1396 lines
37 KiB
Go
1396 lines
37 KiB
Go
/*
|
|
©AngelaMos | 2026
|
|
secrets.go
|
|
|
|
Secret detection patterns, sensitive env names, and Shannon entropy
|
|
analysis
|
|
|
|
SecretPatterns covers 80+ regex patterns for cloud providers (AWS,
|
|
GCP, Azure), CI/CD platforms, payment processors, AI APIs, databases,
|
|
and generic credentials. SensitiveEnvNames is a lookup set for
|
|
variable names that should never hold hardcoded values. Entropy
|
|
functions catch secrets that don't match any known pattern.
|
|
|
|
Key exports:
|
|
SecretPatterns - slice of compiled regex patterns with type and
|
|
description
|
|
SensitiveEnvNames - set of environment variable names to flag
|
|
DetectSecrets - scans a string against all patterns
|
|
IsSensitiveEnvName - checks against known sensitive names with substring
|
|
fallback
|
|
CalculateEntropy, IsHighEntropyString - Shannon entropy detection
|
|
|
|
Connects to:
|
|
analyzer/dockerfile.go - scans ENV, ARG, RUN, and LABEL instructions
|
|
analyzer/compose.go - scans service environment variable values
|
|
config/constants.go - reads MinSecretLength and MinEntropyForSecret
|
|
*/
|
|
|
|
package rules
|
|
|
|
import (
|
|
"math"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
type SecretType string
|
|
|
|
const (
|
|
SecretTypeGeneric SecretType = "generic"
|
|
SecretTypeAWSKey SecretType = "aws_key"
|
|
SecretTypeAWSSecret SecretType = "aws_secret"
|
|
SecretTypeGCPKey SecretType = "gcp_key"
|
|
SecretTypeAzureKey SecretType = "azure_key"
|
|
SecretTypeGitHub SecretType = "github_token"
|
|
SecretTypeGitLab SecretType = "gitlab_token"
|
|
SecretTypeSlack SecretType = "slack_token"
|
|
SecretTypeStripe SecretType = "stripe_key"
|
|
SecretTypeTwilio SecretType = "twilio_key"
|
|
SecretTypeSendGrid SecretType = "sendgrid_key"
|
|
SecretTypeMailgun SecretType = "mailgun_key"
|
|
SecretTypeNPM SecretType = "npm_token"
|
|
SecretTypePyPI SecretType = "pypi_token"
|
|
SecretTypeDockerHub SecretType = "dockerhub_token"
|
|
SecretTypeSSHKey SecretType = "ssh_key"
|
|
SecretTypePrivateKey SecretType = "private_key"
|
|
SecretTypeJWT SecretType = "jwt"
|
|
SecretTypeBasicAuth SecretType = "basic_auth"
|
|
SecretTypeBearer SecretType = "bearer_token"
|
|
SecretTypeAPIKey SecretType = "api_key"
|
|
SecretTypePassword SecretType = "password"
|
|
SecretTypeDatabase SecretType = "database_url"
|
|
SecretTypeConnectionString SecretType = "connection_string"
|
|
)
|
|
|
|
type SecretPattern struct {
|
|
Type SecretType
|
|
Pattern *regexp.Regexp
|
|
Description string
|
|
}
|
|
|
|
var SecretPatterns = []SecretPattern{
|
|
// ==================== AWS ====================
|
|
{
|
|
Type: SecretTypeAWSKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}`,
|
|
),
|
|
Description: "AWS Access Key ID",
|
|
},
|
|
{
|
|
Type: SecretTypeAWSSecret,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)aws_?secret_?access_?key\s*[=:]\s*['"]?([A-Za-z0-9/+=]{40})['"]?`,
|
|
),
|
|
Description: "AWS Secret Access Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAWSKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)aws_?session_?token\s*[=:]\s*['"]?([A-Za-z0-9/+=]{100,})['"]?`,
|
|
),
|
|
Description: "AWS Session Token",
|
|
},
|
|
|
|
// ==================== GCP ====================
|
|
{
|
|
Type: SecretTypeGCPKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)("type"\s*:\s*"service_account")`,
|
|
),
|
|
Description: "GCP Service Account JSON",
|
|
},
|
|
{
|
|
Type: SecretTypeGCPKey,
|
|
Pattern: regexp.MustCompile(`(?i)AIza[0-9A-Za-z\-_]{35}`),
|
|
Description: "Google API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeGCPKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com`,
|
|
),
|
|
Description: "Google OAuth Client ID",
|
|
},
|
|
|
|
// ==================== Azure ====================
|
|
{
|
|
Type: SecretTypeAzureKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{88}`,
|
|
),
|
|
Description: "Azure Storage Account Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAzureKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)azure[_-]?(storage[_-]?)?key\s*[=:]\s*['"]?([A-Za-z0-9+/=]{88})['"]?`,
|
|
),
|
|
Description: "Azure Key in variable",
|
|
},
|
|
{
|
|
Type: SecretTypeAzureKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\.[a-zA-Z0-9~_-]{34,}`,
|
|
),
|
|
Description: "Azure Application Secret",
|
|
},
|
|
|
|
// ==================== GitHub ====================
|
|
{
|
|
Type: SecretTypeGitHub,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}`,
|
|
),
|
|
Description: "GitHub Personal Access Token",
|
|
},
|
|
{
|
|
Type: SecretTypeGitHub,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)github[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9_]{36,255})['"]?`,
