.github/9

ISSUE_TEMPLATE/3

bug_report.md config.yml feature_request.md

workflows/3

ci.yml clean-clone.yml release.yml

CODEOWNERS dependabot.yml pull_request_template.md

apps/630

api/250

src/243

common/30

__tests__/3

authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts

filters/1

all-exceptions.filter.ts

guards/3

auth.guard.ts internal-service.guard.ts rate-limit.guard.ts

interceptors/2

actor-context.interceptor.ts bigint-serialization.interceptor.ts

middleware/2

idempotency.test.ts idempotency.ts

pipes/1

zod-validation.pipe.ts

actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts

config/1

env.ts

lib/11

__tests__/5

crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts

authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts

modules/197

ai/28

__tests__/4

ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts

generator/4

executor.ts generate.controller.ts generate.dto.ts generate.service.ts

ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts

api-keys/3

api-keys.controller.ts api-keys.module.ts api-keys.service.ts

audit/2

audit-log.controller.ts audit.module.ts

auth/4

auth.controller.ts auth.module.ts auth.service.ts dto.ts

automations/5

automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts

blocks/5

__tests__/1

batch-version-cas.test.ts

block.service.ts blocks.controller.ts blocks.module.ts dto.ts

comments/4

comments.controller.ts comments.module.ts comments.service.ts dto.ts

databases/9

__tests__/3

normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts

database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts

docs/2

docs.controller.ts docs.module.ts

files/10

__tests__/1

quota.test.ts

dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts

forms/18

debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts

health/3

health.controller.ts health.module.ts health.service.ts

integrations/3

integrations.controller.ts integrations.module.ts integrations.service.ts

internal/12

__tests__/2

flush-query-shape.test.ts internal.endpoints.test.ts

ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts

notifications/3

notifications.controller.ts notifications.module.ts notifications.service.ts

oauth/6

__tests__/1

oauth.scopes.test.ts

oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts

org/15

audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts

orgs/5

dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts

pages/4

dto.ts page.service.ts pages.controller.ts pages.module.ts

scim/15

__tests__/3

email-mapping.test.ts etag.test.ts filters.test.ts

etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts

search/4

__tests__/1

search.service.test.ts

search.controller.ts search.module.ts search.service.ts

sessions/3

sessions.controller.ts sessions.module.ts sessions.service.ts

share/3

share.controller.ts share.module.ts share.service.ts

sso/16

__tests__/4

enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts

enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts

teams/4

dto.ts teams.controller.ts teams.module.ts teams.service.ts

users/4

dto.ts users.controller.ts users.module.ts users.service.ts

webhooks/3

webhooks.controller.ts webhooks.module.ts webhooks.service.ts

workspaces/4

dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts

types/1

xmldom.d.ts

app.module.ts constants.ts main.ts

_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts

realtime/33

src/17

auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts

test/11

auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts

.env.example Dockerfile package.json README.md tsconfig.json

web/255

src/244

app/45

__tests__/1

theme-tokens.test.ts

(app)/26

w/25

[workspace]/25

ask/1

page.tsx

databases/1

[id]/1

page.tsx

favorites/1

page.tsx

files/1

page.tsx

notifications/1

page.tsx

page/4

[id]/4

[block]/1

page.tsx

share/1

page.tsx

layout.tsx page.tsx

search/1

page.tsx

settings/10

appearance/1

page.tsx

automations/3

[id]/1

page.tsx

new/1

page.tsx

page.tsx

billing/1

page.tsx

developers/1

page.tsx

members/1

page.tsx

permissions/1

page.tsx

teams/1

page.tsx

page.tsx

shared/1

page.tsx

templates/1

page.tsx

trash/1

page.tsx

layout.tsx page.tsx

layout.tsx

(auth)/4

login/1

page.tsx

register/1

page.tsx

reset-password/1

page.tsx

layout.tsx

api/2

metrics/1

route.ts

v1/1

health/1

route.ts

f/1

[slug]/1

page.tsx

health/1

ready/1

route.ts

org/2

[orgId]/2

admin/2

integrations/1

page.tsx

page.tsx

share/1

[id]/1

page.tsx

error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx

components/118

admin/10

org-admin/8

ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx

ScimCard.tsx SsoTabs.tsx

ai/6

ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx

automations/5

action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx

collaboration/6

CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx

comments/3

comment-panel.tsx comment-thread.tsx mention-input.tsx

database/27

__tests__/2

cell-editor.test.tsx cell-renderer.test.tsx

AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx

dialogs/7

__tests__/1

move-to-dialog.test.tsx

create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx

editor/19

__tests__/3

code-block-text.test.ts code-block.test.tsx expandable.test.tsx

block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx

files/4

FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx

form/4

form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx

layout/8

__tests__/1

page-tree-icon.test.tsx

command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx

mentions/3

__tests__/1

mention-model.test.ts

mention-model.ts MentionPopup.tsx

search/3

ask-ai-search.tsx results-list.tsx search-dialog.tsx

settings/10

api-keys/4

ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx

webhooks/5

CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx

settings-shell.tsx

ui/3

confirm-dialog.tsx form.tsx toaster.tsx

hooks/21

__tests__/4

realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx

realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts

lib/50

__tests__/21

ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts

files/7

__tests__/2

picker.test.ts upload.test.ts

api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts

ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts

stores/8

__tests__/1

block-patch-store.test.ts

block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts

instrumentation.ts middleware.ts

.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts

worker/92

src/87

__tests__/13

ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts

health/1

server.ts

lib/12

__tests__/1

clamav.test.ts

clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts

processors/56

automations/28

__tests__/3

condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts

executors/17

assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts

condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts

files/15

__tests__/4

errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts

steps/4

finalize.ts metadata.ts scan.ts thumbnails.ts

cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts

search-index/4

builders.ts grants.ts index.ts processor.ts

ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts

config.ts events.ts index.ts logger.ts queues.ts

.env.example Dockerfile package.json README.md tsconfig.json

docs/73

api/17

ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md

architecture/10

ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md

database/2

database-architecture.md redis-keys.md

development/8

admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md

product/4

functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md

requirements/1

requirements-matrix.md

security/5

audit-report.md files.md forms.md license-allowlist.md security-architecture.md

tasks/16

phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md

ui/9

ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md

support-matrix.md

infrastructure/71

caddy/1

Caddyfile

docker/6

init/1

01-extensions.sql

opensearch/1

init-indices.json

.env.docker docker-compose.yml opensearch-init.sh README.md

kubernetes/40

observability/20

alertmanager/1

alertmanager.yaml

grafana/8

dashboards/6

ai.json api-overview.json infra.json realtime.json search.json workers-queues.json

provisioning/2

dashboards/1

dashboards.yaml

datasources/1

datasource.yaml

prometheus/3

alerts.yaml recording-rules.yaml scrape.yaml

scripts/1

sync-sources.mjs

alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml

postgres/7

configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml

api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml

nginx/2

nginx.conf README.md

observability/14

alertmanager/1

alertmanager.yaml

grafana/8

dashboards/6

ai.json api-overview.json infra.json realtime.json search.json workers-queues.json

