cloudflare.1) | ghost.cloudflare.1 | Cloudflare API key. | api, cloudflare | 4.2 |
| [Cloudinary API Key](#ghost.cloudinary.1) | ghost.cloudinary.1 | Cloudinary API Key variable declaration. | api, cloudinary | 4.5 |
| [Cohere API Key](#ghost.cohere.1) | ghost.cohere.1 | Cohere API key variable declaration. | api, cohere | 4.1 |
| [Confluent API Key](#ghost.confluent.1) | ghost.confluent.1 | Confluent API Key | api, confluent | 4.7 |
| [Coze API Key](#ghost.coze.1) | ghost.coze.1 | Coze API Key | api, coze | 4.7 |
| [Crates.io API Key](#ghost.crates.1) | ghost.crates.1 | Crates.io API key. | api, crates | 3.8 |
| [Crew.ai PAT](#ghost.crewai.1) | ghost.crewai.1 | Crew AI PAT | api, crewai | 4.3 |
| [Crew.ai Auth Token](#ghost.crewai.2) | ghost.crewai.2 | Crew AI Enterprise Action Auth Token | api, crewai, auth, token | 3.5 |
Expand All @@ -49,6 +51,7 @@ Total rules: 127
| [Fastly API Key](#ghost.fastly.1) | ghost.fastly.1 | Fastly API key. | api, fastly | 4.2 |
| [Firecrawl API Key](#ghost.firecrawl.1) | ghost.firecrawl.1 | Firecrawl API key. | api, firecrawl | 3.1 |
| [Fly.io API Key](#ghost.flyio.1) | ghost.flyio.1 | Fly.io API key. | api, flyio | 5.5 |
| [Framework Secret Key](#ghost.framework.1) | ghost.framework.1 | Framework Secret key variable declaration | api, framework, symfony, laravel, django, rails | 4.1 |
| [Generic Token](#ghost.generic.1) | ghost.generic.1 | Generic token variable declaration. | generic, token | 3.1 |
| [Generic Secret](#ghost.generic.2) | ghost.generic.2 | Generic secret variable declaration. | generic, secret | 3.1 |
| [Generic Password](#ghost.generic.3) | ghost.generic.3 | Generic password variable declaration. | generic, password | 3.5 |
Expand Down Expand Up @@ -94,6 +97,7 @@ Total rules: 127
| [OpenRouter API Key](#ghost.openrouter.1) | ghost.openrouter.1 | OpenRouter API Key | api, openrouter | 3.5 |
| [OpenWeather API Key](#ghost.openweather.1) | ghost.openweather.1 | OpenWeather API key variable declaration. | api, openweather | 3.5 |
| [Perplexity API Key](#ghost.perplexity.1) | ghost.perplexity.1 | Perplexity API key. | api, perplexity | 4.3 |
| [Plaid API Key](#ghost.plaid.1) | ghost.plaid.1 | Plaid API Key variable declaration. | api, plaid | 3.5 |
| [PlanetScale API Key](#ghost.planetscale.1) | ghost.planetscale.1 | PlanetScale API key. | api, planetscale | 4.1 |
| [PostgreSQL Senstive Connection String](#ghost.postgres.1) | ghost.postgres.1 | PostgreSQL connection string with credentials. | api, postgres, postgresql | 4.1 |
| [PostHog Project Token](#ghost.posthog.1) | ghost.posthog.1 | PostHog Project Token | api, posthog, project | 4.5 |
Expand All @@ -103,6 +107,7 @@ Total rules: 127
| [PostHog OAuth Access Token](#ghost.posthog.5) | ghost.posthog.5 | PostHog OAuth Refresh Token | api, posthog, oauth | 4.5 |
| [Pulumi Access Token](#ghost.pulumi.1) | ghost.pulumi.1 | Pulumi access token. | api, pulumi | 3.3 |
| [PyPI API Key](#ghost.pypi.1) | ghost.pypi.1 | PyPI API key. | api, pypi | 4.5 |
| [RapiAPI API Key](#ghost.rapidapi.1) | ghost.rapidapi.1 | RapidAPI API Key | api, rapidapi | 3.5 |
| [ReCaptcha API Key](#ghost.recaptcha.1) | ghost.recaptcha.1 | ReCaptcha API key variable declaration. | api, recaptcha | 3.5 |
| [Resend API Key](#ghost.resend.1) | ghost.resend.1 | Resend API key. | api, resend | 4.2 |
| [Salesforce App Consumer Secret](#ghost.salesforce.1) | ghost.salesforce.1 | Salesforce App Consumer Secret. | api, salesforce | 4.1 |
Expand All @@ -119,6 +124,7 @@ Total rules: 127
| [Slack Workflow Webhook Secret](#ghost.slack.7) | ghost.slack.7 | Slack workflow webhook secret. | api, slack | 4.1 |
| [Sourcegraph Legacy Token](#ghost.sourcegraph.1) | ghost.sourcegraph.1 | Sourcegraph legacy token. | api, sourcegraph | 4.1 |
| [Sourcegraph Workspace Token](#ghost.sourcegraph.2) | ghost.sourcegraph.2 | Sourcegraph workspace token. | api, sourcegraph | 3.5 |
| [Spotify Access Token](#ghost.spotify.1) | ghost.spotify.1 | Spotify Access Token variable declaration. | api, spotify, token | 4.1 |
| [SSH Private Key](#ghost.ssh.1) | ghost.ssh.1 | Matches an SSH private key on a single line. | ssh, private, key | 5.1 |
| [SSH Private Key](#ghost.ssh.2) | ghost.ssh.2 | Matches the beginning of a multi-line SSH private key. | ssh, private, key | 2.1 |
| [Stability AI API Key](#ghost.stability.1) | ghost.stability.1 | Stability AI API key. | api, stability | 4.4 |
Expand All @@ -132,6 +138,8 @@ Total rules: 127
| [Travis Token](#ghost.travisci.1) | ghost.travisci.1 | Travis CI token. | api, travisci | 4.1 |
| [Twilio API Key](#ghost.twilio.1) | ghost.twilio.1 | Twilio API key or. | api, twilio, key | 4.1 |
| [Vercel API Key](#ghost.vercel.1) | ghost.vercel.1 | Vercel API key. | api, vercel | 4.1 |
| [Weights & Biases API Key](#ghost.wandb.1) | ghost.wandb.1 | Weights & Biases API Key | api, wandb | 5.1 |
| [Wireguard API Key](#ghost.wireguard.1) | ghost.wireguard.1 | Wireguard Private key variable declaration. | api, wireguard | 4.7 |
| [xAI API Key](#ghost.xai.1) | ghost.xai.1 | xAI API key. | xai, api | 4.8 |