|
|
),
|
|
Description: "GitHub Token in variable",
|
|
},
|
|
{
|
|
Type: SecretTypeGitHub,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)github_app_[0-9]+_installation_[0-9]+_access_token`,
|
|
),
|
|
Description: "GitHub App Installation Token",
|
|
},
|
|
|
|
// ==================== GitLab ====================
|
|
{
|
|
Type: SecretTypeGitLab,
|
|
Pattern: regexp.MustCompile(`(?i)glpat-[A-Za-z0-9\-_]{20,}`),
|
|
Description: "GitLab Personal Access Token",
|
|
},
|
|
{
|
|
Type: SecretTypeGitLab,
|
|
Pattern: regexp.MustCompile(`(?i)glsa-[A-Za-z0-9\-_]{20,}`),
|
|
Description: "GitLab Service Account Token",
|
|
},
|
|
{
|
|
Type: SecretTypeGitLab,
|
|
Pattern: regexp.MustCompile(`(?i)glrt-[A-Za-z0-9\-_]{20,}`),
|
|
Description: "GitLab Runner Token",
|
|
},
|
|
|
|
// ==================== Slack ====================
|
|
{
|
|
Type: SecretTypeSlack,
|
|
Pattern: regexp.MustCompile(
|
|
`xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*`,
|
|
),
|
|
Description: "Slack Token",
|
|
},
|
|
{
|
|
Type: SecretTypeSlack,
|
|
Pattern: regexp.MustCompile(
|
|
`https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+`,
|
|
),
|
|
Description: "Slack Webhook URL",
|
|
},
|
|
{
|
|
Type: SecretTypeSlack,
|
|
Pattern: regexp.MustCompile(`xoxe\.[a-zA-Z0-9\-]+`),
|
|
Description: "Slack Enterprise Grid Token",
|
|
},
|
|
|
|
// ==================== Stripe ====================
|
|
{
|
|
Type: SecretTypeStripe,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(sk|pk|rk)_(test|live)_[0-9a-zA-Z]{24,}`,
|
|
),
|
|
Description: "Stripe API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeStripe,
|
|
Pattern: regexp.MustCompile(`(?i)whsec_[A-Za-z0-9]{32,}`),
|
|
Description: "Stripe Webhook Secret",
|
|
},
|
|
|
|
// ==================== Twilio ====================
|
|
{
|
|
Type: SecretTypeTwilio,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)twilio[_-]?(auth[_-]?token|api[_-]?key)\s*[=:]\s*['"]?([A-Za-z0-9]{32})['"]?`,
|
|
),
|
|
Description: "Twilio Auth Token or API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeTwilio,
|
|
Pattern: regexp.MustCompile(`SK[a-f0-9]{32}`),
|
|
Description: "Twilio API Key",
|
|
},
|
|
|
|
// ==================== SendGrid ====================
|
|
{
|
|
Type: SecretTypeSendGrid,
|
|
Pattern: regexp.MustCompile(
|
|
`SG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43}`,
|
|
),
|
|
Description: "SendGrid API Key",
|
|
},
|
|
|
|
// ==================== Mailgun ====================
|
|
{
|
|
Type: SecretTypeMailgun,
|
|
Pattern: regexp.MustCompile(`(?i)key-[0-9a-zA-Z]{32}`),
|
|
Description: "Mailgun API Key",
|
|
},
|
|
|
|
// ==================== NPM ====================
|
|
{
|
|
Type: SecretTypeNPM,
|
|
Pattern: regexp.MustCompile(`(?i)npm_[A-Za-z0-9]{36}`),
|
|
Description: "NPM Access Token",
|
|
},
|
|
{
|
|
Type: SecretTypeNPM,
|
|
Pattern: regexp.MustCompile(
|
|
`//registry\.npmjs\.org/:_authToken=[A-Za-z0-9\-_]+`,
|
|
),
|
|
Description: "NPM Auth Token in .npmrc",
|
|
},
|
|
|
|
// ==================== PyPI ====================
|
|
{
|
|
Type: SecretTypePyPI,
|
|
Pattern: regexp.MustCompile(
|
|
`pypi-AgEIcHlwaS5vcmc[A-Za-z0-9\-_]{50,}`,
|
|
),
|
|
Description: "PyPI API Token",
|
|
},
|
|
|
|
// ==================== Docker Hub ====================
|
|
{
|
|
Type: SecretTypeDockerHub,
|
|
Pattern: regexp.MustCompile(`(?i)dckr_pat_[A-Za-z0-9\-_]{27,}`),
|
|
Description: "Docker Hub Personal Access Token",
|
|
},
|
|
|
|
// ==================== SSH & Private Keys ====================
|
|
{
|
|
Type: SecretTypeSSHKey,
|
|
Pattern: regexp.MustCompile(
|
|
`-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----`,
|
|
),
|
|
Description: "SSH Private Key",
|
|
},
|
|
{
|
|
Type: SecretTypePrivateKey,
|
|
Pattern: regexp.MustCompile(`-----BEGIN PRIVATE KEY-----`),
|
|
Description: "Generic Private Key",
|
|
},
|
|
{
|
|
Type: SecretTypePrivateKey,
|
|
Pattern: regexp.MustCompile(
|
|
`-----BEGIN PGP PRIVATE KEY BLOCK-----`,
|
|
),
|
|
Description: "PGP Private Key",
|
|
},
|
|
{
|
|
Type: SecretTypePrivateKey,
|
|
Pattern: regexp.MustCompile(
|
|
`-----BEGIN ENCRYPTED PRIVATE KEY-----`,
|
|
),
|
|
Description: "Encrypted Private Key",
|
|
},
|
|
|
|
// ==================== JWT ====================
|
|
{
|
|
Type: SecretTypeJWT,
|
|
Pattern: regexp.MustCompile(
|
|
`eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_.+/]*`,
|
|
),
|
|
Description: "JSON Web Token",
|
|
},
|
|
|
|
// ==================== Authentication ====================
|
|
{
|
|
Type: SecretTypeBasicAuth,
|
|
Pattern: regexp.MustCompile(`(?i)basic\s+[A-Za-z0-9+/=]{20,}`),
|
|
Description: "HTTP Basic Authentication",
|