provisioning/2

dashboards/1

dashboards.yaml

datasources/1

datasource.yaml

prometheus/3

alerts.yaml recording-rules.yaml scrape.yaml

scripts/1

dashboard-completeness.mjs

README.md

terraform/8

compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf

packages/289

ai/24

src/20

providers/7

anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts

schemas/2

database.ts generate.ts

adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts

package.json README.md tsconfig.json vitest.config.ts

auth/11

src/7

index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts

package.json README.md tsconfig.json vitest.config.ts

collaboration/17

src/13

awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

config/7

src/4

eslint.base.js index.ts prettier.base.json tsconfig.base.json

package.json README.md tsconfig.json

database-client/5

src/2

index.test.ts index.ts

package.json README.md tsconfig.json

database-engine/33

src/29

filter/2

filter.test.ts index.ts

formula/8

evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts

query/6

group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts

relations/2

index.ts relations.test.ts

rollups/2

index.ts rollups.test.ts

values/5

dates.ts index.ts registry.ts types.ts values.test.ts

views/3

buttons.ts index.ts views.test.ts

index.ts

package.json README.md tsconfig.json vitest.config.ts

editor/25

src/21

marks/1

highlight.ts

nodes/2

equation.ts mention.ts

autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

observability/20

src/16

__tests__/8

db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts

index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts

package.json README.md tsconfig.json vitest.config.ts

permissions/11

src/7

index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts

package.json README.md tsconfig.json vitest.config.ts

search/22

src/18

chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

shared/61

src/57

dto/17

ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts

events/8

audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts

realtime/6

comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts

automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts

package.json README.md tsconfig.json vitest.config.ts

storage/16

src/12

client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts

package.json README.md tsconfig.json vitest.config.ts

ui/37

src/33

components/19

avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx

color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts

package.json README.md tsconfig.json vitest.config.ts

prisma/16

migrations/13

20260927000000_init/1

migration.sql

20260928000000_search_documents_content_hash/1

migration.sql

20260929000000_workspace_usage_storage_bytes/1

migration.sql

20260930000000_form_submitted_notification_type/1

migration.sql

20261001000000_ai_phase12/1

migration.sql

20261002000000_webhooks_secret_encrypted_dlq/1

migration.sql

20261002111436_webhook_delivery_latency/1

migration.sql

20261002120000_org_admin_2fa_retention_unique/1

migration.sql

20261002215124_audit_export/1

migration.sql

20261003210000_perf_indexes_hot_paths/1

migration.sql

20261004004500_perf_indexes_hot_paths_2/1

migration.sql

migration_lock.toml README.md

schema.prisma seed.ts verify.ts

scripts/7

backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh

tests/169

e2e/63

.auth/1

user.json

fixtures/7

files/6

clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt

realtime.ts

mocks/2

oidc-issuer.ts saml-idp.ts

playwright-report/3

data/2

a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm

index.html

reports/1

files-security.json

specs/34

ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts

test-results-final-flow/3

final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2

test-failed-1.png trace.zip

.last-run.json

utils/4

api.ts dnd.ts search-lag.ts wait.ts

.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json

fixtures/1

files/1

make-sparse.ts

integration/60

ai-capability/2

ai-app.capability.test.ts gateway.capability.test.ts

drill/2

seed-drill.mjs verify-restore.mjs

fixtures/5

files/5

clip.mp4 clip.wav doc.pdf hero-1400.png note.txt

helpers/3

api.ts containers.ts seed.ts

realtime/11

control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts

ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts

performance/28

fixtures/1

search-100k.ts

helpers/2

seed-100k.mjs seed-1k-load.mjs

reports/7

api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json

api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs

security/16

helpers/1

app.ts

audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts

README.md

.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json

gitleaks.tomlgitleaks.tomlraw← root80,803 B← Back to the app

1# AI Software Factory — gitleaks configuration (TASK-0134).
2#
3# Pinned: gitleaks v8.18.4 (matches CI's gitleaks/gitleaks-action@v2).
4# Rules: the UNMODIFIED upstream default ruleset (regenerate on upgrade via
5#   https://raw.githubusercontent.com/gitleaks/gitleaks/v8.18.4/config/gitleaks.toml
6# and re-apply the factory allowlist additions below). The baseline of
7# pre-existing findings is gitleaks-baseline.json (CLI --baseline; every
8# entry = a tracked remediation — schema enforced by
9# tests/security/gitleaks-config.test.ts).
10 
11# This file has been auto-generated. Do not edit manually.
12# If you would like to contribute new rules, please use 
13# cmd/generate/config/main.go and follow the contributing guidelines
14# at https://github.com/zricethezav/gitleaks/blob/master/CONTRIBUTING.md
15 
16# This is the default gitleaks configuration file.
17# Rules and allowlists are defined within this file.
18# Rules instruct gitleaks on what should be considered a secret.
19# Allowlists instruct gitleaks on what is allowed, i.e. not a secret.
20 
21title = "gitleaks config"
22 
23[allowlist]
24description = "global allow lists"
25regexes = [
26    '''fk_test_''',
27    '''whsec_test_''',
28    '''ghp_test_''',
29    '''gho_test_''',
30    '''xox[baprs]-test-''',
31    '''AKIA_TEST_''',
32    '''AIza_TEST_''',
33    '''sk-test-''',
34]
35paths = [
36    '''gitleaks.toml''',
37    '''(.*?)(jpg|gif|doc|docx|zip|xls|pdf|bin|svg|socket|vsidx|v2|suo|wsuo|.dll|pdb|exe)$''',
38    '''(go.mod|go.sum)$''',
39    '''gradle.lockfile''',
40    '''node_modules''',
41    '''package-lock.json''',
42    '''yarn.lock''',
43    '''pnpm-lock.yaml''',
44    '''Database.refactorlog''',
45    '''vendor''',
46    '''.env.example$''',
47    '''.*\.env\.example.*''',
48    '''docker-compose.*\.example\.(yml|yaml)$''',
49    '''.*\.env\.template$''',
50    '''gitleaks\.toml$''',
51    '''gitleaks-baseline\.json$''',
52    # Never scan git internals: worktree-mode `detect` would otherwise flag
53    # .git/objects hex blobs as "private-key". CI's gitleaks-action scans
54    # history via git-log (it never reads the .git directory), so this keeps
55    # local scans consistent with CI (not a rule weakening).
56    '''.git''',
57    '''.git/''',
58]
59 
60[[rules]]
61id = "adafruit-api-key"
62description = "Identified a potential Adafruit API Key, which could lead to unauthorized access to Adafruit services and sensitive data exposure."
63regex = '''(?i)(?:adafruit)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
64keywords = [
65    "adafruit",
66]
67 
68[[rules]]
69id = "adobe-client-id"
70description = "Detected a pattern that resembles an Adobe OAuth Web Client ID, posing a risk of compromised Adobe integrations and data breaches."
71regex = '''(?i)(?:adobe)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
72keywords = [
73    "adobe",
74]
75 
76[[rules]]
77id = "adobe-client-secret"
78description = "Discovered a potential Adobe Client Secret, which, if exposed, could allow unauthorized Adobe service access and data manipulation."
79regex = '''(?i)\b((p8e-)(?i)[a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
80keywords = [
81    "p8e-",
82]
83 
84[[rules]]
85id = "age-secret-key"
86description = "Discovered a potential Age encryption tool secret key, risking data decryption and unauthorized access to sensitive information."
87regex = '''AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}'''
88keywords = [
89    "age-secret-key-1",
90]
91 
92[[rules]]
93id = "airtable-api-key"
94description = "Uncovered a possible Airtable API Key, potentially compromising database access and leading to data leakage or alteration."
95regex = '''(?i)(?:airtable)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{17})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
96keywords = [
97    "airtable",
98]
99 
100[[rules]]
101id = "algolia-api-key"
102description = "Identified an Algolia API Key, which could result in unauthorized search operations and data exposure on Algolia-managed platforms."
103regex = '''(?i)(?:algolia)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
104keywords = [
105    "algolia",
106]
107 
108[[rules]]
109id = "alibaba-access-key-id"
110description = "Detected an Alibaba Cloud AccessKey ID, posing a risk of unauthorized cloud resource access and potential data compromise."
111regex = '''(?i)\b((LTAI)(?i)[a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
112keywords = [
113    "ltai",
114]
115 
116[[rules]]
117id = "alibaba-secret-key"
118description = "Discovered a potential Alibaba Cloud Secret Key, potentially allowing unauthorized operations and data access within Alibaba Cloud."
119regex = '''(?i)(?:alibaba)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
120keywords = [
121    "alibaba",
122]
123 
124[[rules]]
125id = "asana-client-id"
126description = "Discovered a potential Asana Client ID, risking unauthorized access to Asana projects and sensitive task information."
127regex = '''(?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
128keywords = [
129    "asana",
130]
131 
132[[rules]]
133id = "asana-client-secret"
134description = "Identified an Asana Client Secret, which could lead to compromised project management integrity and unauthorized access."
135regex = '''(?i)(?:asana)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
136keywords = [
137    "asana",
138]
139 
140[[rules]]
141id = "atlassian-api-token"
142description = "Detected an Atlassian API token, posing a threat to project management and collaboration tool security and data confidentiality."
143regex = '''(?i)(?:atlassian|confluence|jira)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
144keywords = [
145    "atlassian","confluence","jira",
146]
147 
148[[rules]]
149id = "authress-service-client-access-key"
150description = "Uncovered a possible Authress Service Client Access Key, which may compromise access control services and sensitive data."
151regex = '''(?i)\b((?:sc|ext|scauth|authress)_[a-z0-9]{5,30}\.[a-z0-9]{4,6}\.acc[_-][a-z0-9-]{10,32}\.[a-z0-9+/_=-]{30,120})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
152keywords = [
153    "sc_","ext_","scauth_","authress_",
154]
155 
156[[rules]]
157id = "aws-access-token"
158description = "Identified a pattern that may indicate AWS credentials, risking unauthorized cloud resource access and data breaches on AWS platforms."
159regex = '''(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}'''
160keywords = [
161    "akia","asia","abia","acca",
162]
163 
164[[rules]]
165id = "beamer-api-token"
166description = "Detected a Beamer API token, potentially compromising content management and exposing sensitive notifications and updates."
167regex = '''(?i)(?:beamer)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(b_[a-z0-9=_\-]{44})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
168keywords = [
169    "beamer",
170]
171 
172[[rules]]
173id = "bitbucket-client-id"
174description = "Discovered a potential Bitbucket Client ID, risking unauthorized repository access and potential codebase exposure."
175regex = '''(?i)(?:bitbucket)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
176keywords = [
177    "bitbucket",
178]
179 
180[[rules]]
181id = "bitbucket-client-secret"
182description = "Discovered a potential Bitbucket Client Secret, posing a risk of compromised code repositories and unauthorized access."
183regex = '''(?i)(?:bitbucket)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
184keywords = [
185    "bitbucket",
186]
187 
188[[rules]]
189id = "bittrex-access-key"
190description = "Identified a Bittrex Access Key, which could lead to unauthorized access to cryptocurrency trading accounts and financial loss."
191regex = '''(?i)(?:bittrex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
192keywords = [
193    "bittrex",
194]
195 
196[[rules]]
197id = "bittrex-secret-key"
198description = "Detected a Bittrex Secret Key, potentially compromising cryptocurrency transactions and financial security."
