codegate/signatures.yaml at fix-logging · stacklok/codegate

This repository was archived by the owner on Jun 5, 2025. It is now read-only.
396 lines (310 loc) · 14.2 KB
  - Access Key: (?:A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA|ABIA|ACCA)[A-Z0-9]{16}
  - Secret Access Key Variable: (?i)(amazon|amz|aws)[-_]{0,1}(secret)[-_]{0,1}((access)[-_]{0,1}){0,1}key
  # - Cognito User Pool ID: (?i)us-[a-z]{2,}-[a-z]{4,}-\d{1,}
  - RDS Password: (?i)(rds\-master\-password|db\-password)
  - S3 Private Key Variable: (?i)AWS_S3_PRIVATE_KEY|s3_key|S3_PRIVATE_KEY
  - Security Token Header Variable: (?i)X-Amz-Security-Token
  - API Gateway Key Source Header Variable: (?i)x-amazon-apigateway-api-key-source
  - S3 Bucket: (?i)AWS_S3_BUCKET|s3_bucket
  - SNS Confirmation URL: (?i)https:\/\/sns\.[a-z0-9-]+\.amazonaws\.com\/?Action=ConfirmSubscription&Token=[a-zA-Z0-9-=_]+
  - SES SMTP Password Variable: (?i)ses_smtp_password
  - AWS Private Key Variable: (?i)ec2\-private\-key|EC2_PRIVATE_KEY
  - MWS Token: (amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})
  - AppSync GraphQL Key: \bda2-[a-z0-9]{26}
- Microsoft:
  - Azure API Key Variable: (?i)Ocp-Apim-Subscription-Key
  - Azure Functions Key Header Variable: (?i)x-functions-key
  # - Azure account key
  # - Azure account name
  - Azure Connection String: (?i)(.*.windows.net).+(password)
  - Azure Endpoint Key: (?i)(defaultendpointsprotocol).+(key).+
  - Client Secret: (?i)(?:client_secret|ClientSecret)[\s:\"]{0,3}[a-zA-Z0-9\-_]{36,}
  - Graph API Key: (?i)MSGRAPH_[a-zA-Z0-9\-_]{20,40}
  - Outlook Webhook URL: (?i)https:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-]{60,}
  - OneDrive Access Token Variable: (?i)onedrive_access_token
  - SQL Connection Password Variable: mssql.connection.password
- DigitalOcean:
  - API Key: (?i)do_[a-z0-9]{60}
  - Environment Variable: (?i)\b(DO|DIGITALOCEAN).+(API|OAUTH|ACCESS)*(TOKEN|KEY)\b
  - Custom App Token: (?i)shpca_[a-fA-F0-9]{32}
  - Shared Secret Token: (?i)shpss_[a-fA-F0-9]{32}
  - Access Token: (?i)shpat_[a-fA-F0-9]{32}
  - Private Access Token: (?i)shppa_[a-fA-F0-9]{32}
  - SendGrid API Key: \b(?i)SG\.[\w\-_]{20,24}\.[\w\-_]{39,50}\b
  - Account SID: \bAC[a-zA-Z0-9_\-]{32}\b
  - App SID: \bAP[a-zA-Z0-9_\-]{32}\b
  - API Key: \bSK[0-9a-fA-F]{32}\b
  - Access Token: \b(?i)55[0-9a-fA-F]{32}\b
- Atlassian: 
  - JIRA Token: (?i)(jira_token)
  - Bitbucket Data Center Access Token: BBDC-[a-zA-Z0-9+]{44}
  - Confluence API Key: (?i)confluence[a-zA-Z0-9_]{12,}
  - App Password: (?i)(bbp_[a-zA-Z0-9]{32})
  - Cloud API Key: AIza[0-9A-Za-z_-]{35}
  - Cloud OAuth Secret: (?i)(GOCSPX-[-0-9A-Za-z_]{24,32})
  #- reCaptcha Key: 6L([A-Za-z0-9_-]{6})AAAAA([A-Za-z0-9_-]{27})
  - OAuth Key: ya29\.[0-9A-Za-z_-]{64,256}
  - Firebase URL: (?i)https:\/\/[a-z0-9-]+\.firebaseio\.com\/.*.json