|
},
|
|
{
|
|
Type: SecretTypeBearer,
|
|
Pattern: regexp.MustCompile(`(?i)bearer\s+[A-Za-z0-9\-_.]+`),
|
|
Description: "Bearer Token",
|
|
},
|
|
|
|
// ==================== Database Connection Strings ====================
|
|
{
|
|
Type: SecretTypeDatabase,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(postgres|postgresql|mysql|mongodb|redis|amqp|mssql):\/\/[^\s'"]+:[^\s'"]+@[^\s'"]+`,
|
|
),
|
|
Description: "Database Connection URL with credentials",
|
|
},
|
|
{
|
|
Type: SecretTypeConnectionString,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(Server|Data Source)=[^;]+;.*(Password|Pwd)=[^;]+`,
|
|
),
|
|
Description: "Connection String with password",
|
|
},
|
|
{
|
|
Type: SecretTypeDatabase,
|
|
Pattern: regexp.MustCompile(
|
|
`mongodb\+srv:\/\/[^:]+:[^@]+@[^\s"']+`,
|
|
),
|
|
Description: "MongoDB Atlas Connection String",
|
|
},
|
|
|
|
// ==================== Datadog ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)DD_API_KEY\s*[=:]\s*['"]?([a-f0-9]{32})['"]?`,
|
|
),
|
|
Description: "Datadog API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)DD_APP_KEY\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "Datadog Application Key",
|
|
},
|
|
|
|
// ==================== PagerDuty ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`(?i)pd_[a-z0-9]{20}_[a-z0-9]{7}`),
|
|
Description: "PagerDuty API Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)pagerduty[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9\-_+]{20,})['"]?`,
|
|
),
|
|
Description: "PagerDuty API Key",
|
|
},
|
|
|
|
// ==================== Heroku ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)heroku[_-]?api[_-]?key\s*[=:]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`,
|
|
),
|
|
Description: "Heroku API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)HEROKU_API_KEY\s*[=:]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`,
|
|
),
|
|
Description: "Heroku API Key Variable",
|
|
},
|
|
|
|
// ==================== DigitalOcean ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`dop_v1_[a-f0-9]{64}`),
|
|
Description: "DigitalOcean Personal Access Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)digitalocean[_-]?token\s*[=:]\s*['"]?([a-f0-9]{64})['"]?`,
|
|
),
|
|
Description: "DigitalOcean Token Variable",
|
|
},
|
|
|
|
// ==================== Linode ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)linode[_-]?token\s*[=:]\s*['"]?([a-f0-9]{64})['"]?`,
|
|
),
|
|
Description: "Linode API Token",
|
|
},
|
|
|
|
// ==================== Vultr ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)vultr[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Z0-9]{36})['"]?`,
|
|
),
|
|
Description: "Vultr API Key",
|
|
},
|
|
|
|
// ==================== Oracle Cloud ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)oci[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9+/=]{200,})['"]?`,
|
|
),
|
|
Description: "Oracle Cloud Infrastructure API Key",
|
|
},
|
|
|
|
// ==================== IBM Cloud ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)ibm[_-]?cloud[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9\-_]{44})['"]?`,
|
|
),
|
|
Description: "IBM Cloud API Key",
|
|
},
|
|
|
|
// ==================== Alibaba Cloud ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`(?i)LTAI[A-Za-z0-9]{12,20}`),
|
|
Description: "Alibaba Cloud Access Key ID",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)alibaba[_-]?access[_-]?key[_-]?secret\s*[=:]\s*['"]?([A-Za-z0-9]{30})['"]?`,
|
|
),
|
|
Description: "Alibaba Cloud Access Key Secret",
|
|
},
|
|
|
|
// ==================== CircleCI ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)circle[_-]?token\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "CircleCI Personal API Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)CIRCLE_TOKEN\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "CircleCI Token Variable",
|
|
},
|
|
|
|
// ==================== Travis CI ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)travis[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9\-_]{22})['"]?`,
|
|
),
|
|
Description: "Travis CI API Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)TRAVIS_TOKEN\s*[=:]\s*['"]?([A-Za-z0-9\-_]{22})['"]?`,
|
|
),
|
|
Description: "Travis CI Token Variable",
|
|
},
|
|
|
|
// ==================== Buildkite ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)buildkite[_-]?token\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "Buildkite API Token",
|
|
},
|
|
|
|
// ==================== Drone ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)drone[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9]{32})['"]?`,
|
|
),
|
|
Description: "Drone CI Token",
|