199regex = '''(?i)(?:bittrex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
200keywords = [
201    "bittrex",
202]
203 
204[[rules]]
205id = "clojars-api-token"
206description = "Uncovered a possible Clojars API token, risking unauthorized access to Clojure libraries and potential code manipulation."
207regex = '''(?i)(CLOJARS_)[a-z0-9]{60}'''
208keywords = [
209    "clojars",
210]
211 
212[[rules]]
213id = "cloudflare-api-key"
214description = "Detected a Cloudflare API Key, potentially compromising cloud application deployments and operational security."
215regex = '''(?i)(?:cloudflare)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
216keywords = [
217    "cloudflare",
218]
219 
220[[rules]]
221id = "cloudflare-global-api-key"
222description = "Detected a Cloudflare Global API Key, potentially compromising cloud application deployments and operational security."
223regex = '''(?i)(?:cloudflare)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{37})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
224keywords = [
225    "cloudflare",
226]
227 
228[[rules]]
229id = "cloudflare-origin-ca-key"
230description = "Detected a Cloudflare Origin CA Key, potentially compromising cloud application deployments and operational security."
231regex = '''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
232keywords = [
233    "cloudflare","v1.0-",
234]
235 
236[[rules]]
237id = "codecov-access-token"
238description = "Found a pattern resembling a Codecov Access Token, posing a risk of unauthorized access to code coverage reports and sensitive data."
239regex = '''(?i)(?:codecov)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
240keywords = [
241    "codecov",
242]
243 
244[[rules]]
245id = "coinbase-access-token"
246description = "Detected a Coinbase Access Token, posing a risk of unauthorized access to cryptocurrency accounts and financial transactions."
247regex = '''(?i)(?:coinbase)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
248keywords = [
249    "coinbase",
250]
251 
252[[rules]]
253id = "confluent-access-token"
254description = "Identified a Confluent Access Token, which could compromise access to streaming data platforms and sensitive data flow."
255regex = '''(?i)(?:confluent)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
256keywords = [
257    "confluent",
258]
259 
260[[rules]]
261id = "confluent-secret-key"
262description = "Found a Confluent Secret Key, potentially risking unauthorized operations and data access within Confluent services."
263regex = '''(?i)(?:confluent)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
264keywords = [
265    "confluent",
266]
267 
268[[rules]]
269id = "contentful-delivery-api-token"
270description = "Discovered a Contentful delivery API token, posing a risk to content management systems and data integrity."
271regex = '''(?i)(?:contentful)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{43})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
272keywords = [
273    "contentful",
274]
275 
276[[rules]]
277id = "databricks-api-token"
278description = "Uncovered a Databricks API token, which may compromise big data analytics platforms and sensitive data processing."
279regex = '''(?i)\b(dapi[a-h0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
280keywords = [
281    "dapi",
282]
283 
284[[rules]]
285id = "datadog-access-token"
286description = "Detected a Datadog Access Token, potentially risking monitoring and analytics data exposure and manipulation."
287regex = '''(?i)(?:datadog)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
288keywords = [
289    "datadog",
290]
291 
292[[rules]]
293id = "defined-networking-api-token"
294description = "Identified a Defined Networking API token, which could lead to unauthorized network operations and data breaches."
295regex = '''(?i)(?:dnkey)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(dnkey-[a-z0-9=_\-]{26}-[a-z0-9=_\-]{52})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
296keywords = [
297    "dnkey",
298]
299 
300[[rules]]
301id = "digitalocean-access-token"
302description = "Found a DigitalOcean OAuth Access Token, risking unauthorized cloud resource access and data compromise."
303regex = '''(?i)\b(doo_v1_[a-f0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
304keywords = [
305    "doo_v1_",
306]
307 
308[[rules]]
309id = "digitalocean-pat"
310description = "Discovered a DigitalOcean Personal Access Token, posing a threat to cloud infrastructure security and data privacy."
311regex = '''(?i)\b(dop_v1_[a-f0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
312keywords = [
313    "dop_v1_",
314]
315 
316[[rules]]
317id = "digitalocean-refresh-token"
318description = "Uncovered a DigitalOcean OAuth Refresh Token, which could allow prolonged unauthorized access and resource manipulation."
319regex = '''(?i)\b(dor_v1_[a-f0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
320keywords = [
321    "dor_v1_",
322]
323 
324[[rules]]
325id = "discord-api-token"
326description = "Detected a Discord API key, potentially compromising communication channels and user data privacy on Discord."
327regex = '''(?i)(?:discord)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
328keywords = [
329    "discord",
330]
331 
332[[rules]]
333id = "discord-client-id"
334description = "Identified a Discord client ID, which may lead to unauthorized integrations and data exposure in Discord applications."
335regex = '''(?i)(?:discord)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9]{18})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
336keywords = [
337    "discord",
338]
339 
340[[rules]]
341id = "discord-client-secret"
342description = "Discovered a potential Discord client secret, risking compromised Discord bot integrations and data leaks."
343regex = '''(?i)(?:discord)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
344keywords = [
345    "discord",
346]
347 
348[[rules]]
349id = "doppler-api-token"
350description = "Discovered a Doppler API token, posing a risk to environment and secrets management security."
351regex = '''(dp\.pt\.)(?i)[a-z0-9]{43}'''
352keywords = [
353    "doppler",
354]
355 
356[[rules]]
357id = "droneci-access-token"
358description = "Detected a Droneci Access Token, potentially compromising continuous integration and deployment workflows."
359regex = '''(?i)(?:droneci)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
360keywords = [
361    "droneci",
362]
363 
364[[rules]]
365id = "dropbox-api-token"
366description = "Identified a Dropbox API secret, which could lead to unauthorized file access and data breaches in Dropbox storage."
367regex = '''(?i)(?:dropbox)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{15})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
368keywords = [
369    "dropbox",
370]
371 
372[[rules]]
373id = "dropbox-long-lived-api-token"
374description = "Found a Dropbox long-lived API token, risking prolonged unauthorized access to cloud storage and sensitive data."
375regex = '''(?i)(?:dropbox)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{11}(AAAAAAAAAA)[a-z0-9\-_=]{43})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
376keywords = [
377    "dropbox",
378]
379 
380[[rules]]
381id = "dropbox-short-lived-api-token"
382description = "Discovered a Dropbox short-lived API token, posing a risk of temporary but potentially harmful data access and manipulation."
383regex = '''(?i)(?:dropbox)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(sl\.[a-z0-9\-=_]{135})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
384keywords = [
385    "dropbox",
386]
387 
388[[rules]]
389id = "duffel-api-token"
390description = "Uncovered a Duffel API token, which may compromise travel platform integrations and sensitive customer data."
391regex = '''duffel_(test|live)_(?i)[a-z0-9_\-=]{43}'''
392keywords = [
393    "duffel",
394]
395 
396[[rules]]
397id = "dynatrace-api-token"
398description = "Detected a Dynatrace API token, potentially risking application performance monitoring and data exposure."
399regex = '''dt0c01\.(?i)[a-z0-9]{24}\.[a-z0-9]{64}'''
400keywords = [
401    "dynatrace",
402]
403 
404[[rules]]
405id = "easypost-api-token"
406description = "Identified an EasyPost API token, which could lead to unauthorized postal and shipment service access and data exposure."
407regex = '''\bEZAK(?i)[a-z0-9]{54}'''
408keywords = [
409    "ezak",
410]
411 
412[[rules]]
413id = "easypost-test-api-token"
414description = "Detected an EasyPost test API token, risking exposure of test environments and potentially sensitive shipment data."
415regex = '''\bEZTK(?i)[a-z0-9]{54}'''
416keywords = [
417    "eztk",
418]
419 
420[[rules]]
421id = "etsy-access-token"
422description = "Found an Etsy Access Token, potentially compromising Etsy shop management and customer data."
423regex = '''(?i)(?:etsy)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
424keywords = [
425    "etsy",
426]
427 
428[[rules]]
429id = "facebook-access-token"
430description = "Discovered a Facebook Access Token, posing a risk of unauthorized access to Facebook accounts and personal data exposure."
431regex = '''(?i)\b(\d{15,16}(\||%)[0-9a-z\-_]{27,40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
432 
433[[rules]]
434id = "facebook-page-access-token"
435description = "Discovered a Facebook Page Access Token, posing a risk of unauthorized access to Facebook accounts and personal data exposure."
436regex = '''(?i)\b(EAA[MC][a-z0-9]{20,})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
437keywords = [
438    "eaam","eaac",
439]
440 
441[[rules]]
442id = "facebook-secret"
443description = "Discovered a Facebook Application secret, posing a risk of unauthorized access to Facebook accounts and personal data exposure."
444regex = '''(?i)(?:facebook)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
445keywords = [
446    "facebook",
447]
448 
449[[rules]]
450id = "fastly-api-token"
451description = "Uncovered a Fastly API key, which may compromise CDN and edge cloud services, leading to content delivery and security issues."
452regex = '''(?i)(?:fastly)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
453keywords = [
454    "fastly",
455]
456 
457[[rules]]
458id = "finicity-api-token"
459description = "Detected a Finicity API token, potentially risking financial data access and unauthorized financial operations."
460regex = '''(?i)(?:finicity)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
461keywords = [
462    "finicity",
463]
464 
465[[rules]]
466id = "finicity-client-secret"
467description = "Identified a Finicity Client Secret, which could lead to compromised financial service integrations and data breaches."
468regex = '''(?i)(?:finicity)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
469keywords = [
470    "finicity",
471]
472 
473[[rules]]
474id = "finnhub-access-token"
475description = "Found a Finnhub Access Token, risking unauthorized access to financial market data and analytics."
476regex = '''(?i)(?:finnhub)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
477keywords = [
478    "finnhub",
479]
480 
481[[rules]]
482id = "flickr-access-token"
483description = "Discovered a Flickr Access Token, posing a risk of unauthorized photo management and potential data leakage."
484regex = '''(?i)(?:flickr)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
485keywords = [
486    "flickr",
487]
488 
489[[rules]]
490id = "flutterwave-encryption-key"
491description = "Uncovered a Flutterwave Encryption Key, which may compromise payment processing and sensitive financial information."
492regex = '''FLWSECK_TEST-(?i)[a-h0-9]{12}'''
493keywords = [
494    "flwseck_test",
495]
496 
497[[rules]]
498id = "flutterwave-public-key"
499description = "Detected a Finicity Public Key, potentially exposing public cryptographic operations and integrations."
500regex = '''FLWPUBK_TEST-(?i)[a-h0-9]{32}-X'''
501keywords = [
502    "flwpubk_test",
503]
504 
505[[rules]]
506id = "flutterwave-secret-key"
507description = "Identified a Flutterwave Secret Key, risking unauthorized financial transactions and data breaches."
508regex = '''FLWSECK_TEST-(?i)[a-h0-9]{32}-X'''
509keywords = [
510    "flwseck_test",
511]
512 
513[[rules]]
514id = "frameio-api-token"
515description = "Found a Frame.io API token, potentially compromising video collaboration and project management."
516regex = '''fio-u-(?i)[a-z0-9\-_=]{64}'''
517keywords = [
518    "fio-u-",
519]
520 
521[[rules]]
522id = "freshbooks-access-token"
523description = "Discovered a Freshbooks Access Token, posing a risk to accounting software access and sensitive financial data exposure."
524regex = '''(?i)(?:freshbooks)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
525keywords = [
526    "freshbooks",
527]
528 
529[[rules]]
530id = "gcp-api-key"
