regexes.json

[
    {
        "Regex": "[\"']?(?P\u003csecret\u003e(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16})[\"']?",
        "Severity": "CRITICAL",
        "Title": "AWS Access Key ID"
    },
    {
        "Regex": "(?i)(^|\\s+)[\"']?(aws)?_?(secret)?_?(access)?_?key[\"']?\\s*(:|=\u003e|=)\\s*[\"']?(?P\u003csecret\u003e[A-Za-z0-9\\/\\+=]{40})[\"']?",
        "Severity": "CRITICAL",
        "Title": "AWS Secret Access Key"
    },
    {
        "Regex" : "arn:aws:sns:[a-z0-9\\-]+:[0-9]+:[A-Za-z0-9\\-_]+",
        "Severity": "MEDIUM",
        "Title": "Amazon SNS Topic Disclosure"
    },
    {
        "Regex": "\bAIza[0-9A-Za-z\\-_]{35}\b",
        "Severity": "MEDIUM",
        "Title": "Google API Key"
    },
    {
        "Regex": "ghp_[0-9a-zA-Z]{36}",
        "Severity": "CRITICAL",
        "Title": "GitHub Personal Access Token"
    },
    {
        "Regex": "gho_[0-9a-zA-Z]{36}",
        "Severity": "CRITICAL",
        "Title": "GitHub OAuth Access Token"
    },
    {
        "Regex": "(ghu|ghs)_[0-9a-zA-Z]{36}",
        "Severity": "CRITICAL",
        "Title": "GitHub App Token"
    },
    {
        "Regex": "ghr_[0-9a-zA-Z]{76}",
        "Severity": "CRITICAL",
        "Title": "GitHub Refresh Token"
    },
    {
        "Regex": "glpat-[0-9a-zA-Z\\-\\_]{20}",
        "Severity": "CRITICAL",
        "Title": "GitLab Personal Access Token"
    },
    {
        "Regex": "(?i)-----\\s*?BEGIN[ A-Z0-9_-]*?PRIVATE KEY( BLOCK)?\\s*?-----[\\s]*?(?P\u003csecret\u003e[\\sA-Za-z0-9=+/\\\\\\r\\n]+)[\\s]*?-----\\s*?END[ A-Z0-9_-]*? PRIVATE KEY( BLOCK)?\\s*?-----",
        "Severity": "HIGH",
        "Title": "Asymmetric Private Key"
    },
    {
        "Regex": "shp(ss|at|ca|pa)_[a-fA-F0-9]{32}",
        "Severity": "HIGH",
        "Title": "Shopify token"
    },
    {
        "Regex": "xox[baprs]-([0-9a-zA-Z]{10,48})",
        "Severity": "HIGH",
        "Title": "Slack token"
    },
    {
        "Regex": "(?i)pk_(test|live)_[0-9a-z]{10,32}",
        "Severity": "LOW",
        "Title": "Stripe Publishable Key"
    },
    {
        "Regex": "(?i)sk_(test|live)_[0-9a-z]{10,32}",
        "Severity": "CRITICAL",
        "Title": "Stripe Secret Key"
    },
    {
        "Regex": "pypi-AgEIcHlwaS5vcmc[A-Za-z0-9\\-_]{50,1000}",
        "Severity": "HIGH",
        "Title": "PyPI upload token"
    },
    {
        "Regex": "\\\"type\\\": \\\"service_account\\\"",
        "Severity": "CRITICAL",
        "Title": "Google (GCP) Service-account"
    },
    {
        "Regex": " (?i)(?P\u003ckey\u003eheroku[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})['\\\"]",
        "Severity": "HIGH",
        "Title": "Heroku API Key"
    },
    {
        "Regex": "https:\\/\\/hooks.slack.com\\/services\\/[A-Za-z0-9+\\/]{44,48}",
        "Severity": "MEDIUM",
        "Title": "Slack Webhook"
    },
    {
        "Regex": "SK[0-9a-fA-F]{32}",
        "Severity": "MEDIUM",
        "Title": "Twilio API Key"
    },
    {
        "Regex": "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}",
        "Severity": "MEDIUM",
        "Title": "Age secret key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003efacebook[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{32})['\\\"]",
        "Severity": "LOW",
        "Title": "Facebook token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003etwitter[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{35,44})['\\\"]",
        "Severity": "LOW",
        "Title": "Twitter token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003eadobe[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{32})['\\\"]",
        "Severity": "LOW",
        "Title": "Adobe Client ID (Oauth Web)"
    },
    {
        "Regex": "(p8e-)(?i)[a-z0-9]{32}",
        "Severity": "LOW",
        "Title": "Adobe Client Secret"
    },
    {
        "Regex": "([^0-9a-z]|^)(?P\u003csecret\u003e(LTAI)(?i)[a-z0-9]{20})([^0-9a-z]|$)",
        "Severity": "HIGH",
        "Title": "Alibaba AccessKey ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ealibaba[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{30})['\\\"]",
        "Severity": "HIGH",
        "Title": "Alibaba Secret Key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003easana[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[0-9]{16})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Asana Client ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003easana[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Asana Client Secret"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003eatlassian[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{24})['\\\"]",
        "Severity": "HIGH",