|
},
|
|
|
|
// ==================== TeamCity ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)teamcity[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9]{20,})['"]?`,
|
|
),
|
|
Description: "TeamCity Access Token",
|
|
},
|
|
|
|
// ==================== Bamboo ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)bamboo[_-]?api[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9]{20,})['"]?`,
|
|
),
|
|
Description: "Bamboo API Token",
|
|
},
|
|
|
|
// ==================== Discord ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`https://discord\.com/api/webhooks/[0-9]{17,19}/[A-Za-z0-9\-_]{68}`,
|
|
),
|
|
Description: "Discord Webhook URL",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`https://discordapp\.com/api/webhooks/[0-9]{17,19}/[A-Za-z0-9\-_]{68}`,
|
|
),
|
|
Description: "Discord App Webhook URL",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)[MN][A-Za-z\d]{23}\.[A-Za-z\d]{6}\.[A-Za-z\d_\-]{27}`,
|
|
),
|
|
Description: "Discord Bot Token",
|
|
},
|
|
|
|
// ==================== Telegram ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`[0-9]{8,10}:[A-Za-z0-9_-]{35}`),
|
|
Description: "Telegram Bot Token",
|
|
},
|
|
|
|
// ==================== Microsoft Teams ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`https://[a-z0-9]+\.webhook\.office\.com/webhookb2/[a-f0-9\-]+@[a-f0-9\-]+/IncomingWebhook/[a-f0-9]+/[a-f0-9\-]+`,
|
|
),
|
|
Description: "Microsoft Teams Webhook URL",
|
|
},
|
|
|
|
// ==================== PayPal ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)paypal[_-]?client[_-]?secret\s*[=:]\s*['"]?([A-Za-z0-9\-_]{64})['"]?`,
|
|
),
|
|
Description: "PayPal Client Secret",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`(?i)A[A-Z0-9]{79}`),
|
|
Description: "PayPal Access Token",
|
|
},
|
|
|
|
// ==================== Square ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sq0[a-z]{3}-[A-Za-z0-9\-_]{22,43}`),
|
|
Description: "Square Access Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`EAAA[a-zA-Z0-9]{60}`),
|
|
Description: "Square OAuth Secret",
|
|
},
|
|
|
|
// ==================== Braintree ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)braintree[_-]?(access[_-]?token|private[_-]?key)\s*[=:]\s*['"]?([a-z0-9]{32})['"]?`,
|
|
),
|
|
Description: "Braintree Access Token",
|
|
},
|
|
|
|
// ==================== Authorize.net ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)authorize[_-]?net[_-]?transaction[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9]{16})['"]?`,
|
|
),
|
|
Description: "Authorize.net Transaction Key",
|
|
},
|
|
|
|
// ==================== Postmark ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`,
|
|
),
|
|
Description: "Postmark Server Token (Generic UUID format)",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)postmark[_-]?api[_-]?token\s*[=:]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`,
|
|
),
|
|
Description: "Postmark API Token",
|
|
},
|
|
|
|
// ==================== SparkPost ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)sparkpost[_-]?api[_-]?key\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "SparkPost API Key",
|
|
},
|
|
|
|
// ==================== Amazon SES ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)ses[_-]?smtp[_-]?password\s*[=:]\s*['"]?([A-Za-z0-9+/=]{44})['"]?`,
|
|
),
|
|
Description: "Amazon SES SMTP Password",
|
|
},
|
|
|
|
// ==================== New Relic ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`NRAK-[A-Z0-9]{27}`),
|
|
Description: "New Relic User API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`NRJS-[a-f0-9]{19}`),
|
|
Description: "New Relic Browser API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)new[_-]?relic[_-]?license[_-]?key\s*[=:]\s*['"]?([a-f0-9]{40})['"]?`,
|
|
),
|
|
Description: "New Relic License Key",
|
|
},
|
|
|
|
// ==================== Splunk ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)splunk[_-]?token\s*[=:]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`,
|
|
),
|
|
Description: "Splunk Authentication Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`Splunk\s+[A-Za-z0-9\-]{73}`),
|
|
Description: "Splunk HEC Token",
|
|
},
|
|
|
|
// ==================== Sumo Logic ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)sumo[_-]?logic[_-]?access[_-]?(id|key)\s*[=:]\s*['"]?([A-Za-z0-9]{14,20})['"]?`,
|
|
),
|
|
Description: "Sumo Logic Access ID/Key",
|
|
},
|
|
|
|
// ==================== Elastic ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)elastic[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9\-_=]{100,})['"]?`,
|
|
),
|
|
Description: "Elastic API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)elasticsearch[_-]?password\s*[=:]\s*['"]?([A-Za-z0-9\-_]{20,})['"]?`,