531description = "Uncovered a GCP API key, which could lead to unauthorized access to Google Cloud services and data breaches."
532regex = '''(?i)\b(AIza[0-9A-Za-z\\-_]{35})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
533keywords = [
534    "aiza",
535]
536 
537[[rules]]
538id = "generic-api-key"
539description = "Detected a Generic API Key, potentially exposing access to various services and sensitive operations."
540regex = '''(?i)(?:key|api|token|secret|client|passwd|password|auth|access)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
541entropy = 3.5
542keywords = [
543    "key","api","token","secret","client","passwd","password","auth","access",
544]
545 
546[rules.allowlist]
547stopwords = [
548    "000000",
549    "aaaaaa",
550    "about",
551    "abstract",
552    "academy",
553    "acces",
554    "account",
555    "act-",
556    "act.",
557    "act_",
558    "action",
559    "active",
560    "actively",
561    "activity",
562    "adapter",
563    "add-",
564    "add.",
565    "add_",
566    "add-on",
567    "addon",
568    "addres",
569    "admin",
570    "adobe",
571    "advanced",
572    "adventure",
573    "agent",
574    "agile",
575    "air-",
576    "air.",
577    "air_",
578    "ajax",
579    "akka",
580    "alert",
581    "alfred",
582    "algorithm",
583    "all-",
584    "all.",
585    "all_",
586    "alloy",
587    "alpha",
588    "amazon",
589    "amqp",
590    "analysi",
591    "analytic",
592    "analyzer",
593    "android",
594    "angular",
595    "angularj",
596    "animate",
597    "animation",
598    "another",
599    "ansible",
600    "answer",
601    "ant-",
602    "ant.",
603    "ant_",
604    "any-",
605    "any.",
606    "any_",
607    "apache",
608    "app-",
609    "app-",
610    "app.",
611    "app.",
612    "app_",
613    "app_",
614    "apple",
615    "arch",
616    "archive",
617    "archived",
618    "arduino",
619    "array",
620    "art-",
621    "art.",
622    "art_",
623    "article",
624    "asp-",
625    "asp.",
626    "asp_",
627    "asset",
628    "async",
629    "atom",
630    "attention",
631    "audio",
632    "audit",
633    "aura",
634    "auth",
635    "author",
636    "author",
637    "authorize",
638    "auto",
639    "automated",
640    "automatic",
641    "awesome",
642    "aws_",
643    "azure",
644    "back",
645    "backbone",
646    "backend",
647    "backup",
648    "bar-",
649    "bar.",
650    "bar_",
651    "base",
652    "based",
653    "bash",
654    "basic",
655    "batch",
656    "been",
657    "beer",
658    "behavior",
659    "being",
660    "benchmark",
661    "best",
662    "beta",
663    "better",
664    "big-",
665    "big.",
666    "big_",
667    "binary",
668    "binding",
669    "bit-",
670    "bit.",
671    "bit_",
672    "bitcoin",
673    "block",
674    "blog",
675    "board",
676    "book",
677    "bookmark",
678    "boost",
679    "boot",
680    "bootstrap",
681    "bosh",
682    "bot-",
683    "bot.",
684    "bot_",
685    "bower",
686    "box-",
687    "box.",
688    "box_",
689    "boxen",
690    "bracket",
691    "branch",
692    "bridge",
693    "browser",
694    "brunch",
695    "buffer",
696    "bug-",
697    "bug.",
698    "bug_",
699    "build",
700    "builder",
701    "building",
702    "buildout",
703    "buildpack",
704    "built",
705    "bundle",
706    "busines",
707    "but-",
708    "but.",
709    "but_",
710    "button",
711    "cache",
712    "caching",
713    "cakephp",
714    "calendar",
715    "call",
716    "camera",
717    "campfire",
718    "can-",
719    "can.",
720    "can_",
721    "canva",
722    "captcha",
723    "capture",
724    "card",
725    "carousel",
726    "case",
727    "cassandra",
728    "cat-",
729    "cat.",
730    "cat_",
731    "category",
732    "center",
733    "cento",
734    "challenge",
735    "change",
736    "changelog",
737    "channel",
738    "chart",
739    "chat",
740    "cheat",
741    "check",
742    "checker",
743    "chef",
744    "ches",
745    "chinese",
746    "chosen",
747    "chrome",
748    "ckeditor",
749    "clas",
750    "classe",
751    "classic",
752    "clean",
753    "cli-",
754    "cli.",
755    "cli_",
756    "client",
757    "client",
758    "clojure",
759    "clone",
760    "closure",
761    "cloud",
762    "club",
763    "cluster",
764    "cms-",
765    "cms_",
766    "coco",
767    "code",
768    "coding",
769    "coffee",
770    "color",
771    "combination",
772    "combo",
773    "command",
774    "commander",
775    "comment",
776    "commit",
777    "common",
778    "community",
779    "compas",
780    "compiler",
781    "complete",
782    "component",
783    "composer",
784    "computer",
785    "computing",
786    "con-",
787    "con.",
788    "con_",
789    "concept",
790    "conf",
791    "config",
792    "config",
793    "connect",
794    "connector",
795    "console",
796    "contact",
797    "container",
798    "contao",
799    "content",
800    "contest",
801    "context",
802    "control",
803    "convert",
804    "converter",
805    "conway'",
806    "cookbook",
807    "cookie",
808    "cool",
809    "copy",
810    "cordova",
811    "core",
812    "couchbase",
813    "couchdb",
814    "countdown",
815    "counter",
816    "course",
817    "craft",
818    "crawler",
819    "create",
820    "creating",
821    "creator",
822    "credential",
823    "crm-",
824    "crm.",
825    "crm_",
826    "cros",
827    "crud",
828    "csv-",
829    "csv.",
830    "csv_",
831    "cube",
832    "cucumber",
833    "cuda",
834    "current",
835    "currently",
836    "custom",
837    "daemon",
838    "dark",
839    "dart",
840    "dash",
841    "dashboard",
842    "data",
843    "database",
844    "date",
845    "day-",
846    "day.",
847    "day_",
848    "dead",
849    "debian",
850    "debug",
851    "debug",
852    "debugger",
853    "deck",
854    "define",
855    "del-",
856    "del.",
857    "del_",
858    "delete",
859    "demo",
860    "deploy",
861    "design",
862    "designer",
863    "desktop",
864    "detection",
865    "detector",
866    "dev-",
867    "dev.",
868    "dev_",
869    "develop",
870    "developer",
871    "device",
872    "devise",
873    "diff",
874    "digital",
875    "directive",
876    "directory",
877    "discovery",
878    "display",
879    "django",
880    "dns-",
881    "dns_",
882    "doc-",
883    "doc-",
884    "doc.",
885    "doc.",
886    "doc_",
887    "doc_",
888    "docker",
889    "docpad",
890    "doctrine",
891    "document",
892    "doe-",
893    "doe.",
894    "doe_",
895    "dojo",
896    "dom-",
897    "dom.",
898    "dom_",
899    "domain",
900    "done",
901    "don't",
902    "dot-",
903    "dot.",
904    "dot_",
905    "dotfile",
906    "download",
907    "draft",
908    "drag",
909    "drill",
910    "drive",
911    "driven",
912    "driver",
913    "drop",
914    "dropbox",
915    "drupal",
916    "dsl-",
917    "dsl.",
918    "dsl_",
919    "dynamic",
920    "easy",
921    "_ec2_",
922    "ecdsa",
923    "eclipse",
924    "edit",
925    "editing",
926    "edition",
927    "editor",
928    "element",
929    "emac",
930    "email",
931    "embed",
932    "embedded",
933    "ember",
934    "emitter",
935    "emulator",
936    "encoding",
937    "endpoint",
938    "engine",
939    "english",
940    "enhanced",
941    "entity",
942    "entry",
943    "env_",
944    "episode",
945    "erlang",
946    "error",
947    "espresso",
948    "event",
949    "evented",
950    "example",
951    "example",
952    "exchange",
953    "exercise",
954    "experiment",
955    "expire",
956    "exploit",
957    "explorer",
958    "export",
959    "exporter",
960    "expres",
961    "ext-",
962    "ext.",
963    "ext_",
964    "extended",
965    "extension",
966    "external",
967    "extra",
968    "extractor",
969    "fabric",
970    "facebook",
971    "factory",
972    "fake",
973    "fast",
974    "feature",
975    "feed",
976    "fewfwef",
977    "ffmpeg",
978    "field",
979    "file",
980    "filter",
981    "find",
982    "finder",
983    "firefox",
984    "firmware",
985    "first",
986    "fish",
987    "fix-",
988    "fix_",
989    "flash",
990    "flask",
991    "flat",
992    "flex",
993    "flexible",
994    "flickr",
995    "flow",
996    "fluent",
997    "fluentd",
998    "fluid",
999    "folder",
1000    "font",
1001    "force",
1002    "foreman",
1003    "fork",
1004    "form",
1005    "format",
1006    "formatter",
1007    "forum",
1008    "foundry",
1009    "framework",
1010    "free",
1011    "friend",
1012    "friendly",
1013    "front-end",
1014    "frontend",
1015    "ftp-",
1016    "ftp.",
1017    "ftp_",
1018    "fuel",
1019    "full",
1020    "fun-",
1021    "fun.",
1022    "fun_",
1023    "func",
1024    "future",
1025    "gaia",
1026    "gallery",
1027    "game",
1028    "gateway",
1029    "gem-",
1030    "gem.",
1031    "gem_",
1032    "gen-",
1033    "gen.",
1034    "gen_",
1035    "general",
1036    "generator",
1037    "generic",
1038    "genetic",
1039    "get-",
1040    "get.",
1041    "get_",
1042    "getenv",
1043    "getting",
1044    "ghost",
1045    "gist",
1046    "git-",
1047    "git.",
1048    "git_",
1049    "github",
1050    "gitignore",
1051    "gitlab",
1052    "glas",
1053    "gmail",
1054    "gnome",
1055    "gnu-",
1056    "gnu.",
1057    "gnu_",
1058    "goal",
1059    "golang",
1060    "gollum",
1061    "good",
1062    "google",
1063    "gpu-",
1064    "gpu.",
1065    "gpu_",
1066    "gradle",
1067    "grail",
1068    "graph",
1069    "graphic",
1070    "great",
1071    "grid",
1072    "groovy",
1073    "group",
1074    "grunt",
1075    "guard",
1076    "gui-",
1077    "gui.",
1078    "gui_",
1079    "guide",
1080    "guideline",
1081    "gulp",
1082    "gwt-",
1083    "gwt.",
1084    "gwt_",
1085    "hack",
1086    "hackathon",
1087    "hacker",
1088    "hacking",
1089    "hadoop",
1090    "haml",
1091    "handler",
1092    "hardware",
1093    "has-",
1094    "has_",
1095    "hash",
1096    "haskell",
1097    "have",
1098    "haxe",
1099    "hello",
1100    "help",
1101    "helper",
1102    "here",
1103    "hero",
1104    "heroku",
1105    "high",
1106    "hipchat",
1107    "history",
1108    "home",
1109    "homebrew",
1110    "homepage",
1111    "hook",
1112    "host",
1113    "hosting",
1114    "hot-",
1115    "hot.",
1116    "hot_",
1117    "house",
1118    "how-",
1119    "how.",
1120    "how_",
1121    "html",
1122    "http",
1123    "hub-",
1124    "hub.",
1125    "hub_",
1126    "hubot",
1127    "human",
1128    "icon",
1129    "ide-",
1130    "ide.",
1131    "ide_",
1132    "idea",
1133    "identity",
1134    "idiomatic",
1135    "image",
1136    "impact",
1137    "import",
1138    "important",
1139    "importer",
1140    "impres",
1141    "index",
1142    "infinite",
1143    "info",
1144    "injection",
1145    "inline",
1146    "input",
1147    "inside",
1148    "inspector",
1149    "instagram",
1150    "install",
1151    "installer",
1152    "instant",
1153    "intellij",
1154    "interface",
1155    "internet",
1156    "interview",
1157    "into",
1158    "intro",
1159    "ionic",
1160    "iphone",
1161    "ipython",
1162    "irc-",
1163    "irc_",
1164    "iso-",
1165    "iso.",
1166    "iso_",
1167    "issue",
1168    "jade",
1169    "jasmine",
1170    "java",
1171    "jbos",
1172    "jekyll",
1173    "jenkin",
1174    "job-",
1175    "job.",
1176    "job_",
1177    "joomla",
1178    "jpa-",
1179    "jpa.",
1180    "jpa_",
1181    "jquery",
1182    "json",
1183    "just",
1184    "kafka",
1185    "karma",
1186    "kata",
1187    "kernel",
1188    "keyboard",
1189    "kindle",
1190    "kit-",
1191    "kit.",
1192    "kit_",
1193    "kitchen",
1194    "knife",
1195    "koan",
1196    "kohana",
1197    "lab-",
1198    "lab-",
1199    "lab.",
1200    "lab.",
1201    "lab_",
1202    "lab_",
1203    "lambda",
1204    "lamp",
1205    "language",
1206    "laravel",
1207    "last",
1208    "latest",
1209    "latex",
1210    "launcher",
1211    "layer",
1212    "layout",
1213    "lazy",
1214    "ldap",
1215    "leaflet",
1216    "league",
1217    "learn",
1218    "learning",
1219    "led-",
1220    "led.",
1221    "led_",
1222    "leetcode",
1223    "les-",
1224    "les.",
1225    "les_",
1226    "level",
1227    "leveldb",
1228    "lib-",
1229    "lib.",
1230    "lib_",
1231    "librarie",
1232    "library",
1233    "license",
1234    "life",
1235    "liferay",
1236    "light",
1237    "lightbox",
1238    "like",
1239    "line",
1240    "link",
1241    "linked",
1242    "linkedin",
1243    "linux",
1244    "lisp",
1245    "list",
1246    "lite",
1247    "little",
1248    "load",
1249    "loader",
1250    "local",
1251    "location",
1252    "lock",
1253    "log-",
1254    "log.",
1255    "log_",
1256    "logger",
1257    "logging",
1258    "logic",
1259    "login",
1260    "logstash",
1261    "longer",
1262    "look",
1263    "love",
1264    "lua-",
1265    "lua.",
1266    "lua_",
1267    "mac-",
1268    "mac.",
1269    "mac_",
1270    "machine",