  - Firebase Cloud Messaging API Key: (?i)([0-9a-zA-Z_-]{11}:APA91b[0-9a-zA-Z_-]{134})
  - Signed URL: (?i)https:\/\/storage\.googleapis\.com\/[A-Za-z0-9\/-]+?GoogleAccessId=[A-Za-z0-9-]+&Expires=\d+&Signature=[A-Za-z0-9%]+
  - Cloud Service Account Private Key: (?i)"-----BEGIN PRIVATE KEY-----[A-Za-z0-9\/+=\n]+-----END PRIVATE KEY-----"
  - Cloud Service Account Key ID: (?i)"private_key_id":\s*"[a-f0-9]{32}"
  - Cloud Project Number: (?i)"project_number":\s*"\d{12}"
  - API Key Header Variable: (?i)x-goog-api-key
  - Client ID: "[0-9]+-[0-9A-Za-z_]{32}\\.apps\\.googleusercontent\\.com"
  - Access Token: \b(?i)ghp_[A-Za-z0-9_]{35,38}
  - OAuth Token: \b(?i)gho_[A-Za-z0-9_]{35,38}
  - App Installation Token: \b(?i)ghu_[A-Za-z0-9_]{35,38}
  - App user Token: \b(?i)ghs_[A-Za-z0-9_]{35,38}
  - Device Code: \bGH_[a-zA-Z0-9_]{9,30}
  - Refresh Token: (\b?i)ghr_[A-Za-z0-9_]{35,38}
  - Webhook Secret: (?i)whsec_[A-Za-z0-9]{31,38}
  - Authentication URL: (?i)(?:(http|https):)//[\S]{1,256}:[\S]{1,256}@github.com[\S]+
  - Personal Access Token: (?i)glpat-[A-Za-z0-9\-_]{20}
  - OAuth Access Token: (?i)glOauth-[A-Za-z0-9\-_]{20,50}
  - GitLab CI Token Variable: (?i)gitlab(?:-|_|.)(?:ci(?:-|_|.))?(?:job(?:-|_|.))?token
  - Repository Access Token: (?i)glrepo-[A-Za-z0-9\-_]{20,50}
  - Secret File Token: (?i)(?:secret_token|CI_JOB_TOKEN)[^{}]{0,20}( ){0,1}[=:]( ){0,1}([A-Za-z0-9\-_]{20,50})
  - Project Secret Token: (?i)glproj-[A-Za-z0-9\-_]{20,50}
  #- Classic Token: (?i)(?:gitlab)[^{}()<>?*&:%@!\/= \n]{0,40}[\"\']?\s{0,50}(?::|=>|=)\s{0,50}[\"\']?([a-zA-Z0-9-_]{20})
  - Meraki API Key Header Variable: (?i)X-Cisco-Meraki-API-Key
- CoinMarketCap:
  - API Key Header Variable: (?i)X-CMC_PRO_API_KEY
  - API Key Header Variable: (?i)X-Algolia-API-Key
  - User Token: (xox[ps]-[0-9]{8,13}-[0-9]{8,13}-[0-9]{8,13}-[a-zA-Z0-9-]{10,32})
  - Bot Token: (xox[b]-[0-9]{8,13}-[0-9]{8,13}-[a-zA-Z0-9-]{20,30})
  - Workspace Access Token: (xoxa-[0-9]{8,13}-[0-9]{8,13}-[a-zA-Z0-9-]{8,128})
  - Workspace Refresh Token: (xoxr-[0-9]{8,13}-[0-9]{8,13}-[a-zA-Z0-9-]{8,128})
  - Configuration Access Token: (xoxe.xoxp-[0-9]{0,2}-[a-zA-Z0-9-]{130,170})
  - Signing Secret: (?i)xox[a-z]-[0-9a-zA-Z-]{10,}
  - Configuration Refresh Token: (xoxe-[0-9]{0,2}-[a-zA-Z0-9-]{130,170})
  - App Token: (xapp-[0-9]{0,2}-[A-Z0-9]{8,13}-[0-9]{12,15}-[a-zA-Z0-9-]{60,70})
  - Webhook URL: https://hooks\.slack\.com/services/.{8,128}
  - API Key: (?i)STACK_UP_AUTH
  - Cloud Infrastructure: ocid1\.(tenancy|user)\.oc1\..[a-zA-Z0-9\-_]{59}
  - Cloud API: AKID[0-9a-zA-Z]{16}
  - Hub Access Token: dckr_pat_[a-zA-Z0-9_=-]{24,32}
  - Swarm Join Token: (?i)(SWMTKN-[a-z0-9A-Z]+)
  - Swarm Unlock Token: (?i)(swmkey-1-[A-Za-z0-9+_-]{30,50})
  - Identity Secret Key: k2.secret.[\w]+
  - Page Access Token: (?i)(EAAG[0-9A-Za-z]{10,128})
  - Facebook Access Token: EAACEdEose0cBA[0-9A-Za-z]+