|
|
),
|
|
Description: "Elasticsearch Password",
|
|
},
|
|
|
|
// ==================== Grafana Cloud ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)grafana[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Za-z0-9\-_=]{100,})['"]?`,
|
|
),
|
|
Description: "Grafana Cloud API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`glc_[A-Za-z0-9+/]{32,}={0,2}`),
|
|
Description: "Grafana Cloud API Token",
|
|
},
|
|
|
|
// ==================== CockroachDB ====================
|
|
{
|
|
Type: SecretTypeDatabase,
|
|
Pattern: regexp.MustCompile(
|
|
`postgresql:\/\/[^:]+:[^@]+@[a-z0-9\-]+\.cockroachlabs\.cloud:\d+\/[^\s'"]+`,
|
|
),
|
|
Description: "CockroachDB Connection String",
|
|
},
|
|
|
|
// ==================== PlanetScale ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`pscale_tkn_[A-Za-z0-9\-_\.=]{43}`),
|
|
Description: "PlanetScale Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`pscale_pw_[A-Za-z0-9\-_\.=]{43}`),
|
|
Description: "PlanetScale Password",
|
|
},
|
|
|
|
// ==================== Supabase ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZS[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+`,
|
|
),
|
|
Description: "Supabase Service Role Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)supabase[_-]?anon[_-]?key\s*[=:]\s*['"]?(eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+)['"]?`,
|
|
),
|
|
Description: "Supabase Anon Key",
|
|
},
|
|
|
|
// ==================== Auth0 ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)auth0[_-]?client[_-]?secret\s*[=:]\s*['"]?([A-Za-z0-9\-_]{64})['"]?`,
|
|
),
|
|
Description: "Auth0 Client Secret",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)auth0[_-]?api[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9\-_\.=]{28,})['"]?`,
|
|
),
|
|
Description: "Auth0 Management API Token",
|
|
},
|
|
|
|
// ==================== Okta ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)okta[_-]?api[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9\-_]{42})['"]?`,
|
|
),
|
|
Description: "Okta API Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`(?i)ssws\s+[A-Za-z0-9\-_]{42}`),
|
|
Description: "Okta API Token (SSWS format)",
|
|
},
|
|
|
|
// ==================== Firebase ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)firebase[_-]?api[_-]?key\s*[=:]\s*['"]?(AIza[0-9A-Za-z\-_]{35})['"]?`,
|
|
),
|
|
Description: "Firebase API Key",
|
|
},
|
|
|
|
// ==================== Clerk ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk_test_[A-Za-z0-9]{48}`),
|
|
Description: "Clerk Secret Key (Test)",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk_live_[A-Za-z0-9]{48}`),
|
|
Description: "Clerk Secret Key (Live)",
|
|
},
|
|
|
|
// ==================== OpenAI ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk-[A-Za-z0-9]{48}`),
|
|
Description: "OpenAI API Key (Legacy)",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk-proj-[A-Za-z0-9\-_]{48,}`),
|
|
Description: "OpenAI Project API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk-org-[A-Za-z0-9]{48,}`),
|
|
Description: "OpenAI Organization API Key",
|
|
},
|
|
|
|
// ==================== Anthropic ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`sk-ant-api03-[A-Za-z0-9\-_]{95,}`),
|
|
Description: "Anthropic API Key",
|
|
},
|
|
|
|
// ==================== HuggingFace ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`hf_[A-Za-z0-9]{38}`),
|
|
Description: "HuggingFace Access Token",
|
|
},
|
|
|
|
// ==================== Replicate ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(`r8_[A-Za-z0-9]{40}`),
|
|
Description: "Replicate API Token",
|
|
},
|
|
|
|
// ==================== Pinecone ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)pinecone[_-]?api[_-]?key\s*[=:]\s*['"]?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['"]?`,
|
|
),
|
|
Description: "Pinecone API Key",
|
|
},
|
|
|
|
// ==================== Algolia ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)algolia[_-]?admin[_-]?api[_-]?key\s*[=:]\s*['"]?([a-f0-9]{32})['"]?`,
|
|
),
|
|
Description: "Algolia Admin API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)x-algolia-api-key:\s*[A-Za-z0-9]{32}`,
|
|
),
|
|
Description: "Algolia API Key Header",
|
|
},
|
|
|
|
// ==================== Cloudinary ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`cloudinary://[0-9]+:[A-Za-z0-9\-_]+@[a-z0-9\-]+`,
|
|
),
|
|
Description: "Cloudinary URL with API Secret",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)cloudinary[_-]?api[_-]?secret\s*[=:]\s*['"]?([A-Za-z0-9\-_]{27})['"]?`,
|
|
),
|
|
Description: "Cloudinary API Secret",
|
|
},
|
|
|
|