1271    "made",
1272    "magento",
1273    "magic",
1274    "mail",
1275    "make",
1276    "maker",
1277    "making",
1278    "man-",
1279    "man.",
1280    "man_",
1281    "manage",
1282    "manager",
1283    "manifest",
1284    "manual",
1285    "map-",
1286    "map-",
1287    "map.",
1288    "map.",
1289    "map_",
1290    "map_",
1291    "mapper",
1292    "mapping",
1293    "markdown",
1294    "markup",
1295    "master",
1296    "math",
1297    "matrix",
1298    "maven",
1299    "md5",
1300    "mean",
1301    "media",
1302    "mediawiki",
1303    "meetup",
1304    "memcached",
1305    "memory",
1306    "menu",
1307    "merchant",
1308    "message",
1309    "messaging",
1310    "meta",
1311    "metadata",
1312    "meteor",
1313    "method",
1314    "metric",
1315    "micro",
1316    "middleman",
1317    "migration",
1318    "minecraft",
1319    "miner",
1320    "mini",
1321    "minimal",
1322    "mirror",
1323    "mit-",
1324    "mit.",
1325    "mit_",
1326    "mobile",
1327    "mocha",
1328    "mock",
1329    "mod-",
1330    "mod.",
1331    "mod_",
1332    "mode",
1333    "model",
1334    "modern",
1335    "modular",
1336    "module",
1337    "modx",
1338    "money",
1339    "mongo",
1340    "mongodb",
1341    "mongoid",
1342    "mongoose",
1343    "monitor",
1344    "monkey",
1345    "more",
1346    "motion",
1347    "moved",
1348    "movie",
1349    "mozilla",
1350    "mqtt",
1351    "mule",
1352    "multi",
1353    "multiple",
1354    "music",
1355    "mustache",
1356    "mvc-",
1357    "mvc.",
1358    "mvc_",
1359    "mysql",
1360    "nagio",
1361    "name",
1362    "native",
1363    "need",
1364    "neo-",
1365    "neo.",
1366    "neo_",
1367    "nest",
1368    "nested",
1369    "net-",
1370    "net.",
1371    "net_",
1372    "nette",
1373    "network",
1374    "new-",
1375    "new-",
1376    "new.",
1377    "new.",
1378    "new_",
1379    "new_",
1380    "next",
1381    "nginx",
1382    "ninja",
1383    "nlp-",
1384    "nlp.",
1385    "nlp_",
1386    "node",
1387    "nodej",
1388    "nosql",
1389    "not-",
1390    "not.",
1391    "not_",
1392    "note",
1393    "notebook",
1394    "notepad",
1395    "notice",
1396    "notifier",
1397    "now-",
1398    "now.",
1399    "now_",
1400    "number",
1401    "oauth",
1402    "object",
1403    "objective",
1404    "obsolete",
1405    "ocaml",
1406    "octopres",
1407    "official",
1408    "old-",
1409    "old.",
1410    "old_",
1411    "onboard",
1412    "online",
1413    "only",
1414    "open",
1415    "opencv",
1416    "opengl",
1417    "openshift",
1418    "openwrt",
1419    "option",
1420    "oracle",
1421    "org-",
1422    "org.",
1423    "org_",
1424    "origin",
1425    "original",
1426    "orm-",
1427    "orm.",
1428    "orm_",
1429    "osx-",
1430    "osx_",
1431    "our-",
1432    "our.",
1433    "our_",
1434    "out-",
1435    "out.",
1436    "out_",
1437    "output",
1438    "over",
1439    "overview",
1440    "own-",
1441    "own.",
1442    "own_",
1443    "pack",
1444    "package",
1445    "packet",
1446    "page",
1447    "page",
1448    "panel",
1449    "paper",
1450    "paperclip",
1451    "para",
1452    "parallax",
1453    "parallel",
1454    "parse",
1455    "parser",
1456    "parsing",
1457    "particle",
1458    "party",
1459    "password",
1460    "patch",
1461    "path",
1462    "pattern",
1463    "payment",
1464    "paypal",
1465    "pdf-",
1466    "pdf.",
1467    "pdf_",
1468    "pebble",
1469    "people",
1470    "perl",
1471    "personal",
1472    "phalcon",
1473    "phoenix",
1474    "phone",
1475    "phonegap",
1476    "photo",
1477    "php-",
1478    "php.",
1479    "php_",
1480    "physic",
1481    "picker",
1482    "pipeline",
1483    "platform",
1484    "play",
1485    "player",
1486    "please",
1487    "plu-",
1488    "plu.",
1489    "plu_",
1490    "plug-in",
1491    "plugin",
1492    "plupload",
1493    "png-",
1494    "png.",
1495    "png_",
1496    "poker",
1497    "polyfill",
1498    "polymer",
1499    "pool",
1500    "pop-",
1501    "pop.",
1502    "pop_",
1503    "popcorn",
1504    "popup",
1505    "port",
1506    "portable",
1507    "portal",
1508    "portfolio",
1509    "post",
1510    "power",
1511    "powered",
1512    "powerful",
1513    "prelude",
1514    "pretty",
1515    "preview",
1516    "principle",
1517    "print",
1518    "pro-",
1519    "pro.",
1520    "pro_",
1521    "problem",
1522    "proc",
1523    "product",
1524    "profile",
1525    "profiler",
1526    "program",
1527    "progres",
1528    "project",
1529    "protocol",
1530    "prototype",
1531    "provider",
1532    "proxy",
1533    "public",
1534    "pull",
1535    "puppet",
1536    "pure",
1537    "purpose",
1538    "push",
1539    "pusher",
1540    "pyramid",
1541    "python",
1542    "quality",
1543    "query",
1544    "queue",
1545    "quick",
1546    "rabbitmq",
1547    "rack",
1548    "radio",
1549    "rail",
1550    "railscast",
1551    "random",
1552    "range",
1553    "raspberry",
1554    "rdf-",
1555    "rdf.",
1556    "rdf_",
1557    "react",
1558    "reactive",
1559    "read",
1560    "reader",
1561    "readme",
1562    "ready",
1563    "real",
1564    "reality",
1565    "real-time",
1566    "realtime",
1567    "recipe",
1568    "recorder",
1569    "red-",
1570    "red.",
1571    "red_",
1572    "reddit",
1573    "redi",
1574    "redmine",
1575    "reference",
1576    "refinery",
1577    "refresh",
1578    "registry",
1579    "related",
1580    "release",
1581    "remote",
1582    "rendering",
1583    "repo",
1584    "report",
1585    "request",
1586    "require",
1587    "required",
1588    "requirej",
1589    "research",
1590    "resource",
1591    "response",
1592    "resque",
1593    "rest",
1594    "restful",
1595    "resume",
1596    "reveal",
1597    "reverse",
1598    "review",
1599    "riak",
1600    "rich",
1601    "right",
1602    "ring",
1603    "robot",
1604    "role",
1605    "room",
1606    "router",
1607    "routing",
1608    "rpc-",
1609    "rpc.",
1610    "rpc_",
1611    "rpg-",
1612    "rpg.",
1613    "rpg_",
1614    "rspec",
1615    "ruby-",
1616    "ruby.",
1617    "ruby_",
1618    "rule",
1619    "run-",
1620    "run.",
1621    "run_",
1622    "runner",
1623    "running",
1624    "runtime",
1625    "rust",
1626    "rvm-",
1627    "rvm.",
1628    "rvm_",
1629    "salt",
1630    "sample",
1631    "sample",
1632    "sandbox",
1633    "sas-",
1634    "sas.",
1635    "sas_",
1636    "sbt-",
1637    "sbt.",
1638    "sbt_",
1639    "scala",
1640    "scalable",
1641    "scanner",
1642    "schema",
1643    "scheme",
1644    "school",
1645    "science",
1646    "scraper",
1647    "scratch",
1648    "screen",
1649    "script",
1650    "scroll",
1651    "scs-",
1652    "scs.",
1653    "scs_",
1654    "sdk-",
1655    "sdk.",
1656    "sdk_",
1657    "sdl-",
1658    "sdl.",
1659    "sdl_",
1660    "search",
1661    "secure",
1662    "security",
1663    "see-",
1664    "see.",
1665    "see_",
1666    "seed",
1667    "select",
1668    "selector",
1669    "selenium",
1670    "semantic",
1671    "sencha",
1672    "send",
1673    "sentiment",
1674    "serie",
1675    "server",
1676    "service",
1677    "session",
1678    "set-",
1679    "set.",
1680    "set_",
1681    "setting",
1682    "setting",
1683    "setup",
1684    "sha1",
1685    "sha2",
1686    "sha256",
1687    "share",
1688    "shared",
1689    "sharing",
1690    "sheet",
1691    "shell",
1692    "shield",
1693    "shipping",
1694    "shop",
1695    "shopify",
1696    "shortener",
1697    "should",
1698    "show",
1699    "showcase",
1700    "side",
1701    "silex",
1702    "simple",
1703    "simulator",
1704    "single",
1705    "site",
1706    "skeleton",
1707    "sketch",
1708    "skin",
1709    "slack",
1710    "slide",
1711    "slider",
1712    "slim",
1713    "small",
1714    "smart",
1715    "smtp",
1716    "snake",
1717    "snippet",
1718    "soap",
1719    "social",
1720    "socket",
1721    "software",
1722    "solarized",
1723    "solr",
1724    "solution",
1725    "solver",
1726    "some",
1727    "soon",
1728    "source",
1729    "space",
1730    "spark",
1731    "spatial",
1732    "spec",
1733    "sphinx",
1734    "spine",
1735    "spotify",
1736    "spree",
1737    "spring",
1738    "sprite",
1739    "sql-",
1740    "sql.",
1741    "sql_",
1742    "sqlite",
1743    "ssh-",
1744    "ssh.",
1745    "ssh_",
1746    "stack",
1747    "staging",
1748    "standard",
1749    "stanford",
1750    "start",
1751    "started",
1752    "starter",
1753    "startup",
1754    "stat",
1755    "statamic",
1756    "state",
1757    "static",
1758    "statistic",
1759    "statsd",
1760    "statu",
1761    "steam",
1762    "step",
1763    "still",
1764    "stm-",
1765    "stm.",
1766    "stm_",
1767    "storage",
1768    "store",
1769    "storm",
1770    "story",
1771    "strategy",
1772    "stream",
1773    "streaming",
1774    "string",
1775    "stripe",
1776    "structure",
1777    "studio",
1778    "study",
1779    "stuff",
1780    "style",
1781    "sublime",
1782    "sugar",
1783    "suite",
1784    "summary",
1785    "super",
1786    "support",
1787    "supported",
1788    "svg-",
1789    "svg.",
1790    "svg_",
1791    "svn-",
1792    "svn.",
1793    "svn_",
1794    "swagger",
1795    "swift",
1796    "switch",
1797    "switcher",
1798    "symfony",
1799    "symphony",
1800    "sync",
1801    "synopsi",
1802    "syntax",
1803    "system",
1804    "system",
1805    "tab-",
1806    "tab-",
1807    "tab.",
1808    "tab.",
1809    "tab_",
1810    "tab_",
1811    "table",
1812    "tag-",
1813    "tag-",
1814    "tag.",
1815    "tag.",
1816    "tag_",
1817    "tag_",
1818    "talk",
1819    "target",
1820    "task",
1821    "tcp-",
1822    "tcp.",
1823    "tcp_",
1824    "tdd-",
1825    "tdd.",
1826    "tdd_",
1827    "team",
1828    "tech",
1829    "template",
1830    "term",
1831    "terminal",
1832    "testing",
1833    "tetri",
1834    "text",
1835    "textmate",
1836    "theme",
1837    "theory",
1838    "three",
1839    "thrift",
1840    "time",
1841    "timeline",
1842    "timer",
1843    "tiny",
1844    "tinymce",
1845    "tip-",
1846    "tip.",
1847    "tip_",
1848    "title",
1849    "todo",
1850    "todomvc",
1851    "token",
1852    "tool",
1853    "toolbox",
1854    "toolkit",
1855    "top-",
1856    "top.",
1857    "top_",
1858    "tornado",
1859    "touch",
1860    "tower",
1861    "tracker",
1862    "tracking",
1863    "traffic",
1864    "training",
1865    "transfer",
1866    "translate",
1867    "transport",
1868    "tree",
1869    "trello",
1870    "try-",
1871    "try.",
1872    "try_",
1873    "tumblr",
1874    "tut-",
1875    "tut.",
1876    "tut_",
1877    "tutorial",
1878    "tweet",
1879    "twig",
1880    "twitter",
1881    "type",
1882    "typo",
1883    "ubuntu",
1884    "uiview",
1885    "ultimate",
1886    "under",
1887    "unit",
1888    "unity",
1889    "universal",
1890    "unix",
1891    "update",
1892    "updated",
1893    "upgrade",
1894    "upload",
1895    "uploader",
1896    "uri-",
1897    "uri.",
1898    "uri_",
1899    "url-",
1900    "url.",
1901    "url_",
1902    "usage",
1903    "usb-",
1904    "usb.",
1905    "usb_",
1906    "use-",
1907    "use.",
1908    "use_",
1909    "used",
1910    "useful",
1911    "user",
1912    "using",
1913    "util",
1914    "utilitie",
1915    "utility",
1916    "vagrant",
1917    "validator",
1918    "value",
1919    "variou",
1920    "varnish",
1921    "version",
1922    "via-",
1923    "via.",
1924    "via_",
1925    "video",
1926    "view",
1927    "viewer",
1928    "vim-",
1929    "vim.",
1930    "vim_",
1931    "vimrc",
1932    "virtual",
1933    "vision",
1934    "visual",
1935    "vpn",
1936    "want",
1937    "warning",
1938    "watch",
1939    "watcher",
1940    "wave",
1941    "way-",
1942    "way.",
1943    "way_",
1944    "weather",
1945    "web-",
1946    "web_",
1947    "webapp",
1948    "webgl",
1949    "webhook",
1950    "webkit",
1951    "webrtc",
1952    "website",
1953    "websocket",
1954    "welcome",
1955    "welcome",
1956    "what",
1957    "what'",
1958    "when",
1959    "where",
1960    "which",
1961    "why-",
1962    "why.",
1963    "why_",
1964    "widget",
1965    "wifi",
1966    "wiki",
1967    "win-",
1968    "win.",
1969    "win_",
1970    "window",
1971    "wip-",
1972    "wip.",
1973    "wip_",
1974    "within",
1975    "without",
1976    "wizard",
1977    "word",
1978    "wordpres",
1979    "work",
1980    "worker",
1981    "workflow",
1982    "working",
1983    "workshop",
1984    "world",
1985    "wrapper",
1986    "write",
1987    "writer",
1988    "writing",
1989    "written",
1990    "www-",
1991    "www.",
1992    "www_",
1993    "xamarin",
1994    "xcode",
1995    "xml-",
1996    "xml.",
1997    "xml_",
1998    "xmpp",
1999    "xxxxxx",
2000    "yahoo",
2001    "yaml",
2002    "yandex",
2003    "yeoman",
2004    "yet-",
2005    "yet.",
2006    "yet_",
2007    "yii-",
2008    "yii.",
2009    "yii_",