        "Title": "Atlassian API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ebitbucket[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{32})['\\\"]",
        "Severity": "HIGH",
        "Title": "Bitbucket client ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ebitbucket[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9_\\-]{64})['\\\"]",
        "Severity": "HIGH",
        "Title": "Bitbucket client secret"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ebeamer[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003eb_[a-z0-9=_\\-]{44})['\\\"]",
        "Severity": "LOW",
        "Title": "Beamer API token"
    },
    {
        "Regex": "(CLOJARS_)(?i)[a-z0-9]{60}",
        "Severity": "MEDIUM",
        "Title": "Clojars API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003econtentful[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9\\-=_]{43})['\\\"]",
        "Severity": "LOW",
        "Title": "Contentful delivery API token"
    },
    {
        "Regex": "dapi[a-h0-9]{32}",
        "Severity": "MEDIUM",
        "Title": "Databricks API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ediscord[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-h0-9]{64})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Discord API key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ediscord[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[0-9]{18})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Discord client ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ediscord[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9=_\\-]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Discord client secret"
    },
    {
        "Regex": "['\\\"](dp\\.pt\\.)(?i)[a-z0-9]{43}['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Doppler API token"
    },
    {
        "Regex": "(?i)(dropbox[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"]([a-z0-9]{15})['\\\"]",
        "Severity": "HIGH",
        "Title": "Dropbox API secret/key"
    },
    {
        "Regex": "(?i)(dropbox[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](sl\\.[a-z0-9\\-=_]{135})['\\\"]",
        "Severity": "HIGH",
        "Title": "Dropbox short lived API token"
    },
    {
        "Regex": "(?i)(dropbox[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"][a-z0-9]{11}(AAAAAAAAAA)[a-z0-9\\-_=]{43}['\\\"]",
        "Severity": "HIGH",
        "Title": "Dropbox long lived API token"
    },
    {
        "Regex": "['\\\"]duffel_(test|live)_(?i)[a-z0-9_-]{43}['\\\"]",
        "Severity": "LOW",
        "Title": "Duffel API token"
    },
    {
        "Regex": "['\\\"]dt0c01\\.(?i)[a-z0-9]{24}\\.[a-z0-9]{64}['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Dynatrace API token"
    },
    {
        "Regex": "['\\\"]EZ[AT]K(?i)[a-z0-9]{54}['\\\"]",
        "Severity": "LOW",
        "Title": "EasyPost API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003efastly[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9\\-=_]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Fastly API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003efinicity[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{20})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Finicity client secret"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003efinicity[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Finicity API token"
    },
    {
        "Regex": "FLW(PUB|SEC)K_TEST-(?i)[a-h0-9]{32}-X",
        "Severity": "MEDIUM",
        "Title": "Flutterwave public/secret key"
    },
    {
        "Regex": "FLWSECK_TEST[a-h0-9]{12}",
        "Severity": "MEDIUM",
        "Title": "Flutterwave encrypted key"
    },
    {
        "Regex": "fio-u-(?i)[a-z0-9\\-_=]{64}",
        "Severity": "LOW",
        "Title": "Frame.io API token"
    },
    {
        "Regex": "['\\\"]live_(?i)[a-z0-9\\-_=]{40}['\\\"]",
        "Severity": "MEDIUM",
        "Title": "GoCardless API token"
    },
    {
        "Regex": "['\\\"]eyJrIjoi(?i)[a-z0-9\\-_=]{72,92}['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Grafana API token"
    },
    {
        "Regex": "['\\\"](?i)[a-z0-9]{14}\\.atlasv1\\.[a-z0-9\\-_=]{60,70}['\\\"]",
        "Severity": "MEDIUM",
        "Title": "HashiCorp Terraform user/org API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003ehubspot[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12})['\\\"]",
        "Severity": "LOW",
        "Title": "HubSpot API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003eintercom[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9=_]{60})['\\\"]",
        "Severity": "LOW",
        "Title": "Intercom API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003eintercom[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12})['\\\"]",