// ==================== Mapbox ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`pk\.eyJ1Ijoi[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_\.]+`,
|
|
),
|
|
Description: "Mapbox Public Token",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`sk\.eyJ1Ijoi[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_\.]+`,
|
|
),
|
|
Description: "Mapbox Secret Token",
|
|
},
|
|
|
|
// ==================== Plaid ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)plaid[_-]?(secret|client_id)\s*[=:]\s*['"]?([a-f0-9]{30})['"]?`,
|
|
),
|
|
Description: "Plaid API Secret",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`access-(?:sandbox|development|production)-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`,
|
|
),
|
|
Description: "Plaid Access Token",
|
|
},
|
|
|
|
// ==================== Bitbucket ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)bitbucket[_-]?app[_-]?password\s*[=:]\s*['"]?([A-Za-z0-9]{20})['"]?`,
|
|
),
|
|
Description: "Bitbucket App Password",
|
|
},
|
|
|
|
// ==================== Atlassian ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)atlassian[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9]{24})['"]?`,
|
|
),
|
|
Description: "Atlassian API Token",
|
|
},
|
|
|
|
// ==================== Confluent ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)confluent[_-]?cloud[_-]?api[_-]?key\s*[=:]\s*['"]?([A-Z0-9]{16})['"]?`,
|
|
),
|
|
Description: "Confluent Cloud API Key",
|
|
},
|
|
|
|
// ==================== Redis ====================
|
|
{
|
|
Type: SecretTypeDatabase,
|
|
Pattern: regexp.MustCompile(`redis:\/\/:[^@]+@[^\s"']+`),
|
|
Description: "Redis Connection String with Password",
|
|
},
|
|
{
|
|
Type: SecretTypeDatabase,
|
|
Pattern: regexp.MustCompile(`rediss:\/\/[^:]+:[^@]+@[^\s"']+`),
|
|
Description: "Redis SSL Connection String",
|
|
},
|
|
|
|
// ==================== Cloudflare ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)cloudflare[_-]?api[_-]?key\s*[=:]\s*['"]?([a-f0-9]{37})['"]?`,
|
|
),
|
|
Description: "Cloudflare Global API Key",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)cloudflare[_-]?api[_-]?token\s*[=:]\s*['"]?([A-Za-z0-9\-_]{40})['"]?`,
|
|
),
|
|
Description: "Cloudflare API Token",
|
|
},
|
|
|
|
// ==================== Sentry ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`https://[a-f0-9]{32}@[a-z0-9\-]+\.ingest\.sentry\.io/[0-9]+`,
|
|
),
|
|
Description: "Sentry DSN",
|
|
},
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)sentry[_-]?auth[_-]?token\s*[=:]\s*['"]?([a-f0-9]{64})['"]?`,
|
|
),
|
|
Description: "Sentry Auth Token",
|
|
},
|
|
|
|
// ==================== Generic High-Entropy Secrets ====================
|
|
{
|
|
Type: SecretTypeAPIKey,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(api[_-]?key|apikey|api[_-]?secret|apisecret)['":\s=]+[A-Za-z0-9\-_]{32,}`,
|
|
),
|
|
Description: "Generic API Key Pattern",
|
|
},
|
|
{
|
|
Type: SecretTypePassword,
|
|
Pattern: regexp.MustCompile(
|
|
`(?i)(password|passwd|pwd)['":\s=]+[^\s'"]{8,}`,
|
|
),
|
|
Description: "Generic Password Pattern",
|
|
},
|
|
}
|
|
|
|
var SensitiveEnvNames = map[string]struct{}{
|
|
// ==================== Generic Auth ====================
|
|
"PASSWORD": {},
|
|
"PASSWD": {},
|
|
"PASS": {},
|
|
"PWD": {},
|
|
"SECRET": {},
|
|
"SECRET_KEY": {},
|
|
"SECRETKEY": {},
|
|
"API_KEY": {},
|
|
"APIKEY": {},
|
|
"API_SECRET": {},
|
|
"APISECRET": {},
|
|
"ACCESS_KEY": {},
|
|
"ACCESSKEY": {},
|
|
"ACCESS_TOKEN": {},
|
|
"ACCESSTOKEN": {},
|
|
"AUTH_TOKEN": {},
|
|
"AUTHTOKEN": {},
|
|
"AUTH_KEY": {},
|
|
"AUTHKEY": {},
|
|
"PRIVATE_KEY": {},
|
|
"PRIVATEKEY": {},
|
|
"ENCRYPTION_KEY": {},
|
|
"ENCRYPTIONKEY": {},
|
|
"SIGNING_KEY": {},
|
|
"SIGNINGKEY": {},
|
|
"JWT_SECRET": {},
|
|
"JWTSECRET": {},
|
|
"SESSION_SECRET": {},
|
|
"SESSIONSECRET": {},
|
|
"COOKIE_SECRET": {},
|
|
"COOKIESECRET": {},
|
|
"TOKEN": {},
|
|
"BEARER_TOKEN": {},
|
|
"OAUTH_TOKEN": {},
|
|
"REFRESH_TOKEN": {},
|
|
"CLIENT_SECRET": {},
|
|
"CONSUMER_SECRET": {},
|
|
"WEBHOOK_SECRET": {},
|
|
"MASTER_KEY": {},
|
|
"ADMIN_PASSWORD": {},
|
|
"USER_PASSWORD": {},
|
|
"ROOT_PASSWORD": {},
|
|
|
|
// ==================== Database ====================
|
|
"DB_PASSWORD": {},
|
|
"DBPASSWORD": {},
|
|
"DATABASE_PASSWORD": {},
|
|
"DATABASEPASSWORD": {},
|
|
"DATABASE_URL": {},
|
|
"DB_URL": {},
|
|
"CONNECTION_STRING": {},
|
|
"MYSQL_PASSWORD": {},
|
|
"MYSQLPASSWORD": {},
|
|
"MYSQL_ROOT_PASSWORD": {},
|
|
"POSTGRES_PASSWORD": {},
|
|
"POSTGRESPASSWORD": {},
|
|
"POSTGRESQL_PASSWORD": {},
|
|
"REDIS_PASSWORD": {},
|
|
"REDISPASSWORD": {},
|
|
"REDIS_URL": {},
|
|
"MONGO_PASSWORD": {},
|
|
"MONGOPASSWORD": {},
|
|
"MONGODB_PASSWORD": {},
|
|
"MONGODB_URI": {},
|
|
