diff --git a/docs/rules.md b/docs/rules.md
index b6d0f66..71f80b0 100644
--- a/docs/rules.md
+++ b/docs/rules.md
@@ -2,7 +2,7 @@
Auto-generated by `make docs`
-Total rules: 135
+Total rules: 142
| Name | ID | Description | Tags | Entropy |
|------|----|-----------|----|---------|
@@ -42,14 +42,17 @@ Total rules: 135
| [Crates.io API Key](#ghost.crates.1) | ghost.crates.1 | Crates.io API key. | api, crates | 3.8 |
| [Crew.ai PAT](#ghost.crewai.1) | ghost.crewai.1 | Crew AI PAT | api, crewai | 4.3 |
| [Crew.ai Auth Token](#ghost.crewai.2) | ghost.crewai.2 | Crew AI Enterprise Action Auth Token | api, crewai, auth, token | 3.5 |
+| [Dify API Key](#ghost.dify.1) | ghost.dify.1 | Dify AI API Key | api, dify | 3.9 |
| [DigitalOcean Personal Access Token](#ghost.digitalocean.1) | ghost.digitalocean.1 | DigitalOcean personal access token. | api, digitalocean, pat, token | 3.1 |
| [DigitalOcean Application Access Token](#ghost.digitalocean.2) | ghost.digitalocean.2 | DigitalOcean application access token. | api, digitalocean, token | 3.1 |
| [Docker Hub PAT](#ghost.docker.1) | ghost.docker.1 | Docker Hub Personal Access Token. | docker, api | 4.1 |
| [Drata API Key](#ghost.drata.1) | ghost.drata.1 | Drata API key. | api, drata | 3.2 |
+| [Dreadnode API Key](#ghost.dreadnode.1) | ghost.dreadnode.1 | Dreadnode API Key | api, dreadnode | 4.3 |
| [Dynatrace API Token](#ghost.dynatrace.1) | ghost.dynatrace.1 | Dynatrace API token. | api, dynatrace | 4.5 |
| [Eleven Labs API Key](#ghost.elevenlabs.1) | ghost.elevenlabs.1 | Eleven Labs API key. | api, eleven, elevenlabs | 3.4 |
| [Fastly API Key](#ghost.fastly.1) | ghost.fastly.1 | Fastly API key. | api, fastly | 4.2 |
| [Firecrawl API Key](#ghost.firecrawl.1) | ghost.firecrawl.1 | Firecrawl API key. | api, firecrawl | 3.1 |
+| [Fireworks API Key](#ghost.fireworks.1) | ghost.fireworks.1 | Fireworks AI API Key | api, fireworks | 4.1 |
| [Fly.io API Key](#ghost.flyio.1) | ghost.flyio.1 | Fly.io API key. | api, flyio | 5.5 |
| [Framework Secret Key](#ghost.framework.1) | ghost.framework.1 | Framework Secret key variable declaration | api, framework, symfony, laravel, django, rails | 4.1 |
| [Generic Token](#ghost.generic.1) | ghost.generic.1 | Generic token variable declaration. | generic, token | 3.1 |
@@ -79,9 +82,12 @@ Total rules: 135
| [JumpCloud API Key](#ghost.jumpcloud.1) | ghost.jumpcloud.1 | JumpCloud API key. | api, jumpcloud | 4.2 |
| [LangSmith Personal Access Token](#ghost.langsmith.1) | ghost.langsmith.1 | LangSmith personal access token. | api, langsmith, pat | 3.1 |
| [LangSmith Service Key](#ghost.langsmith.2) | ghost.langsmith.2 | LangSmith service key. | api, langsmith, service | 3.1 |
+| [Lightfield API Key](#ghost.lightfield.1) | ghost.lightfield.1 | Lightfield API Key | api, lightfield | 4.7 |
| [Linear API Key](#ghost.linear.1) | ghost.linear.1 | Linear API key. | api, linear | 4.2 |
+| [MailerSend API Key](#ghost.mailersend.1) | ghost.mailersend.1 | MailerSend API Key | api, mailersend | 3.5 |
| [Mailgun API Key](#ghost.mailgun.1) | ghost.mailgun.1 | Mailgun API key. | api, mailgun | 4.1 |
| [Mistral API Key](#ghost.mistral.1) | ghost.mistral.1 | Mistral API key. | api, mistral | 4.5 |