2010    "youtube",
2011    "yui-",
2012    "yui.",
2013    "yui_",
2014    "zend",
2015    "zero",
2016    "zip-",
2017    "zip.",
2018    "zip_",
2019    "zsh-",
2020    "zsh.",
2021    "zsh_",
2022]
2023 
2024[[rules]]
2025id = "github-app-token"
2026description = "Identified a GitHub App Token, which may compromise GitHub application integrations and source code security."
2027regex = '''(ghu|ghs)_[0-9a-zA-Z]{36}'''
2028keywords = [
2029    "ghu_","ghs_",
2030]
2031 
2032[[rules]]
2033id = "github-fine-grained-pat"
2034description = "Found a GitHub Fine-Grained Personal Access Token, risking unauthorized repository access and code manipulation."
2035regex = '''github_pat_[0-9a-zA-Z_]{82}'''
2036keywords = [
2037    "github_pat_",
2038]
2039 
2040[[rules]]
2041id = "github-oauth"
2042description = "Discovered a GitHub OAuth Access Token, posing a risk of compromised GitHub account integrations and data leaks."
2043regex = '''gho_[0-9a-zA-Z]{36}'''
2044keywords = [
2045    "gho_",
2046]
2047 
2048[[rules]]
2049id = "github-pat"
2050description = "Uncovered a GitHub Personal Access Token, potentially leading to unauthorized repository access and sensitive content exposure."
2051regex = '''ghp_[0-9a-zA-Z]{36}'''
2052keywords = [
2053    "ghp_",
2054]
2055 
2056[[rules]]
2057id = "github-refresh-token"
2058description = "Detected a GitHub Refresh Token, which could allow prolonged unauthorized access to GitHub services."
2059regex = '''ghr_[0-9a-zA-Z]{36}'''
2060keywords = [
2061    "ghr_",
2062]
2063 
2064[[rules]]
2065id = "gitlab-pat"
2066description = "Identified a GitLab Personal Access Token, risking unauthorized access to GitLab repositories and codebase exposure."
2067regex = '''glpat-[0-9a-zA-Z\-\_]{20}'''
2068keywords = [
2069    "glpat-",
2070]
2071 
2072[[rules]]
2073id = "gitlab-ptt"
2074description = "Found a GitLab Pipeline Trigger Token, potentially compromising continuous integration workflows and project security."
2075regex = '''glptt-[0-9a-f]{40}'''
2076keywords = [
2077    "glptt-",
2078]
2079 
2080[[rules]]
2081id = "gitlab-rrt"
2082description = "Discovered a GitLab Runner Registration Token, posing a risk to CI/CD pipeline integrity and unauthorized access."
2083regex = '''GR1348941[0-9a-zA-Z\-\_]{20}'''
2084keywords = [
2085    "gr1348941",
2086]
2087 
2088[[rules]]
2089id = "gitter-access-token"
2090description = "Uncovered a Gitter Access Token, which may lead to unauthorized access to chat and communication services."
2091regex = '''(?i)(?:gitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2092keywords = [
2093    "gitter",
2094]
2095 
2096[[rules]]
2097id = "gocardless-api-token"
2098description = "Detected a GoCardless API token, potentially risking unauthorized direct debit payment operations and financial data exposure."
2099regex = '''(?i)(?:gocardless)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(live_(?i)[a-z0-9\-_=]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2100keywords = [
2101    "live_","gocardless",
2102]
2103 
2104[[rules]]
2105id = "grafana-api-key"
2106description = "Identified a Grafana API key, which could compromise monitoring dashboards and sensitive data analytics."
2107regex = '''(?i)\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,2})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2108keywords = [
2109    "eyjrijoi",
2110]
2111 
2112[[rules]]
2113id = "grafana-cloud-api-token"
2114description = "Found a Grafana cloud API token, risking unauthorized access to cloud-based monitoring services and data exposure."
2115regex = '''(?i)\b(glc_[A-Za-z0-9+/]{32,400}={0,2})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2116keywords = [
2117    "glc_",
2118]
2119 
2120[[rules]]
2121id = "grafana-service-account-token"
2122description = "Discovered a Grafana service account token, posing a risk of compromised monitoring services and data integrity."
2123regex = '''(?i)\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2124keywords = [
2125    "glsa_",
2126]
2127 
2128[[rules]]
2129id = "hashicorp-tf-api-token"
2130description = "Uncovered a HashiCorp Terraform user/org API token, which may lead to unauthorized infrastructure management and security breaches."
2131regex = '''(?i)[a-z0-9]{14}\.atlasv1\.[a-z0-9\-_=]{60,70}'''
2132keywords = [
2133    "atlasv1",
2134]
2135 
2136[[rules]]
2137id = "hashicorp-tf-password"
2138description = "Identified a HashiCorp Terraform password field, risking unauthorized infrastructure configuration and security breaches."
2139regex = '''(?i)(?:administrator_login_password|password)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}("[a-z0-9=_\-]{8,20}")(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2140path = '''\.(tf|hcl)$'''
2141keywords = [
2142    "administrator_login_password","password",
2143]
2144 
2145[[rules]]
2146id = "heroku-api-key"
2147description = "Detected a Heroku API Key, potentially compromising cloud application deployments and operational security."
2148regex = '''(?i)(?:heroku)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2149keywords = [
2150    "heroku",
2151]
2152 
2153[[rules]]
2154id = "hubspot-api-key"
2155description = "Found a HubSpot API Token, posing a risk to CRM data integrity and unauthorized marketing operations."
2156regex = '''(?i)(?:hubspot)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2157keywords = [
2158    "hubspot",
2159]
2160 
2161[[rules]]
2162id = "huggingface-access-token"
2163description = "Discovered a Hugging Face Access token, which could lead to unauthorized access to AI models and sensitive data."
2164regex = '''(?:^|[\\'"` >=:])(hf_[a-zA-Z]{34})(?:$|[\\'"` <])'''
2165entropy = 1
2166keywords = [
2167    "hf_",
2168]
2169 
2170[[rules]]
2171id = "huggingface-organization-api-token"
2172description = "Uncovered a Hugging Face Organization API token, potentially compromising AI organization accounts and associated data."
2173regex = '''(?:^|[\\'"` >=:\(,)])(api_org_[a-zA-Z]{34})(?:$|[\\'"` <\),])'''
2174entropy = 2
2175keywords = [
2176    "api_org_",
2177]
2178 
2179[[rules]]
2180id = "infracost-api-token"
2181description = "Detected an Infracost API Token, risking unauthorized access to cloud cost estimation tools and financial data."
2182regex = '''(?i)\b(ico-[a-zA-Z0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2183keywords = [
2184    "ico-",
2185]
2186 
2187[[rules]]
2188id = "intercom-api-key"
2189description = "Identified an Intercom API Token, which could compromise customer communication channels and data privacy."
2190regex = '''(?i)(?:intercom)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{60})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2191keywords = [
2192    "intercom",
2193]
2194 
2195[[rules]]
2196id = "intra42-client-secret"
2197description = "Found a Intra42 client secret, which could lead to unauthorized access to the 42School API and sensitive data."
2198regex = '''(?i)\b(s-s4t2(?:ud|af)-[abcdef0123456789]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2199keywords = [
2200    "intra","s-s4t2ud-","s-s4t2af-",
2201]
2202 
2203[[rules]]
2204id = "jfrog-api-key"
2205description = "Found a JFrog API Key, posing a risk of unauthorized access to software artifact repositories and build pipelines."
2206regex = '''(?i)(?:jfrog|artifactory|bintray|xray)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{73})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2207keywords = [
2208    "jfrog","artifactory","bintray","xray",
2209]
2210 
2211[[rules]]
2212id = "jfrog-identity-token"
2213description = "Discovered a JFrog Identity Token, potentially compromising access to JFrog services and sensitive software artifacts."
2214regex = '''(?i)(?:jfrog|artifactory|bintray|xray)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2215keywords = [
2216    "jfrog","artifactory","bintray","xray",
2217]
2218 
2219[[rules]]
2220id = "jwt"
2221description = "Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data."
2222regex = '''\b(ey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9\/\\_-]{17,}\.(?:[a-zA-Z0-9\/\\_-]{10,}={0,2})?)(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2223keywords = [
2224    "ey",
2225]
2226 
2227[[rules]]
2228id = "jwt-base64"
2229description = "Detected a Base64-encoded JSON Web Token, posing a risk of exposing encoded authentication and data exchange information."
2230regex = '''\bZXlK(?:(?P<alg>aGJHY2lPaU)|(?P<apu>aGNIVWlPaU)|(?P<apv>aGNIWWlPaU)|(?P<aud>aGRXUWlPaU)|(?P<b64>aU5qUWlP)|(?P<crit>amNtbDBJanBi)|(?P<cty>amRIa2lPaU)|(?P<epk>bGNHc2lPbn)|(?P<enc>bGJtTWlPaU)|(?P<jku>cWEzVWlPaU)|(?P<jwk>cWQyc2lPb)|(?P<iss>cGMzTWlPaU)|(?P<iv>cGRpSTZJ)|(?P<kid>cmFXUWlP)|(?P<key_ops>clpYbGZiM0J6SWpwY)|(?P<kty>cmRIa2lPaUp)|(?P<nonce>dWIyNWpaU0k2)|(?P<p2c>d01tTWlP)|(?P<p2s>d01uTWlPaU)|(?P<ppt>d2NIUWlPaU)|(?P<sub>emRXSWlPaU)|(?P<svt>emRuUWlP)|(?P<tag>MFlXY2lPaU)|(?P<typ>MGVYQWlPaUp)|(?P<url>MWNtd2l)|(?P<use>MWMyVWlPaUp)|(?P<ver>MlpYSWlPaU)|(?P<version>MlpYSnphVzl1SWpv)|(?P<x>NElqb2)|(?P<x5c>NE5XTWlP)|(?P<x5t>NE5YUWlPaU)|(?P<x5ts256>NE5YUWpVekkxTmlJNkl)|(?P<x5u>NE5YVWlPaU)|(?P<zip>NmFYQWlPaU))[a-zA-Z0-9\/\\_+\-\r\n]{40,}={0,2}'''
2231keywords = [
2232    "zxlk",
2233]
2234 
2235[[rules]]
2236id = "kraken-access-token"
2237description = "Identified a Kraken Access Token, potentially compromising cryptocurrency trading accounts and financial security."
2238regex = '''(?i)(?:kraken)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9\/=_\+\-]{80,90})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2239keywords = [
2240    "kraken",
2241]
2242 
2243[[rules]]
2244id = "kucoin-access-token"
2245description = "Found a Kucoin Access Token, risking unauthorized access to cryptocurrency exchange services and transactions."
2246regex = '''(?i)(?:kucoin)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2247keywords = [
2248    "kucoin",
2249]
2250 
2251[[rules]]
2252id = "kucoin-secret-key"
2253description = "Discovered a Kucoin Secret Key, which could lead to compromised cryptocurrency operations and financial data breaches."
2254regex = '''(?i)(?:kucoin)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2255keywords = [
2256    "kucoin",
2257]
2258 
2259[[rules]]
2260id = "launchdarkly-access-token"
2261description = "Uncovered a Launchdarkly Access Token, potentially compromising feature flag management and application functionality."
2262regex = '''(?i)(?:launchdarkly)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2263keywords = [
2264    "launchdarkly",
2265]
2266 
2267[[rules]]
2268id = "linear-api-key"
2269description = "Detected a Linear API Token, posing a risk to project management tools and sensitive task data."
2270regex = '''lin_api_(?i)[a-z0-9]{40}'''
2271keywords = [
2272    "lin_api_",
2273]
2274 
2275[[rules]]
2276id = "linear-client-secret"
2277description = "Identified a Linear Client Secret, which may compromise secure integrations and sensitive project management data."
2278regex = '''(?i)(?:linear)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2279keywords = [
2280    "linear",
2281]
2282 
2283[[rules]]
2284id = "linkedin-client-id"
2285description = "Found a LinkedIn Client ID, risking unauthorized access to LinkedIn integrations and professional data exposure."
2286regex = '''(?i)(?:linkedin|linked-in)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{14})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2287keywords = [
2288    "linkedin","linked-in",
2289]
2290 
2291[[rules]]
2292id = "linkedin-client-secret"
2293description = "Discovered a LinkedIn Client secret, potentially compromising LinkedIn application integrations and user data."
2294regex = '''(?i)(?:linkedin|linked-in)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2295keywords = [
2296    "linkedin","linked-in",
2297]
2298 
2299[[rules]]
2300id = "lob-api-key"
2301description = "Uncovered a Lob API Key, which could lead to unauthorized access to mailing and address verification services."
2302regex = '''(?i)(?:lob)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}((live|test)_[a-f0-9]{35})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2303keywords = [
2304    "test_","live_",
2305]
2306 
2307[[rules]]
2308id = "lob-pub-api-key"
2309description = "Detected a Lob Publishable API Key, posing a risk of exposing mail and print service integrations."
2310regex = '''(?i)(?:lob)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}((test|live)_pub_[a-f0-9]{31})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2311keywords = [
2312    "test_pub","live_pub","_pub",
2313]
2314 
2315[[rules]]
2316id = "mailchimp-api-key"
2317description = "Identified a Mailchimp API key, potentially compromising email marketing campaigns and subscriber data."
2318regex = '''(?i)(?:MailchimpSDK.initialize|mailchimp)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{32}-us\d\d)(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2319keywords = [