"MONGODB_URL": {},
|
|
"MSSQL_PASSWORD": {},
|
|
"ORACLE_PASSWORD": {},
|
|
"CASSANDRA_PASSWORD": {},
|
|
"COCKROACHDB_URL": {},
|
|
"PLANETSCALE_TOKEN": {},
|
|
"SUPABASE_KEY": {},
|
|
"SUPABASE_ANON_KEY": {},
|
|
"SUPABASE_SERVICE_KEY": {},
|
|
|
|
// ==================== AWS ====================
|
|
"AWS_SECRET_ACCESS_KEY": {},
|
|
"AWS_ACCESS_KEY_ID": {},
|
|
"AWS_SESSION_TOKEN": {},
|
|
"AWS_API_KEY": {},
|
|
|
|
// ==================== GCP ====================
|
|
"GCP_PRIVATE_KEY": {},
|
|
"GOOGLE_API_KEY": {},
|
|
"GOOGLE_APPLICATION_CREDENTIALS": {},
|
|
"GCLOUD_SERVICE_KEY": {},
|
|
|
|
// ==================== Azure ====================
|
|
"AZURE_CLIENT_SECRET": {},
|
|
"AZURE_STORAGE_KEY": {},
|
|
"AZURE_TENANT_ID": {},
|
|
"AZURE_SUBSCRIPTION_ID": {},
|
|
|
|
// ==================== GitHub ====================
|
|
"GITHUB_TOKEN": {},
|
|
"GH_TOKEN": {},
|
|
"GITHUB_PAT": {},
|
|
"GITHUB_PERSONAL_ACCESS_TOKEN": {},
|
|
"GITHUB_APP_PRIVATE_KEY": {},
|
|
|
|
// ==================== GitLab ====================
|
|
"GITLAB_TOKEN": {},
|
|
"CI_JOB_TOKEN": {},
|
|
"CI_DEPLOY_PASSWORD": {},
|
|
|
|
// ==================== Bitbucket ====================
|
|
"BITBUCKET_PASSWORD": {},
|
|
"BITBUCKET_APP_PASSWORD": {},
|
|
|
|
// ==================== Docker ====================
|
|
"DOCKER_PASSWORD": {},
|
|
"DOCKER_AUTH": {},
|
|
"DOCKERHUB_TOKEN": {},
|
|
"DOCKERHUB_PASSWORD": {},
|
|
"REGISTRY_PASSWORD": {},
|
|
|
|
// ==================== NPM / Yarn ====================
|
|
"NPM_TOKEN": {},
|
|
"NPM_AUTH_TOKEN": {},
|
|
"YARN_AUTH_TOKEN": {},
|
|
|
|
// ==================== Slack ====================
|
|
"SLACK_TOKEN": {},
|
|
"SLACK_WEBHOOK": {},
|
|
"SLACK_WEBHOOK_URL": {},
|
|
"SLACK_BOT_TOKEN": {},
|
|
"SLACK_API_TOKEN": {},
|
|
|
|
// ==================== Stripe ====================
|
|
"STRIPE_SECRET_KEY": {},
|
|
"STRIPE_API_KEY": {},
|
|
"STRIPE_PRIVATE_KEY": {},
|
|
"STRIPE_WEBHOOK_SECRET": {},
|
|
|
|
// ==================== Twilio ====================
|
|
"TWILIO_AUTH_TOKEN": {},
|
|
"TWILIO_API_KEY": {},
|
|
"TWILIO_API_SECRET": {},
|
|
|
|
// ==================== SendGrid ====================
|
|
"SENDGRID_API_KEY": {},
|
|
|
|
// ==================== Mailgun ====================
|
|
"MAILGUN_API_KEY": {},
|
|
"MAILGUN_PRIVATE_KEY": {},
|
|
|
|
// ==================== Postmark ====================
|
|
"POSTMARK_API_TOKEN": {},
|
|
"POSTMARK_SERVER_TOKEN": {},
|
|
|
|
// ==================== SparkPost ====================
|
|
"SPARKPOST_API_KEY": {},
|
|
|
|
// ==================== SES ====================
|
|
"SES_SMTP_PASSWORD": {},
|
|
"SES_ACCESS_KEY": {},
|
|
|
|
// ==================== Firebase ====================
|
|
"FIREBASE_API_KEY": {},
|
|
"FIREBASE_PRIVATE_KEY": {},
|
|
"FIREBASE_CLIENT_EMAIL": {},
|
|
|
|
// ==================== Heroku ====================
|
|
"HEROKU_API_KEY": {},
|
|
|
|
// ==================== DigitalOcean ====================
|
|
"DIGITALOCEAN_TOKEN": {},
|
|
"DIGITALOCEAN_ACCESS_TOKEN": {},
|
|
|
|
// ==================== Linode ====================
|
|
"LINODE_TOKEN": {},
|
|
"LINODE_API_TOKEN": {},
|
|
|
|
// ==================== Vultr ====================
|
|
"VULTR_API_KEY": {},
|
|
|
|
// ==================== Oracle Cloud ====================
|
|
"OCI_CLI_KEY_FILE": {},
|
|
"OCI_CLI_USER": {},
|
|
|
|
// ==================== IBM Cloud ====================
|
|
"IBM_CLOUD_API_KEY": {},
|
|
"IBMCLOUD_API_KEY": {},
|
|
|
|
// ==================== Alibaba Cloud ====================
|
|
"ALIBABA_CLOUD_ACCESS_KEY_ID": {},
|
|
"ALIBABA_CLOUD_ACCESS_KEY_SECRET": {},
|
|
|
|
// ==================== Cloudflare ====================
|
|
"CLOUDFLARE_API_KEY": {},
|
|
"CLOUDFLARE_API_TOKEN": {},
|
|
"CF_API_KEY": {},
|
|
|
|
// ==================== Datadog ====================
|
|
"DATADOG_API_KEY": {},
|
|
"DD_API_KEY": {},
|
|
"DD_APP_KEY": {},
|
|
|
|
// ==================== New Relic ====================
|
|
"NEW_RELIC_LICENSE_KEY": {},
|
|
"NEW_RELIC_API_KEY": {},
|
|
"NEWRELIC_LICENSE_KEY": {},
|
|
|
|
// ==================== Sentry ====================
|
|
"SENTRY_DSN": {},
|
|
"SENTRY_AUTH_TOKEN": {},
|
|
|
|
// ==================== PagerDuty ====================
|
|
"PAGERDUTY_API_KEY": {},
|
|
"PD_API_KEY": {},
|
|
|
|
// ==================== CircleCI ====================
|
|
"CIRCLE_TOKEN": {},
|
|
"CIRCLECI_TOKEN": {},
|
|
|
|
// ==================== Travis CI ====================
|
|
"TRAVIS_TOKEN": {},
|
|
|
|
// ==================== Buildkite ====================
|
|
"BUILDKITE_TOKEN": {},
|
|
"BUILDKITE_API_TOKEN": {},
|
|
|
|
// ==================== Drone ====================
|
|
"DRONE_TOKEN": {},
|
|
|
|
// ==================== TeamCity ====================