## Rule Details
Expand Down Expand Up @@ -891,6 +899,35 @@ Total rules: 127
- assert_not: 1 cases


<a id="ghost.cloudinary.1"></a>
### Cloudinary API Key

**ID:** `ghost.cloudinary.1`

**Description:** Cloudinary API Key variable declaration.

**Tags:** api, cloudinary

**Pattern:**
```
(?x)
\b
(
(?i)(?:cloudinary)\w*
[\W]{0,40}?
[A-Z0-9_-]{27}
)
\b

```

**Min entropy:** 4.5

**Tests:**
- assert: 4 cases
- assert_not: 4 cases


<a id="ghost.cohere.1"></a>
### Cohere API Key

Expand Down Expand Up @@ -945,6 +982,31 @@ Total rules: 127
- assert_not: 4 cases


<a id="ghost.coze.1"></a>
### Coze API Key

**ID:** `ghost.coze.1`

**Description:** Coze API Key

**Tags:** api, coze

**Pattern:**
```
(?x)
\b
(pat_(?i)[A-Z0-9]{64})
\b

```

**Min entropy:** 4.7

**Tests:**
- assert: 2 cases
- assert_not: 2 cases


<a id="ghost.crates.1"></a>
### Crates.io API Key

Expand Down Expand Up @@ -1253,6 +1315,35 @@ Total rules: 127
- assert_not: 1 cases


<a id="ghost.framework.1"></a>
### Framework Secret Key

**ID:** `ghost.framework.1`

**Description:** Framework Secret key variable declaration

**Tags:** api, framework, symfony, laravel, django, rails

**Pattern:**
```
(?x)
\b
(
(?i)(?:APP_SECRET|APP_KEY|SECRET_KEY|SECRET_KEY_BASE)\w*
[\W]{0,40}?
[A-Z0-9]{32,}
)
\b

```

**Min entropy:** 4.1

**Tests:**
- assert: 4 cases
- assert_not: 4 cases


<a id="ghost.generic.1"></a>
### Generic Token

Expand Down Expand Up @@ -2436,6 +2527,35 @@ Total rules: 127
- assert_not: 2 cases


<a id="ghost.plaid.1"></a>
### Plaid API Key

**ID:** `ghost.plaid.1`

**Description:** Plaid API Key variable declaration.

**Tags:** api, plaid

**Pattern:**
```
(?x)
\b
(
(?i)(?:plaid)\w*
[\W]{0,40}?
[A-F0-9]{30}
)
\b

```

**Min entropy:** 3.5

**Tests:**
- assert: 4 cases
- assert_not: 4 cases


<a id="ghost.planetscale.1"></a>
### PlanetScale API Key

Expand Down Expand Up @@ -2663,6 +2783,35 @@ Total rules: 127
- assert_not: 2 cases