  #- Client Token: (?i)fb[a-zA-Z0-9]{24,32}
  - Instagram Access Token: (?i)(IGQV[0-9A-Za-z-_]{10,255})
  - Instagram App Secret: (?i)(ig_[a-f0-9]{32})
  - Instagram Client Token: (?i)(ig_ct_[a-zA-Z0-9]{32})
  - Instagram Authentication Token: (?i)(ig_did=[a-f0-9-]{36})
  #- WhatsApp API Key: (?i)(?:whatsapp)[^{}]{0,20}[=:\"\' ]{0,5}([A-Za-z0-9]{24,32})
  - WhatsApp Session Token: (?i)(session_token=[a-zA-Z0-9-_]{40,})
  #- Messenger App Secret: (?i)(?:messenger|fb)[^{}]{0,20}[=:\"\' ]{0,5}([a-f0-9]{32})
  - Debug Token: (?i)(DQVJ[0-9A-Za-z-_]{10,255})
  - Service Account Token: (?i)glsa_[a-z0-9+-=\/]{32}_[a-f0-9]{8}
  - API Token: (?i)grafana_(api_token|token)
  - Read-only Key: (?i)rk_live_[a-zA-Z0-9]{20,30}
  - Secret Key: (?i)sk_live_[a-zA-Z0-9]{20,30}
  - Publishable Key: (?i)pk_live_[a-zA-Z0-9]{20,30}
  - Access Token: (?:^|['\"])access_token\$production\$([0-9a-zA-Z]{28,42})
- SquareUp:
  - API Key: sq0i[a-z]{2}-[0-9A-Za-z\-_]{22,43}
  - API Secret: sq0c[a-z]{2}-[0-9A-Za-z\-_]{40,50}
  - Access Token: sqOatp-[0-9A-Za-z\-_]{22}
  - Publish Key: pub-c-[0-9a-z]{8}-[0-9a-z]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}
  - Subscribe Key: sub-c-[0-9a-z]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}
- FlutterWave:
  - API Key: (?i)(FLWSECK-[0-9a-z]{32}-X)
  - Client Token: ^pub[0-9a-f]{32}$
  # - App ID: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
  - Device Cookie: (?i)sp_dc=[\w_-]{128,256}
  - Key: (?i)sp_key=[a-f0-9]{8}-?[a-f0-9]{4}-?4[a-f0-9]{3}-?[89ab][a-f0-9]{3}-?[a-f0-9]{12}
- Telegram:
  - Bot API Key: (?:bot)*[0-9]{8,10}:AA[0-9A-Za-z\-_=]{33}
- SonarSource:
  - API Key Variable: sonar(qube|source)_(api_key|token|key)
  - API Key Variable: (?i)KAKAO(_|-){0,1}API(_|-){0,1}KEY
- Airtable:
  - API Key: (?i)(?:airtable).{0,40}[\"\'`]?\s{0,50}(?::|=>|=|,)\s{0,50}[\"\'`]?(key[a-zA-Z0-9_-]{14})
  - Table URL: https:\/\/api\.airtable\.com\/v0\/[\w]+\/[\w]+
  - API Key: (?i)(PMAK-[a-zA-Z-0-9]{59})
#- Clearbit:
#  - API Key: (?i)(?:clearbit)[^{}]{0,20}( ){0,1}[=:]( ){0,1}.{0,40}(sk_[0-9a-z_]{24,32})
  - App Secret Key Variable: APP_SECRET_KEY
  - API Key Variable: (?i)(shodan_key|shodan_api_key|shodan_token)
- Homebrew:
  - API Token Variable: (?i)HOMEBREW_GITHUB_API_TOKEN
  - GitHub API Token Variable: (?i)JEKYLL_GITHUB_TOKEN
  - Project API Key: (?i)sk-proj-[\w-]+T3BlbkFJ[\w-]+
  - User API Key: (?i)sk-[^proj]\w.+T3BlbkFJ[\w-]+
  - API Key Variable: (?i)openai(.|_)api_key
  - API Key: (?i)gsk_[A-Za-z0-9]+
  - API Key Variable: (?i)GROQ(_|-){0,1}API(_|-){0,1}KEY
- Pinecone:
  - API Key Variable: (?i)PINECONE(_|-){0,1}API(_|-){0,1}KEY
- LangChain:
  - API Key Variable: (?i)LANGCHAIN(_|-){0,1}API(_|-){0,1}KEY
- ElevenLabs:
  - API Key Variable: (?i)ELEVENLABS(_|-){0,1}API(_|-){0,1}KEY
- CartesiaAI:
  - API Key Variable: (?i)CARTESIA(_|-){0,1}API(_|-){0,1}KEY
- OpenWeatherMap:
  - API Key URL: (?i)(?:https?://api\.openweathermap\.org/data/[a-z0-9.+?\/]+=)([a-z0-9]{32})
- Razorpay:
  - Test Key: (?i)rzp_test_\w{10,20}
  - Live Key: (?i)rzp_live_\w{10,20}
#- CircleCI:
#  - Personal Token: (?i)(?:circle)[^{}]{0,20}( ){0,1}[=:]( ){0,1}(["a-fA-F0-9]{40,42})
  - API Key: (?i)key-[0-9a-zA-Z]{32}
  - Domain Sending Key: "[a-f0-9]{32}-[a-f0-9]{8}-[a-f0-9]{8}"
  - API Key Variable: (?i)(?:okta_api_key)
- Hashicorp:
  - Terraform API Token: (?i)([A-Za-z0-9]{14}.atlasv1.[A-Za-z0-9]{67})
  - Vault Unseal Key: (?i)unseal.?(?:key|token)[^)(|\s"\'<>,&#]?.{0,40}([a-fA-F0-9\/_\-=][^|\s"\'<>,&#]{43})
  - MailChimp API Key: (?i)[0-9a-f]{32}-us[0-9]{1,2}
  - Token: (?i)(npm_[0-9a-zA-Z]{36})
- Riot Games: 
  - API Key: (?i)(rgapi[a-f0-9-]{37})
- RubyGems:	
  - API Key: (?i)(rubygems_[a-zA0-9]{48})
- Artifactory:
  - Token: AKCp[0-9][a-zA-Z0-9]{64,128}
  - Personal Access Token: (figd_[a-zA-Z0-9-_]{14,32}_[a-zA-Z0-9-_]{14,32})
  - Token Header Variable: (?i)X-Figma-Token
- Adafruit.io:
  - API Key: aio_[a-zA-Z0-9]{28}
- Checkout.com: 
  - Secret Key: (sk_|sk_test_)[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}
  - Token: (?i)(sk\.eyj1ijoi[a-zA-Z-0-9-_\.]{80,240})
#  - Cloud User Key: (?i)(?:ibm)[^{}]{0,20}( ){0,1}[=:]( ){0,1}(-_[A-Za-z0-9_-]{42})
  - API Key Variable: (?i)heroku_api_key
  - App Name Variable: (?i)heroku_app_name
- Freshdesk:
  - API Token: (?i)(?:freshdesk)[^{}()<>?*&:%@.\-!\/\n]{0,40}\b([0-9A-Za-z]{16,24})
- SendInBlue:
  - API Key: xkeysib-.{0,81}
- Docusign:
  - API Key: (?i)(?:docusign).{0,40}\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b
- Dynatrace:
  - API Token: dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64}
  - API Key: (?i)(?:CONTRIBSYS_+COM).{0,40}\b(?:[0-9a-z\-_\t .]{0,20})\b
  - Personal Token:	(?i)(?:fastly)[^{}()<>?*&%'",@!\-/=\n]{0,40}\b([A-Za-z0-9_-]{32})\b
  - Personal Access Token: (?i)(?:asana).{0,40}([0-9]{1,}\/[0-9]{10,}:[A-Za-z0-9]{32,})|([0-9]{1,}\/[0-9]{10,}:[A-Za-z0-9]{32,})
  - API Key: (?i)(?:beamer).{0,40}b_[a-z0-9+/]{43}=|b_[a-z0-9+/]{43}=
- Chief.app:
  - Key: ct[pt]_([a-zA-Z0-9]){36}
  - Access Token:	(sq0atp-[0-9A-Za-z\-_]{22})
- Saucelabs:
  - TestFairy Key Variable: (?i)testfairy_{0,}(access_key|key|secret|token|shared_secret|sharedsecret)
  - TestFairy OAuth Token URL: https://testfairy\.atlassian\.net/plugins/servlet/oauth/authorize\?oauth_token-\w{32}
  - Key Variable: (?i)sauce_token
- Hockeyapp:
  - Key Variable: (?i)(?:hockeyapp_key)
  - API Key: (?i)(?:nuget).{0,40}(oy2[a-z0-9]{43})
- Cloudinary:
  - API URL: cloudinary://.+/
- CodeClimate:
  - Key Variable: (?i)(?:codeclimate_key)
  - Token Variable: (?i)(?:pingdom_token)
  - Auth Token Variable: (?i)ngrok.set_auth_token
  - API Key Block: (?i)add-api-key
  - Authentication Token Block: (?i)add-authtoken	
  - Connection URL Block: (?i)add-connect-url
