diff --git a/docs/rules.md b/docs/rules.md index 71f80b0..d2fb42b 100644 --- a/docs/rules.md +++ b/docs/rules.md @@ -2,12 +2,13 @@ Auto-generated by `make docs` -Total rules: 142 +Total rules: 150 | Name | ID | Description | Tags | Entropy | |------|----|-----------|----|---------| | [Airtable PAT](#ghost.airtable.1) | ghost.airtable.1 | Airtable PAT | api, airtable, pat | 4.1 | | [Algolia API Key](#ghost.algolia.1) | ghost.algolia.1 | Algolia API key variable declaration. | api, algolia | 3.6 | +| [Alibaba API Key](#ghost.alibaba.1) | ghost.alibaba.1 | Alibaba API Key | api, alibaba | 3.5 | | [Amplemarket API Key](#ghost.amplemarket.1) | ghost.amplemarket.1 | Amplemarket API Key | api, amplemarket | 3.5 | | [Anthropic API Key](#ghost.anthropic.1) | ghost.anthropic.1 | Anthropic API key. | api, anthropic | 5.1 | | [Anthropic Admin API Key](#ghost.anthropic.2) | ghost.anthropic.2 | Anthropic admin API key. | api, anthropic, admin | 5.1 | @@ -78,6 +79,7 @@ Total rules: 142 | [Harness SDK API Key](#ghost.harness.3) | ghost.harness.3 | Harness SDK API Key | api, harness, sdk | 3.5 | | [HubSpot API Key](#ghost.hubspot.1) | ghost.hubspot.1 | HubSpot API key. | api, hubspot | 3.5 | | [Hugging Face API Key](#ghost.huggingface.1) | ghost.huggingface.1 | Hugging Face API key. | api, huggingface | 4.2 | +| [InfluxDB API Token](#ghost.influxdb.1) | ghost.influxdb.1 | InfluxDB API token variable declaration. | api, influxdb | 5.1 | | [Intercom API Key](#ghost.intercom.1) | ghost.intercom.1 | Intercom API key. | api, intercom | 4.2 | | [JumpCloud API Key](#ghost.jumpcloud.1) | ghost.jumpcloud.1 | JumpCloud API key. | api, jumpcloud | 4.2 | | [LangSmith Personal Access Token](#ghost.langsmith.1) | ghost.langsmith.1 | LangSmith personal access token. | api, langsmith, pat | 3.1 | @@ -97,6 +99,7 @@ Total rules: 142 | [NPM Legacy Token](#ghost.npm.1) | ghost.npm.1 | NPM legacy token. | api, npm, legacy | 4.1 | | [NPM Access Token](#ghost.npm.2) | ghost.npm.2 | NPM access token. | api, npm, token | 4.1 | | [NuGet API Key](#ghost.nuget.1) | ghost.nuget.1 | NuGet API key. | api, nuget | 4.1 | +| [NVIDIA API Key](#ghost.nvidia.1) | ghost.nvidia.1 | Nvidia API key. | api, nvidai | 4.8 | | [OpenAI API Key](#ghost.openai.1) | ghost.openai.1 | Matches an OpenAI API key. | api, openai | 5.1 | | [OpenAI Admin API Key](#ghost.openai.2) | ghost.openai.2 | Matches an OpenAI admin API key. | api, openai, admin | 5.1 | | [OpenAI Legacy API Key](#ghost.openai.3) | ghost.openai.3 | Matches an OpenAI legacy API key. | api, openai, legacy | 5.1 | @@ -113,12 +116,15 @@ Total rules: 142 | [PostHog OAuth Access Token](#ghost.posthog.5) | ghost.posthog.5 | PostHog OAuth Refresh Token | api, posthog, oauth | 4.5 | | [Pulumi Access Token](#ghost.pulumi.1) | ghost.pulumi.1 | Pulumi access token. | api, pulumi | 3.3 | | [PyPI API Key](#ghost.pypi.1) | ghost.pypi.1 | PyPI API key. | api, pypi | 4.5 | +| [Raindrop AI API Key](#ghost.raindrop.1) | ghost.raindrop.1 | Raindrop AI API