<a id="ghost.rapidapi.1"></a>
### RapiAPI API Key

**ID:** `ghost.rapidapi.1`

**Description:** RapidAPI API Key

**Tags:** api, rapidapi

**Pattern:**
```
(?x)
\b
(
(?i)(?:rapid)\w*
[\W]{0,40}?
[a-f0-9]{10}[a-z0-9]{40}
)
\b

```

**Min entropy:** 3.5

**Tests:**
- assert: 4 cases
- assert_not: 3 cases


<a id="ghost.recaptcha.1"></a>
### ReCaptcha API Key

Expand Down Expand Up @@ -3099,6 +3248,35 @@ Total rules: 127
- assert_not: 1 cases


<a id="ghost.spotify.1"></a>
### Spotify Access Token

**ID:** `ghost.spotify.1`

**Description:** Spotify Access Token variable declaration.

**Tags:** api, spotify, token

**Pattern:**
```
(?x)
\b
(
(?i)(?:spotify)\w*
[\W]{0,40}?
[A-Z0-9]{44}
)
\b

```

**Min entropy:** 4.1

**Tests:**
- assert: 3 cases
- assert_not: 4 cases


<a id="ghost.ssh.1"></a>
### SSH Private Key

Expand Down Expand Up @@ -3436,6 +3614,60 @@ Total rules: 127
- assert_not: 2 cases


<a id="ghost.wandb.1"></a>
### Weights & Biases API Key

**ID:** `ghost.wandb.1`

**Description:** Weights & Biases API Key

**Tags:** api, wandb

**Pattern:**
```
(?x)
\b
(wandb_v1_(?i)[A-Z0-9]{27}_[A-Z0-9]{49})
\b

```

**Min entropy:** 5.1

**Tests:**
- assert: 3 cases
- assert_not: 3 cases


<a id="ghost.wireguard.1"></a>
### Wireguard API Key

**ID:** `ghost.wireguard.1`

**Description:** Wireguard Private key variable declaration.

**Tags:** api, wireguard

**Pattern:**
```
(?x)
\b
(
(?:PrivateKey)\w*
[\W]{0,40}?
(?i)[A-Z0-9]{43}
)
\b

```

**Min entropy:** 4.7

**Tests:**
- assert: 2 cases
- assert_not: 3 cases


<a id="ghost.xai.1"></a>
### xAI API Key

Expand Down
33 changes: 33 additions & 0 deletions pkg/rules/cloudinary.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
rules:
- name: Cloudinary API Key
id: ghost.cloudinary.1
description: Cloudinary API Key variable declaration.
tags:
- api
- cloudinary
pattern: |
(?x)
\b
(
(?i)(?:cloudinary)\w*
[\W]{0,40}?
[A-Z0-9_-]{27}
)
\b
redact: [12, 4]
entropy: 4.5
tests:
assert:
- let cloudinary=LVr_i_vaatAbxdQ28o-jLOxprMM
- CLOUDINARY_SECRET=k2WmPZmFUSoybYvmz9THXXJRpHc
- CLOUDINARY_SECRET=XEQ7PdwGInfoYRAmUIcGIhTjlJU
- CLOUDINARY_SECRET=_2pvZlfWP2nKqqndkhzpj9dNgso
assert_not:
- let cloudinary=LVr_i_vaatAbxdQ28o-jLOxprMMM
- CLOUDINARY_SECRET=k2WmPZmFUSoybYvmz9THXXJRpH
- CLOUDINARY_SECRET=XEQ7%dwGInfoYRAmUIcGIhTjlJU
- CLOUDINARY_SECRET=2pvZlfWP2nKqqndkhzpj9dNgso
history:
- 2026-03-25 initial version
refs:
- https://cloudinary.com/documentation/cloudinary_references
25 changes: 25 additions & 0 deletions pkg/rules/coze.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
rules:
- name: Coze API Key
id: ghost.coze.1
description: Coze API Key
tags:
- api
- coze
pattern: |
(?x)
\b
(pat_(?i)[A-Z0-9]{64})
\b
entropy: 4.7
redact: [7, 4]
tests:
assert:
- pat_dcQ8TSQWiH8lFXj261kF37DClSEWuWNPIXLRxHwpXz705XxvLhXohWcJSpRe1SlW
- pat_i5LCLq2AiiT0FN32FOdUGxFkQOMxNF7a5SwcsZHIckfOgOurRuxIy9IrJ8SVYgkd
assert_not:
- pat_dcQ8TSQWiH8lFXj261kF37DClSEWuWNPIXLRxHwpXz705XxvLhXohWcJSpRe1SlWx
- pat_i5LCLq2AiiT0FN32FOdUGxFkQOMxNF7a5SwcsZHIckfOgOurRuxIy9IrJ8SVYgk
history:
- 2026-03-25 initial version
refs:
- https://www.coze.com/open/docs/developer_guides
Loading
Loading