  - Token Variable: (?i)line_(channel|secret|token)
- Crunchbase:
  - API Key Header Variable: (?i)X-Cb-User-Key
- RapidAPI:
  - Key Header Variable: (?i)x-rapidapi-key
  - App Key: (?:^|['\"`])(wx[a-f0-9]{16})(?:$|['\"`])
  - API Key: re_\w{8}_{0,1}\w*\d\w*
  - Blob Read/Write Token: vercel_blob_rw_\w{47,49}
  - Project ID: \bprj_.{28}\b
  - Project ID Variable: (?i)PROJECT_ID_VERCEL
  - Turbo Build Token Variable: (?i)TURBO_TOKEN
  - Access Token Variable: (?i)VERCEL_ACCESS_TOKEN
  - Private Lines Variable: Private-Lines
  - Private MAC Variable: Private-MAC
- Postgresql:
  - URL: (?i)(?:pgsql:|postgres:|postgresql:)//[\S]{1,256}:[\S]{1,256}@[-.%\w\/:]+\.[\S]+
  - Password Variable: (?i)POSTGRES_PASSWORD
  - Access Token: (?i)\bghp_[A-Za-z0-9]{36}\b
  - OAuth Token: (?i)\bgho_[A-Za-z0-9]{36}\b
  - App Installation Token: (?i)\bghu_[A-Za-z0-9]{36}\b
  - App user Token: (?i)\bghs_[A-Za-z0-9]{36}\b
  - Refresh Token: (?i)\bghr_[A-Za-z0-9]{36}\b
  - Shell Command: "[\\w. ]+(--username|-u|--user|--uname|--userid|--id|-i) [^$][\\w_\\-.\"']{1,256} (--password|-p|--pwd|--pass)[^$<{][\\w_\\-.\"']{4,253}"
  - Bearer Token: "(Authorization: )*((b|B)earer [a-zA-Z0-9+\\/._=-]{16,512})(={0,2})"
  - Basic Token: "(Authorization: )*((b|B)asic [a-zA-Z0-9+\\/._=-]{16,512})(={0,2})"
  - JSON Web Token: \beyJ[a-zA-Z0-9]{3,}\.eyJ[A-Za-z0-9_\\/+-]{3,}\.[A-Za-z0-9_\\/+-]{3,}\b
  - JSON Web Token Variable: (?i)JWT_SECRET
  #- Refresh Token Variable: (?i)refresh[_-]{0,1}token
  - Access Token Variable: (?i)access[_-]{0,1}token
  - Token Variable: (?i)token
  - Password Variable: (?i)password
  - API Key Variable: (?i)_api_key
  - API Key Header Variable: X-Api-Key
  - Secret Key Variable: (?i)secret_key
  - User Key Variable: (?i)user_key
  - Secret Variable: (?i).+secret\b
  - Consumer Key Variable: (?i)consumer(\.|_)?key
  - Consumer Secret Variable: (?i)consumer(\.|_)?secret
  - Auth URL: (?i)((https?|ftps?|ssh|sftp)://[^":@>\]\[\n\s*/]+:[^:@/>\]\[\n\s*/]+([^>\]\[\n\s*:][@]{1})\w+(\.\w+)+)
  - Redis URL: (?i)((redis?)://[^":@>\]\[\n\s*/]+:[^:@/>\]\[\n\s*/]+([^>\]\[\n\s*:][@]{1})\w+(\.\w+)+)
  - MongoDB URL: (?i)(?:mongodb:|mongodb\+srv:)//[\S]{1,256}:[\S]{1,256}@[-.%\w\/:]+\.[\S]+
  - MySQL URL: (?i)(?:mysql:)//[\S]{1,256}:[\S]{1,256}@[-.%\w\/:]+\.[\S]+
  - File Transfer Protocol (FTP) URL: ftp://[a-zA-Z0-9-_+.@]+:[^@]+@[^/]+
  - Advanced Message Queuing Protocol (AMQP) URL: amqp://[a-zA-Z0-9-_+.@]+:[^@]+@[^/]+
  # Private Keys
  - JSON Web Key Block: /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/gm
  - Private Key Block: -{0,5} ?BEGIN (?:RSA |ENCRYPTED |OPENSSH |SSH2 )?PRIVATE KEY ?-{0,5} ?([\s\S]*?)-{0,5} ?END (?:RSA |ENCRYPTED |OPENSSH |SSH2 )?PRIVATE KEY ?-{0,5}
Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FilesExpand file tree

signatures.yaml

Latest commit

History

signatures.yaml

File metadata and controls