+| [Murf AI API Key](#ghost.murf.1) | ghost.murf.1 | Murf AI API Key | api, murf | 3.2 |
| [MySQL Senstive Connection String](#ghost.mysql.1) | ghost.mysql.1 | MySQL connection string with credentials. | api, mysql | 4.1 |
| [Netlify PAT](#ghost.netlify.1) | ghost.netlify.1 | Netlify Personal Access Token. | api, netlify, pat | 4.2 |
| [ngrok API Key](#ghost.ngrok.1) | ghost.ngrok.1 | ngrok API key. | api, ngrok, key | 4.5 |
@@ -114,6 +120,7 @@ Total rules: 135
| [Salesforce App Consumer Key](#ghost.salesforce.2) | ghost.salesforce.2 | Salesforce App Consumer Key. | api, salesforce | 5.1 |
| [Salesforce Security Token](#ghost.salesforce.3) | ghost.salesforce.3 | Salesforce Security Token. | api, salesforce, token | 4.1 |
| [Sendgrid API Key](#ghost.sendgrid.1) | ghost.sendgrid.1 | Sendgrid API key. | api, sendgrid | 4.8 |
+| [Sentry Token](#ghost.sentry.1) | ghost.sentry.1 | Sentry Token | api, sentry | 3.5 |
| [Shodan API Key](#ghost.shodan.1) | ghost.shodan.1 | Shodan API key. | api, shodan | 3.1 |
| [Slack Bot Token](#ghost.slack.1) | ghost.slack.1 | Slack bot token. | api, slack, bot | 3.5 |
| [Slack User Token](#ghost.slack.2) | ghost.slack.2 | Slack user token. | api, slack | 3.5 |
@@ -1082,6 +1089,31 @@ Total rules: 135
- assert_not: 4 cases
+
+### Dify API Key
+
+**ID:** `ghost.dify.1`
+
+**Description:** Dify AI API Key
+
+**Tags:** api, dify
+
+**Pattern:**
+```
+(?x)
+ \b
+ (app-(?i)[A-Z0-9]{24})
+ \b
+
+```
+
+**Min entropy:** 3.9
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 3 cases
+
+
### DigitalOcean Personal Access Token
@@ -1186,6 +1218,31 @@ Total rules: 135
- assert_not: 2 cases
+
+### Dreadnode API Key
+
+**ID:** `ghost.dreadnode.1`
+
+**Description:** Dreadnode API Key
+
+**Tags:** api, dreadnode
+
+**Pattern:**
+```
+(?x)
+ \b
+ (dn_(?i)[A-Z0-9_-]{32})
+ \b
+
+```
+
+**Min entropy:** 4.3
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
### Dynatrace API Token
@@ -1290,6 +1347,31 @@ Total rules: 135
- assert_not: 4 cases
+
+### Fireworks API Key
+
+**ID:** `ghost.fireworks.1`
+
+**Description:** Fireworks AI API Key
+
+**Tags:** api, fireworks
+
+**Pattern:**
+```
+(?x)
+ \b
+ (fw_(?i)[A-Z0-9]{22})
+ \b
+
+```
+
+**Min entropy:** 4.1
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 2 cases
+
+
### Fly.io API Key
@@ -2043,6 +2125,31 @@ Total rules: 135
- assert_not: 2 cases
+
+### Lightfield API Key
+
+**ID:** `ghost.lightfield.1`
+
+**Description:** Lightfield API Key
+
+**Tags:** api, lightfield
+
+**Pattern:**
+```
+(?x)
+ \b
+ (sk_lf_\d_(?i)[A-Z0-9_-]{64})
+ \b
+
+```
+
+**Min entropy:** 4.7
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 4 cases
+
+
### Linear API Key
@@ -2068,6 +2175,31 @@ Total rules: 135
- assert_not: 2 cases
+
+### MailerSend API Key
+
+**ID:** `ghost.mailersend.1`
+
+**Description:** MailerSend API Key
+
+**Tags:** api, mailersend
+
+**Pattern:**
+```
+(?x)
+ \b
+ (mlsn\.[a-f0-9]{64})
+ \b
+
+```
+
+**Min entropy:** 3.5
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 4 cases
+
+
### Mailgun API Key
@@ -2124,6 +2256,31 @@ Total rules: 135
- assert_not: 1 cases
+
+### Murf AI API Key
+