|
|
"TEAMCITY_TOKEN": {},
|
|
|
|
// ==================== Bamboo ====================
|
|
"BAMBOO_TOKEN": {},
|
|
|
|
// ==================== Discord ====================
|
|
"DISCORD_WEBHOOK": {},
|
|
"DISCORD_BOT_TOKEN": {},
|
|
"DISCORD_TOKEN": {},
|
|
|
|
// ==================== Telegram ====================
|
|
"TELEGRAM_BOT_TOKEN": {},
|
|
"TELEGRAM_TOKEN": {},
|
|
|
|
// ==================== Teams ====================
|
|
"TEAMS_WEBHOOK": {},
|
|
"TEAMS_WEBHOOK_URL": {},
|
|
|
|
// ==================== PayPal ====================
|
|
"PAYPAL_CLIENT_SECRET": {},
|
|
"PAYPAL_SECRET": {},
|
|
|
|
// ==================== Square ====================
|
|
"SQUARE_ACCESS_TOKEN": {},
|
|
"SQUARE_SECRET": {},
|
|
|
|
// ==================== Braintree ====================
|
|
"BRAINTREE_PRIVATE_KEY": {},
|
|
"BRAINTREE_ACCESS_TOKEN": {},
|
|
|
|
// ==================== Authorize.net ====================
|
|
"AUTHORIZENET_TRANSACTION_KEY": {},
|
|
|
|
// ==================== Splunk ====================
|
|
"SPLUNK_TOKEN": {},
|
|
"SPLUNK_HEC_TOKEN": {},
|
|
|
|
// ==================== Sumo Logic ====================
|
|
"SUMOLOGIC_ACCESS_ID": {},
|
|
"SUMOLOGIC_ACCESS_KEY": {},
|
|
|
|
// ==================== Elastic ====================
|
|
"ELASTIC_API_KEY": {},
|
|
"ELASTICSEARCH_PASSWORD": {},
|
|
|
|
// ==================== Grafana ====================
|
|
"GRAFANA_API_KEY": {},
|
|
"GRAFANA_CLOUD_API_KEY": {},
|
|
|
|
// ==================== Auth0 ====================
|
|
"AUTH0_CLIENT_SECRET": {},
|
|
"AUTH0_API_TOKEN": {},
|
|
|
|
// ==================== Okta ====================
|
|
"OKTA_API_TOKEN": {},
|
|
"OKTA_CLIENT_TOKEN": {},
|
|
|
|
// ==================== Clerk ====================
|
|
"CLERK_SECRET_KEY": {},
|
|
"CLERK_API_KEY": {},
|
|
|
|
// ==================== OpenAI ====================
|
|
"OPENAI_API_KEY": {},
|
|
"OPENAI_SECRET_KEY": {},
|
|
|
|
// ==================== Anthropic ====================
|
|
"ANTHROPIC_API_KEY": {},
|
|
"CLAUDE_API_KEY": {},
|
|
|
|
// ==================== HuggingFace ====================
|
|
"HUGGINGFACE_TOKEN": {},
|
|
"HF_TOKEN": {},
|
|
|
|
// ==================== Replicate ====================
|
|
"REPLICATE_API_TOKEN": {},
|
|
|
|
// ==================== Pinecone ====================
|
|
"PINECONE_API_KEY": {},
|
|
|
|
// ==================== Algolia ====================
|
|
"ALGOLIA_API_KEY": {},
|
|
"ALGOLIA_ADMIN_API_KEY": {},
|
|
|
|
// ==================== Cloudinary ====================
|
|
"CLOUDINARY_API_SECRET": {},
|
|
"CLOUDINARY_URL": {},
|
|
|
|
// ==================== Mapbox ====================
|
|
"MAPBOX_ACCESS_TOKEN": {},
|
|
"MAPBOX_SECRET_TOKEN": {},
|
|
|
|
// ==================== Plaid ====================
|
|
"PLAID_SECRET": {},
|
|
"PLAID_CLIENT_ID": {},
|
|
|
|
// ==================== Atlassian ====================
|
|
"ATLASSIAN_TOKEN": {},
|
|
"JIRA_API_TOKEN": {},
|
|
"CONFLUENCE_API_TOKEN": {},
|
|
|
|
// ==================== Confluent ====================
|
|
"CONFLUENT_API_KEY": {},
|
|
"CONFLUENT_API_SECRET": {},
|
|
|
|
// ==================== SSH / TLS ====================
|
|
"SSH_PRIVATE_KEY": {},
|
|
"SSH_KEY": {},
|
|
"SSL_KEY": {},
|
|
"TLS_KEY": {},
|
|
"CERTIFICATE_KEY": {},
|
|
"CERT_KEY": {},
|
|
|
|
// ==================== Encryption ====================
|
|
"ENCRYPTION_PASSWORD": {},
|
|
"CRYPTO_KEY": {},
|
|
"AES_KEY": {},
|
|
}
|
|
|
|
func IsSensitiveEnvName(name string) bool {
|
|
normalized := strings.ToUpper(strings.TrimSpace(name))
|
|
if _, exists := SensitiveEnvNames[normalized]; exists {
|
|
return true
|
|
}
|
|
sensitiveSubstrings := []string{
|
|
"PASSWORD", "PASSWD", "SECRET", "TOKEN", "KEY", "CREDENTIAL",
|
|
"AUTH", "PRIVATE", "APIKEY", "API_KEY", "ACCESS",
|
|
}
|
|
for _, substr := range sensitiveSubstrings {
|
|
if strings.Contains(normalized, substr) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func DetectSecrets(content string) []SecretPattern {
|
|
var matches []SecretPattern
|
|
for _, pattern := range SecretPatterns {
|
|
if pattern.Pattern.MatchString(content) {
|
|
matches = append(matches, pattern)
|
|
}
|
|
}
|
|
return matches
|
|
}
|
|
|
|
func CalculateEntropy(s string) float64 {
|
|
if len(s) == 0 {
|
|
return 0
|
|
}
|
|
freq := make(map[rune]float64)
|
|
for _, c := range s {
|
|
freq[c]++
|
|
}
|
|
length := float64(len(s))
|
|
var entropy float64
|
|
for _, count := range freq {
|
|
p := count / length
|
|
entropy -= p * math.Log2(p)
|
|
}
|
|
return entropy
|
|
}
|
|
|
|
func IsHighEntropyString(s string, minLength int, minEntropy float64) bool {
|
|
if len(s) < minLength {
|
|
return false
|
|
}
|
|
return CalculateEntropy(s) >= minEntropy
|
|
}
|