2320    "mailchimp",
2321]
2322 
2323[[rules]]
2324id = "mailgun-private-api-token"
2325description = "Found a Mailgun private API token, risking unauthorized email service operations and data breaches."
2326regex = '''(?i)(?:mailgun)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(key-[a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2327keywords = [
2328    "mailgun",
2329]
2330 
2331[[rules]]
2332id = "mailgun-pub-key"
2333description = "Discovered a Mailgun public validation key, which could expose email verification processes and associated data."
2334regex = '''(?i)(?:mailgun)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(pubkey-[a-f0-9]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2335keywords = [
2336    "mailgun",
2337]
2338 
2339[[rules]]
2340id = "mailgun-signing-key"
2341description = "Uncovered a Mailgun webhook signing key, potentially compromising email automation and data integrity."
2342regex = '''(?i)(?:mailgun)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2343keywords = [
2344    "mailgun",
2345]
2346 
2347[[rules]]
2348id = "mapbox-api-token"
2349description = "Detected a MapBox API token, posing a risk to geospatial services and sensitive location data exposure."
2350regex = '''(?i)(?:mapbox)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(pk\.[a-z0-9]{60}\.[a-z0-9]{22})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2351keywords = [
2352    "mapbox",
2353]
2354 
2355[[rules]]
2356id = "mattermost-access-token"
2357description = "Identified a Mattermost Access Token, which may compromise team communication channels and data privacy."
2358regex = '''(?i)(?:mattermost)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{26})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2359keywords = [
2360    "mattermost",
2361]
2362 
2363[[rules]]
2364id = "messagebird-api-token"
2365description = "Found a MessageBird API token, risking unauthorized access to communication platforms and message data."
2366regex = '''(?i)(?:messagebird|message-bird|message_bird)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{25})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2367keywords = [
2368    "messagebird","message-bird","message_bird",
2369]
2370 
2371[[rules]]
2372id = "messagebird-client-id"
2373description = "Discovered a MessageBird client ID, potentially compromising API integrations and sensitive communication data."
2374regex = '''(?i)(?:messagebird|message-bird|message_bird)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2375keywords = [
2376    "messagebird","message-bird","message_bird",
2377]
2378 
2379[[rules]]
2380id = "microsoft-teams-webhook"
2381description = "Uncovered a Microsoft Teams Webhook, which could lead to unauthorized access to team collaboration tools and data leaks."
2382regex = '''https:\/\/[a-z0-9]+\.webhook\.office\.com\/webhookb2\/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}\/IncomingWebhook\/[a-z0-9]{32}\/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}'''
2383keywords = [
2384    "webhook.office.com","webhookb2","incomingwebhook",
2385]
2386 
2387[[rules]]
2388id = "netlify-access-token"
2389description = "Detected a Netlify Access Token, potentially compromising web hosting services and site management."
2390regex = '''(?i)(?:netlify)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{40,46})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2391keywords = [
2392    "netlify",
2393]
2394 
2395[[rules]]
2396id = "new-relic-browser-api-token"
2397description = "Identified a New Relic ingest browser API token, risking unauthorized access to application performance data and analytics."
2398regex = '''(?i)(?:new-relic|newrelic|new_relic)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(NRJS-[a-f0-9]{19})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2399keywords = [
2400    "nrjs-",
2401]
2402 
2403[[rules]]
2404id = "new-relic-insert-key"
2405description = "Discovered a New Relic insight insert key, compromising data injection into the platform."
2406regex = '''(?i)(?:new-relic|newrelic|new_relic)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(NRII-[a-z0-9-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2407keywords = [
2408    "nrii-",
2409]
2410 
2411[[rules]]
2412id = "new-relic-user-api-id"
2413description = "Found a New Relic user API ID, posing a risk to application monitoring services and data integrity."
2414regex = '''(?i)(?:new-relic|newrelic|new_relic)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2415keywords = [
2416    "new-relic","newrelic","new_relic",
2417]
2418 
2419[[rules]]
2420id = "new-relic-user-api-key"
2421description = "Discovered a New Relic user API Key, which could lead to compromised application insights and performance monitoring."
2422regex = '''(?i)(?:new-relic|newrelic|new_relic)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(NRAK-[a-z0-9]{27})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2423keywords = [
2424    "nrak",
2425]
2426 
2427[[rules]]
2428id = "npm-access-token"
2429description = "Uncovered an npm access token, potentially compromising package management and code repository access."
2430regex = '''(?i)\b(npm_[a-z0-9]{36})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2431keywords = [
2432    "npm_",
2433]
2434 
2435[[rules]]
2436id = "nytimes-access-token"
2437description = "Detected a Nytimes Access Token, risking unauthorized access to New York Times APIs and content services."
2438regex = '''(?i)(?:nytimes|new-york-times,|newyorktimes)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{32})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2439keywords = [
2440    "nytimes","new-york-times","newyorktimes",
2441]
2442 
2443[[rules]]
2444id = "okta-access-token"
2445description = "Identified an Okta Access Token, which may compromise identity management services and user authentication data."
2446regex = '''(?i)(?:okta)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9=_\-]{42})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2447keywords = [
2448    "okta",
2449]
2450 
2451[[rules]]
2452id = "openai-api-key"
2453description = "Found an OpenAI API Key, posing a risk of unauthorized access to AI services and data manipulation."
2454regex = '''(?i)\b(sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2455keywords = [
2456    "t3blbkfj",
2457]
2458 
2459[[rules]]
2460id = "plaid-api-token"
2461description = "Discovered a Plaid API Token, potentially compromising financial data aggregation and banking services."
2462regex = '''(?i)(?:plaid)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2463keywords = [
2464    "plaid",
2465]
2466 
2467[[rules]]
2468id = "plaid-client-id"
2469description = "Uncovered a Plaid Client ID, which could lead to unauthorized financial service integrations and data breaches."
2470regex = '''(?i)(?:plaid)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2471entropy = 3.5
2472keywords = [
2473    "plaid",
2474]
2475 
2476[[rules]]
2477id = "plaid-secret-key"
2478description = "Detected a Plaid Secret key, risking unauthorized access to financial accounts and sensitive transaction data."
2479regex = '''(?i)(?:plaid)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2480entropy = 3.5
2481keywords = [
2482    "plaid",
2483]
2484 
2485[[rules]]
2486id = "planetscale-api-token"
2487description = "Identified a PlanetScale API token, potentially compromising database management and operations."
2488regex = '''(?i)\b(pscale_tkn_(?i)[a-z0-9=\-_\.]{32,64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2489keywords = [
2490    "pscale_tkn_",
2491]
2492 
2493[[rules]]
2494id = "planetscale-oauth-token"
2495description = "Found a PlanetScale OAuth token, posing a risk to database access control and sensitive data integrity."
2496regex = '''(?i)\b(pscale_oauth_(?i)[a-z0-9=\-_\.]{32,64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2497keywords = [
2498    "pscale_oauth_",
2499]
2500 
2501[[rules]]
2502id = "planetscale-password"
2503description = "Discovered a PlanetScale password, which could lead to unauthorized database operations and data breaches."
2504regex = '''(?i)\b(pscale_pw_(?i)[a-z0-9=\-_\.]{32,64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2505keywords = [
2506    "pscale_pw_",
2507]
2508 
2509[[rules]]
2510id = "postman-api-token"
2511description = "Uncovered a Postman API token, potentially compromising API testing and development workflows."
2512regex = '''(?i)\b(PMAK-(?i)[a-f0-9]{24}\-[a-f0-9]{34})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2513keywords = [
2514    "pmak-",
2515]
2516 
2517[[rules]]
2518id = "prefect-api-token"
2519description = "Detected a Prefect API token, risking unauthorized access to workflow management and automation services."
2520regex = '''(?i)\b(pnu_[a-z0-9]{36})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2521keywords = [
2522    "pnu_",
2523]
2524 
2525[[rules]]
2526id = "private-key"
2527description = "Identified a Private Key, which may compromise cryptographic security and sensitive data encryption."
2528regex = '''(?i)-----BEGIN[ A-Z0-9_-]{0,100}PRIVATE KEY( BLOCK)?-----[\s\S-]*KEY( BLOCK)?----'''
2529keywords = [
2530    "-----begin",
2531]
2532 
2533[[rules]]
2534id = "pulumi-api-token"
2535description = "Found a Pulumi API token, posing a risk to infrastructure as code services and cloud resource management."
2536regex = '''(?i)\b(pul-[a-f0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2537keywords = [
2538    "pul-",
2539]
2540 
2541[[rules]]
2542id = "pypi-upload-token"
2543description = "Discovered a PyPI upload token, potentially compromising Python package distribution and repository integrity."
2544regex = '''pypi-AgEIcHlwaS5vcmc[A-Za-z0-9\-_]{50,1000}'''
2545keywords = [
2546    "pypi-ageichlwas5vcmc",
2547]
2548 
2549[[rules]]
2550id = "rapidapi-access-token"
2551description = "Uncovered a RapidAPI Access Token, which could lead to unauthorized access to various APIs and data services."
2552regex = '''(?i)(?:rapidapi)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9_-]{50})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2553keywords = [
2554    "rapidapi",
2555]
2556 
2557[[rules]]
2558id = "readme-api-token"
2559description = "Detected a Readme API token, risking unauthorized documentation management and content exposure."
2560regex = '''(?i)\b(rdme_[a-z0-9]{70})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2561keywords = [
2562    "rdme_",
2563]
2564 
2565[[rules]]
2566id = "rubygems-api-token"
2567description = "Identified a Rubygem API token, potentially compromising Ruby library distribution and package management."
2568regex = '''(?i)\b(rubygems_[a-f0-9]{48})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2569keywords = [
2570    "rubygems_",
2571]
2572 
2573[[rules]]
2574id = "scalingo-api-token"
2575description = "Found a Scalingo API token, posing a risk to cloud platform services and application deployment security."
2576regex = '''\b(tk-us-[a-zA-Z0-9-_]{48})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2577keywords = [
2578    "tk-us-",
2579]
2580 
2581[[rules]]
2582id = "sendbird-access-id"
2583description = "Discovered a Sendbird Access ID, which could compromise chat and messaging platform integrations."
2584regex = '''(?i)(?:sendbird)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2585keywords = [
2586    "sendbird",
2587]
2588 
2589[[rules]]
2590id = "sendbird-access-token"
2591description = "Uncovered a Sendbird Access Token, potentially risking unauthorized access to communication services and user data."
2592regex = '''(?i)(?:sendbird)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2593keywords = [
2594    "sendbird",
2595]
2596 
2597[[rules]]
2598id = "sendgrid-api-token"
2599description = "Detected a SendGrid API token, posing a risk of unauthorized email service operations and data exposure."
2600regex = '''(?i)\b(SG\.(?i)[a-z0-9=_\-\.]{66})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2601keywords = [
2602    "sg.",
2603]
2604 
2605[[rules]]
2606id = "sendinblue-api-token"
2607description = "Identified a Sendinblue API token, which may compromise email marketing services and subscriber data privacy."
2608regex = '''(?i)\b(xkeysib-[a-f0-9]{64}\-(?i)[a-z0-9]{16})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2609keywords = [
2610    "xkeysib-",
2611]
2612 
2613[[rules]]
2614id = "sentry-access-token"
2615description = "Found a Sentry Access Token, risking unauthorized access to error tracking services and sensitive application data."
2616regex = '''(?i)(?:sentry)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2617keywords = [
2618    "sentry",
2619]
2620 
2621[[rules]]
2622id = "shippo-api-token"
2623description = "Discovered a Shippo API token, potentially compromising shipping services and customer order data."