+**ID:** `ghost.murf.1`
+
+**Description:** Murf AI API Key
+
+**Tags:** api, murf
+
+**Pattern:**
+```
+(?x)
+ \b
+ (ap2_[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})
+ \b
+
+```
+
+**Min entropy:** 3.2
+
+**Tests:**
+- assert: 3 cases
+- assert_not: 3 cases
+
+
### MySQL Senstive Connection String
@@ -2980,6 +3137,31 @@ Total rules: 135
- assert_not: 3 cases
+
+### Sentry Token
+
+**ID:** `ghost.sentry.1`
+
+**Description:** Sentry Token
+
+**Tags:** api, sentry
+
+**Pattern:**
+```
+(?x)
+ \b
+ (sntryu_[a-f0-9]{64})
+ \b
+
+```
+
+**Min entropy:** 3.5
+
+**Tests:**
+- assert: 2 cases
+- assert_not: 2 cases
+
+
### Shodan API Key
diff --git a/pkg/rules/dify.yaml b/pkg/rules/dify.yaml
new file mode 100644
index 0000000..9713fcb
--- /dev/null
+++ b/pkg/rules/dify.yaml
@@ -0,0 +1,26 @@
+rules:
+ - name: Dify API Key
+ id: ghost.dify.1
+ description: Dify AI API Key
+ tags:
+ - api
+ - dify
+ pattern: |
+ (?x)
+ \b
+ (app-(?i)[A-Z0-9]{24})
+ \b
+ entropy: 3.9
+ redact: [6, 4]
+ tests:
+ assert:
+ - app-gc4TBNcwMOVde5q5en8BpaxL
+ - app-awUrXYzSR685gW8EINiukzUl
+ assert_not:
+ - app-gc4TBNcwMOVde5q5en8BpaxLx
+ - app-awUrXYzSR685gW8EINiukzU
+ - app-awUrXYzSR68%gW8EINiukzUl
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://docs.dify.ai/en/use-dify/publish/developing-with-apis
diff --git a/pkg/rules/dreadnode.yaml b/pkg/rules/dreadnode.yaml
new file mode 100644
index 0000000..130bff7
--- /dev/null
+++ b/pkg/rules/dreadnode.yaml
@@ -0,0 +1,27 @@
+rules:
+ - name: Dreadnode API Key
+ id: ghost.dreadnode.1
+ description: Dreadnode API Key
+ tags:
+ - api
+ - dreadnode
+ pattern: |
+ (?x)
+ \b
+ (dn_(?i)[A-Z0-9_-]{32})
+ \b
+ entropy: 4.3
+ redact: [6, 4]
+ tests:
+ assert:
+ - dn_1pIzmgTsDsZtmIY-meu0iv0LlaOPiFGb
+ - dn_Zz287fTvnbCJx2ibm-Bg2b0-Z2cKoGgk
+ - dn_2_iQAz-ST7XMmJWPWMpfck4PC56ijt8z
+ assert_not:
+ - dn_1pIzmgTsDsZtmIY-meu0iv0LlaOPiFGbx
+ - dn_Zz287fTvnbCJx2ibm-Bg2b0-Z2cKoGg
+ - dn_2_iQAz%ST7XMmJWPWMpfck4PC56ijt8z
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://docs.dreadnode.io/sdk/api-client
diff --git a/pkg/rules/fireworks.yaml b/pkg/rules/fireworks.yaml
new file mode 100644
index 0000000..27d592f
--- /dev/null
+++ b/pkg/rules/fireworks.yaml
@@ -0,0 +1,25 @@
+rules:
+ - name: Fireworks API Key
+ id: ghost.fireworks.1
+ description: Fireworks AI API Key
+ tags:
+ - api
+ - fireworks
+ pattern: |
+ (?x)
+ \b
+ (fw_(?i)[A-Z0-9]{22})
+ \b
+ entropy: 4.1
+ redact: [6, 4]
+ tests:
+ assert:
+ - fw_GZQpdDHrs3z66NBxy1fzaH
+ - fw_AGuDdk53ECTPBQUZgXDjBo
+ assert_not:
+ - fw_GZQpdDHrs3z66NBxy1fzaHx
+ - fw_AGuDdk53ECTPBQUZgXDjB
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://docs.fireworks.ai/getting-started/quickstart
diff --git a/pkg/rules/lightfield.yaml b/pkg/rules/lightfield.yaml
new file mode 100644
index 0000000..66d5530
--- /dev/null
+++ b/pkg/rules/lightfield.yaml
@@ -0,0 +1,28 @@
+rules:
+ - name: Lightfield API Key
+ id: ghost.lightfield.1
+ description: Lightfield API Key
+ tags:
+ - api
+ - lightfield
+ pattern: |
+ (?x)
+ \b
+ (sk_lf_\d_(?i)[A-Z0-9_-]{64})
+ \b
+ entropy: 4.7
+ redact: [11, 4]
+ tests:
+ assert:
+ - sk_lf_0_XnjCzv_XYc3qZdxi46ObM69P5zq5ppi13FQxUFHtdJKpsfv7nFJGJeTGNyfk9m2t