        "Severity": "LOW",
        "Title": "Intercom client secret/ID"
    },
    {
        "Regex": "(?i)(ionic[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](ion_[a-z0-9]{42})['\\\"]",
        "Severity": "",
        "Title": "Ionic API token"
    },
    {
        "Regex": "lin_api_(?i)[a-z0-9]{40}",
        "Severity": "MEDIUM",
        "Title": "Linear API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003elinear[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Linear client secret/ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003elob[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e(live|test)_[a-f0-9]{35})['\\\"]",
        "Severity": "LOW",
        "Title": "Lob API Key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003elob[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e(test|live)_pub_[a-f0-9]{31})['\\\"]",
        "Severity": "LOW",
        "Title": "Lob Publishable API Key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003emailchimp[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-f0-9]{32}-us20)['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Mailchimp API key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003emailgun[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e(pub)?key-[a-f0-9]{32})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Mailgun private API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003emailgun[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "Mailgun webhook signing key"
    },
    {
        "Regex": "(?i)(pk\\.[a-z0-9]{60}\\.[a-z0-9]{22})",
        "Severity": "MEDIUM",
        "Title": "Mapbox API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003emessagebird[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{25})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "MessageBird API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003emessagebird[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-h0-9]{8}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{4}-[a-h0-9]{12})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "MessageBird API client ID"
    },
    {
        "Regex": "['\\\"](NRAK-[A-Z0-9]{27})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "New Relic user API Key"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003enewrelic[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[A-Z0-9]{64})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "New Relic user API ID"
    },
    {
        "Regex": "['\\\"](NRJS-[a-f0-9]{19})['\\\"]",
        "Severity": "MEDIUM",
        "Title": "New Relic ingest browser API token"
    },
    {
        "Regex": "['\\\"](npm_(?i)[a-z0-9]{36})['\\\"]",
        "Severity": "CRITICAL",
        "Title": "npm access token"
    },
    {
        "Regex": "pscale_pw_(?i)[a-z0-9\\-_\\.]{43}",
        "Severity": "MEDIUM",
        "Title": "PlanetScale password"
    },
    {
        "Regex": "pscale_tkn_(?i)[a-z0-9\\-_\\.]{43}",
        "Severity": "MEDIUM",
        "Title": "PlanetScale API token"
    },
    {
        "Regex": "PMAK-(?i)[a-f0-9]{24}\\-[a-f0-9]{34}",
        "Severity": "MEDIUM",
        "Title": "Postman API token"
    },
    {
        "Regex": "\bpul-[a-f0-9]{40}\b",
        "Severity": "HIGH",
        "Title": "Pulumi API token"
    },
    {
        "Regex": "rubygems_[a-f0-9]{48}",
        "Severity": "MEDIUM",
        "Title": "Rubygem API token"
    },
    {
        "Regex": "SG\\.(?i)[a-z0-9_\\-\\.]{66}",
        "Severity": "MEDIUM",
        "Title": "SendGrid API token"
    },
    {
        "Regex": "xkeysib-[a-f0-9]{64}\\-(?i)[a-z0-9]{16}",
        "Severity": "LOW",
        "Title": "Sendinblue API token"
    },
    {
        "Regex": "shippo_(live|test)_[a-f0-9]{40}",
        "Severity": "LOW",
        "Title": "Shippo API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003elinkedin[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z]{16})['\\\"]",
        "Severity": "LOW",
        "Title": "LinkedIn Client secret"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003elinkedin[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{14})['\\\"]",
        "Severity": "LOW",
        "Title": "LinkedIn Client ID"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003etwitch[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}['\\\"](?P\u003csecret\u003e[a-z0-9]{30})['\\\"]",
        "Severity": "LOW",
        "Title": "Twitch API token"
    },
    {
        "Regex": "(?i)(?P\u003ckey\u003etypeform[a-z0-9_ .\\-,]{0,25})(=|\u003e|:=|\\|\\|:|\u003c=|=\u003e|:).{0,5}(?P\u003csecret\u003etfp_[a-z0-9\\-_\\.=]{59})",
        "Severity": "LOW",
        "Title": "Typeform API token"
    }
]