2624regex = '''(?i)\b(shippo_(live|test)_[a-f0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2625keywords = [
2626    "shippo_",
2627]
2628 
2629[[rules]]
2630id = "shopify-access-token"
2631description = "Uncovered a Shopify access token, which could lead to unauthorized e-commerce platform access and data breaches."
2632regex = '''shpat_[a-fA-F0-9]{32}'''
2633keywords = [
2634    "shpat_",
2635]
2636 
2637[[rules]]
2638id = "shopify-custom-access-token"
2639description = "Detected a Shopify custom access token, potentially compromising custom app integrations and e-commerce data security."
2640regex = '''shpca_[a-fA-F0-9]{32}'''
2641keywords = [
2642    "shpca_",
2643]
2644 
2645[[rules]]
2646id = "shopify-private-app-access-token"
2647description = "Identified a Shopify private app access token, risking unauthorized access to private app data and store operations."
2648regex = '''shppa_[a-fA-F0-9]{32}'''
2649keywords = [
2650    "shppa_",
2651]
2652 
2653[[rules]]
2654id = "shopify-shared-secret"
2655description = "Found a Shopify shared secret, posing a risk to application authentication and e-commerce platform security."
2656regex = '''shpss_[a-fA-F0-9]{32}'''
2657keywords = [
2658    "shpss_",
2659]
2660 
2661[[rules]]
2662id = "sidekiq-secret"
2663description = "Discovered a Sidekiq Secret, which could lead to compromised background job processing and application data breaches."
2664regex = '''(?i)(?:BUNDLE_ENTERPRISE__CONTRIBSYS__COM|BUNDLE_GEMS__CONTRIBSYS__COM)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-f0-9]{8}:[a-f0-9]{8})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2665keywords = [
2666    "bundle_enterprise__contribsys__com","bundle_gems__contribsys__com",
2667]
2668 
2669[[rules]]
2670id = "sidekiq-sensitive-url"
2671description = "Uncovered a Sidekiq Sensitive URL, potentially exposing internal job queues and sensitive operation details."
2672regex = '''(?i)\b(http(?:s??):\/\/)([a-f0-9]{8}:[a-f0-9]{8})@(?:gems.contribsys.com|enterprise.contribsys.com)(?:[\/|\#|\?|:]|$)'''
2673secretGroup = 2
2674keywords = [
2675    "gems.contribsys.com","enterprise.contribsys.com",
2676]
2677 
2678[[rules]]
2679id = "slack-app-token"
2680description = "Detected a Slack App-level token, risking unauthorized access to Slack applications and workspace data."
2681regex = '''(?i)(xapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+)'''
2682keywords = [
2683    "xapp",
2684]
2685 
2686[[rules]]
2687id = "slack-bot-token"
2688description = "Identified a Slack Bot token, which may compromise bot integrations and communication channel security."
2689regex = '''(xoxb-[0-9]{10,13}\-[0-9]{10,13}[a-zA-Z0-9-]*)'''
2690keywords = [
2691    "xoxb",
2692]
2693 
2694[[rules]]
2695id = "slack-config-access-token"
2696description = "Found a Slack Configuration access token, posing a risk to workspace configuration and sensitive data access."
2697regex = '''(?i)(xoxe.xox[bp]-\d-[A-Z0-9]{163,166})'''
2698keywords = [
2699    "xoxe.xoxb-","xoxe.xoxp-",
2700]
2701 
2702[[rules]]
2703id = "slack-config-refresh-token"
2704description = "Discovered a Slack Configuration refresh token, potentially allowing prolonged unauthorized access to configuration settings."
2705regex = '''(?i)(xoxe-\d-[A-Z0-9]{146})'''
2706keywords = [
2707    "xoxe-",
2708]
2709 
2710[[rules]]
2711id = "slack-legacy-bot-token"
2712description = "Uncovered a Slack Legacy bot token, which could lead to compromised legacy bot operations and data exposure."
2713regex = '''(xoxb-[0-9]{8,14}\-[a-zA-Z0-9]{18,26})'''
2714keywords = [
2715    "xoxb",
2716]
2717 
2718[[rules]]
2719id = "slack-legacy-token"
2720description = "Detected a Slack Legacy token, risking unauthorized access to older Slack integrations and user data."
2721regex = '''(xox[os]-\d+-\d+-\d+-[a-fA-F\d]+)'''
2722keywords = [
2723    "xoxo","xoxs",
2724]
2725 
2726[[rules]]
2727id = "slack-legacy-workspace-token"
2728description = "Identified a Slack Legacy Workspace token, potentially compromising access to workspace data and legacy features."
2729regex = '''(xox[ar]-(?:\d-)?[0-9a-zA-Z]{8,48})'''
2730keywords = [
2731    "xoxa","xoxr",
2732]
2733 
2734[[rules]]
2735id = "slack-user-token"
2736description = "Found a Slack User token, posing a risk of unauthorized user impersonation and data access within Slack workspaces."
2737regex = '''(xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9-]{28,34})'''
2738keywords = [
2739    "xoxp-","xoxe-",
2740]
2741 
2742[[rules]]
2743id = "slack-webhook-url"
2744description = "Discovered a Slack Webhook, which could lead to unauthorized message posting and data leakage in Slack channels."
2745regex = '''(https?:\/\/)?hooks.slack.com\/(services|workflows)\/[A-Za-z0-9+\/]{43,46}'''
2746keywords = [
2747    "hooks.slack.com",
2748]
2749 
2750[[rules]]
2751id = "snyk-api-token"
2752description = "Uncovered a Snyk API token, potentially compromising software vulnerability scanning and code security."
2753regex = '''(?i)(?:snyk_token|snyk_key|snyk_api_token|snyk_api_key|snyk_oauth_token)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2754keywords = [
2755    "snyk_token","snyk_key","snyk_api_token","snyk_api_key","snyk_oauth_token",
2756]
2757 
2758[[rules]]
2759id = "square-access-token"
2760description = "Detected a Square Access Token, risking unauthorized payment processing and financial transaction exposure."
2761regex = '''(?i)\b((EAAA|sq0atp-)[0-9A-Za-z\-_]{22,60})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2762keywords = [
2763    "sq0atp-","eaaa",
2764]
2765 
2766[[rules]]
2767id = "squarespace-access-token"
2768description = "Identified a Squarespace Access Token, which may compromise website management and content control on Squarespace."
2769regex = '''(?i)(?:squarespace)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2770keywords = [
2771    "squarespace",
2772]
2773 
2774[[rules]]
2775id = "stripe-access-token"
2776description = "Found a Stripe Access Token, posing a risk to payment processing services and sensitive financial data."
2777regex = '''(?i)\b((sk|rk)_(test|live|prod)_[0-9a-z]{10,99})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2778keywords = [
2779    "sk_test","sk_live","sk_prod","rk_test","rk_live","rk_prod",
2780]
2781 
2782[[rules]]
2783id = "sumologic-access-id"
2784description = "Discovered a SumoLogic Access ID, potentially compromising log management services and data analytics integrity."
2785regex = '''(?i:(?:sumo)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3})(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(su[a-zA-Z0-9]{12})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2786entropy = 3
2787keywords = [
2788    "sumo",
2789]
2790 
2791[rules.allowlist]
2792 
2793regexTarget = "line"
2794regexes = [
2795    "sumOf",
2796]
2797 
2798[[rules]]
2799id = "sumologic-access-token"
2800description = "Uncovered a SumoLogic Access Token, which could lead to unauthorized access to log data and analytics insights."
2801regex = '''(?i)(?:sumo)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{64})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2802entropy = 3
2803keywords = [
2804    "sumo",
2805]
2806 
2807[[rules]]
2808id = "telegram-bot-api-token"
2809description = "Detected a Telegram Bot API Token, risking unauthorized bot operations and message interception on Telegram."
2810regex = '''(?i:(?:telegr)(?:[0-9a-z\(-_\t .\\]{0,40})(?:[\s|']|[\s|"]){0,3})(?:=|\|\|:|<=|=>|:|\?=|\()(?:'|\"|\s|=|\x60){0,5}([0-9]{5,16}:A[a-z0-9_\-]{34})(?:['|\"|\n|\r|\s|\x60|;|\\]|$)'''
2811keywords = [
2812    "telegr",
2813]
2814 
2815[[rules]]
2816id = "travisci-access-token"
2817description = "Identified a Travis CI Access Token, potentially compromising continuous integration services and codebase security."
2818regex = '''(?i)(?:travis)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{22})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2819keywords = [
2820    "travis",
2821]
2822 
2823[[rules]]
2824id = "twilio-api-key"
2825description = "Found a Twilio API Key, posing a risk to communication services and sensitive customer interaction data."
2826regex = '''SK[0-9a-fA-F]{32}'''
2827keywords = [
2828    "twilio",
2829]
2830 
2831[[rules]]
2832id = "twitch-api-token"
2833description = "Discovered a Twitch API token, which could compromise streaming services and account integrations."
2834regex = '''(?i)(?:twitch)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{30})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2835keywords = [
2836    "twitch",
2837]
2838 
2839[[rules]]
2840id = "twitter-access-secret"
2841description = "Uncovered a Twitter Access Secret, potentially risking unauthorized Twitter integrations and data breaches."
2842regex = '''(?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{45})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2843keywords = [
2844    "twitter",
2845]
2846 
2847[[rules]]
2848id = "twitter-access-token"
2849description = "Detected a Twitter Access Token, posing a risk of unauthorized account operations and social media data exposure."
2850regex = '''(?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([0-9]{15,25}-[a-zA-Z0-9]{20,40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2851keywords = [
2852    "twitter",
2853]
2854 
2855[[rules]]
2856id = "twitter-api-key"
2857description = "Identified a Twitter API Key, which may compromise Twitter application integrations and user data security."
2858regex = '''(?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{25})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2859keywords = [
2860    "twitter",
2861]
2862 
2863[[rules]]
2864id = "twitter-api-secret"
2865description = "Found a Twitter API Secret, risking the security of Twitter app integrations and sensitive data access."
2866regex = '''(?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{50})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2867keywords = [
2868    "twitter",
2869]
2870 
2871[[rules]]
2872id = "twitter-bearer-token"
2873description = "Discovered a Twitter Bearer Token, potentially compromising API access and data retrieval from Twitter."
2874regex = '''(?i)(?:twitter)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(A{22}[a-zA-Z0-9%]{80,100})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2875keywords = [
2876    "twitter",
2877]
2878 
2879[[rules]]
2880id = "typeform-api-token"
2881description = "Uncovered a Typeform API token, which could lead to unauthorized survey management and data collection."
2882regex = '''(?i)(?:typeform)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(tfp_[a-z0-9\-_\.=]{59})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2883keywords = [
2884    "tfp_",
2885]
2886 
2887[[rules]]
2888id = "vault-batch-token"
2889description = "Detected a Vault Batch Token, risking unauthorized access to secret management services and sensitive data."
2890regex = '''(?i)\b(hvb\.[a-z0-9_-]{138,212})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2891keywords = [
2892    "hvb",
2893]
2894 
2895[[rules]]
2896id = "vault-service-token"
2897description = "Identified a Vault Service Token, potentially compromising infrastructure security and access to sensitive credentials."
2898regex = '''(?i)\b(hvs\.[a-z0-9_-]{90,100})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2899keywords = [
2900    "hvs",
2901]
2902 
2903[[rules]]
2904id = "yandex-access-token"
2905description = "Found a Yandex Access Token, posing a risk to Yandex service integrations and user data privacy."
2906regex = '''(?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(t1\.[A-Z0-9a-z_-]+[=]{0,2}\.[A-Z0-9a-z_-]{86}[=]{0,2})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2907keywords = [
2908    "yandex",
2909]
2910 
2911[[rules]]
2912id = "yandex-api-key"
2913description = "Discovered a Yandex API Key, which could lead to unauthorized access to Yandex services and data manipulation."
2914regex = '''(?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(AQVN[A-Za-z0-9_\-]{35,38})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2915keywords = [
2916    "yandex",
2917]
2918 
2919[[rules]]
2920id = "yandex-aws-access-token"
2921description = "Uncovered a Yandex AWS Access Token, potentially compromising cloud resource access and data security on Yandex Cloud."
2922regex = '''(?i)(?:yandex)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}(YC[a-zA-Z0-9_\-]{38})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2923keywords = [
2924    "yandex",
2925]
2926 
2927[[rules]]
2928id = "zendesk-secret-key"
2929description = "Detected a Zendesk Secret Key, risking unauthorized access to customer support services and sensitive ticketing data."
2930regex = '''(?i)(?:zendesk)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{40})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
2931keywords = [
2932    "zendesk",
2933]
2934 
2935 
2936