+ - sk_lf_0_R4A6gAks2ce2LkJJ_Z9owXgmILut9jZ69mJT0yP5YCNZqOOTafhdnBttw20E6V2I
+ - sk_lf_0_pB1JymczabyooNFCTRmVkM6NANb6-RDc69gOuJa8cRNDqvodDdG-x9XxrNCRJnMF
+ assert_not:
+ - sk_lf_A_XnjCzv_XYc3qZdxi46ObM69P5zq5ppi13FQxUFHtdJKpsfv7nFJGJeTGNyfk9m2t
+ - sk_lf_0_R4A6gAks2ce2LkJJ_Z9owXgmILut9jZ69mJT0yP5YCNZqOOTafhdnBttw20E6V2
+ - sk_lf_0_pB1JymczabyooNFCTRmVkM6NANb6-RDc69gOuJa8cRNDqvodDdG-x9XxrNCRJnMFx
+ - sk_lf_0_pB1JymczabyooNFCTRmVkM6NANb6%RDc69gOuJa8cRNDqvodDdG-x9XxrNCRJnMF
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://docs.lightfield.app/using-the-api/api-keys/
diff --git a/pkg/rules/mailersend.yaml b/pkg/rules/mailersend.yaml
new file mode 100644
index 0000000..077f989
--- /dev/null
+++ b/pkg/rules/mailersend.yaml
@@ -0,0 +1,28 @@
+rules:
+ - name: MailerSend API Key
+ id: ghost.mailersend.1
+ description: MailerSend API Key
+ tags:
+ - api
+ - mailersend
+ pattern: |
+ (?x)
+ \b
+ (mlsn\.[a-f0-9]{64})
+ \b
+ entropy: 3.5
+ redact: [9, 4]
+ tests:
+ assert:
+ - mlsn.45784df7b38b0b453fb3b06b50e4569daa0cb9fdaf817642015da8240d15bddc
+ - mlsn.b8c2b8a469694e76b1480f2ffabc5e5161bfc73f81cea4275c796394d7a9ef9e
+ - mlsn.0e55e5431a4e59d7c0357911e9d503d7fca95d5087079acc86942e8bd405ed1b
+ assert_not:
+ - mlsn.45784df7b38b0b453fb3b06b50e4569daa0cb9fdaf817642015da8240d15bddcx
+ - mlsn.b8c2b8a469694e76b1480f2ffabc5e5161bfc73f81cea4275c796394d7a9ef9
+ - mlsn.0e55e5431a4e59d7c0357911e9d503d7fca95d5087079acc86942e8bd405ex1b
+ - mlsn-0e55e5431a4e59d7c0357911e9d503d7fca95d5087079acc86942e8bd405ed1b
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://www.mailersend.com/help/managing-api-tokens
diff --git a/pkg/rules/murf.yaml b/pkg/rules/murf.yaml
new file mode 100644
index 0000000..4d4cbff
--- /dev/null
+++ b/pkg/rules/murf.yaml
@@ -0,0 +1,27 @@
+rules:
+ - name: Murf AI API Key
+ id: ghost.murf.1
+ description: Murf AI API Key
+ tags:
+ - api
+ - murf
+ pattern: |
+ (?x)
+ \b
+ (ap2_[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})
+ \b
+ entropy: 3.2
+ redact: [8, 4]
+ tests:
+ assert:
+ - ap2_02434094-9a6b-4685-8938-e996c25ae29b
+ - ap2_1b7c4e8b-fbe3-4da2-b536-6465e2791031
+ - ap2_213ac2fa-c029-4933-9b37-bae23da80c0f
+ assert_not:
+ - ap2_02434094-9a6z-4685-8938-e996c25ae29b
+ - ap2_02434094a9a6zb4685c8938de996c25ae29b
+ - ap2_213ac2fa-c029-4933-9b37-bae23da80c0
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://murf.ai/api/docs/introduction/quickstart
diff --git a/pkg/rules/sentry.yaml b/pkg/rules/sentry.yaml
new file mode 100644
index 0000000..c739ab9
--- /dev/null
+++ b/pkg/rules/sentry.yaml
@@ -0,0 +1,25 @@
+rules:
+ - name: Sentry Token
+ id: ghost.sentry.1
+ description: Sentry Token
+ tags:
+ - api
+ - sentry
+ pattern: |
+ (?x)
+ \b
+ (sntryu_[a-f0-9]{64})
+ \b
+ entropy: 3.5
+ redact: [10, 4]
+ tests:
+ assert:
+ - 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
+ - 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
+ assert_not:
+ - sntryu_da3a4e895224b83aece8bcb15b7b1e8d87323508734903e8d101765c77b0b99X
+ - sntryu_d096083c1d7066e9ea590d4b72fce58c0e8bc2046c25eca0ac206600d639948
+ history:
+ - 2026-03-26 initial version
+ refs:
+ - https://docs.sentry.io/account/auth-tokens