key variable declaration. | api, raindrop | 3.5 | | [RapiAPI API Key](#ghost.rapidapi.1) | ghost.rapidapi.1 | RapidAPI API Key | api, rapidapi | 3.5 | +| [Readme.io API Key](#ghost.readmeio.1) | ghost.readmeio.1 | ReadMe.io API key | api, readmeio | 3.5 | | [ReCaptcha API Key](#ghost.recaptcha.1) | ghost.recaptcha.1 | ReCaptcha API key variable declaration. | api, recaptcha | 3.5 | | [Resend API Key](#ghost.resend.1) | ghost.resend.1 | Resend API key. | api, resend | 4.2 | | [Salesforce App Consumer Secret](#ghost.salesforce.1) | ghost.salesforce.1 | Salesforce App Consumer Secret. | api, salesforce | 4.1 | | [Salesforce App Consumer Key](#ghost.salesforce.2) | ghost.salesforce.2 | Salesforce App Consumer Key. | api, salesforce | 5.1 | | [Salesforce Security Token](#ghost.salesforce.3) | ghost.salesforce.3 | Salesforce Security Token. | api, salesforce, token | 4.1 | +| [Sendbird API Key](#ghost.sendbird.1) | ghost.sendbird.1 | Sendbird API key variable declaration. | api, sendbird | 3.5 | | [Sendgrid API Key](#ghost.sendgrid.1) | ghost.sendgrid.1 | Sendgrid API key. | api, sendgrid | 4.8 | | [Sentry Token](#ghost.sentry.1) | ghost.sentry.1 | Sentry Token | api, sentry | 3.5 | | [Shodan API Key](#ghost.shodan.1) | ghost.shodan.1 | Shodan API key. | api, shodan | 3.1 | @@ -129,6 +135,8 @@ Total rules: 142 | [Slack Refresh Token](#ghost.slack.5) | ghost.slack.5 | Slack refresh token. | api, slack | 4.1 | | [Slack Service Webhook Secret](#ghost.slack.6) | ghost.slack.6 | Slack service webhook secret. | api, slack | 4.1 | | [Slack Workflow Webhook Secret](#ghost.slack.7) | ghost.slack.7 | Slack workflow webhook secret. | api, slack | 4.1 | +| [SonarQube PAT](#ghost.sonarqube.1) | ghost.sonarqube.1 | SonarQube Personal Access Token variable declaration. | api, sonarqube, pat | 4.1 | +| [SonarQube Scoped Access Token](#ghost.sonarqube.2) | ghost.sonarqube.2 | SonarQube Scoped Access Token | api, sonarqube, token | 4.5 | | [Sourcegraph Legacy Token](#ghost.sourcegraph.1) | ghost.sourcegraph.1 | Sourcegraph legacy token. | api, sourcegraph | 4.1 | | [Sourcegraph Workspace Token](#ghost.sourcegraph.2) | ghost.sourcegraph.2 | Sourcegraph workspace token. | api, sourcegraph | 3.5 | | [Spotify Access Token](#ghost.spotify.1) | ghost.spotify.1 | Spotify Access Token variable declaration. | api, spotify, token | 4.1 | @@ -205,6 +213,31 @@ Total rules: 142 - assert_not: 3 cases + +### Alibaba API Key + +**ID:** `ghost.alibaba.1` + +**Description:** Alibaba API Key + +**Tags:** api, alibaba + +**Pattern:** +``` +(?x) + \b + (sk-(?i)[a-f0-9]{32}) + \b + +``` + +**Min entropy:** 3.5 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### Amplemarket API Key @@ -2023,6 +2056,35 @@ Total rules: 142 - assert_not: 3 cases + +### InfluxDB API Token + +**ID:** `ghost.influxdb.1` + +**Description:** InfluxDB API token variable declaration. + +**Tags:** api, influxdb + +**Pattern:** +``` +(?x) + \b + ( + (?i)(?:influx)\w* + [\W]{0,40}? + [A-Z0-9_-]{86,} + ) + \b + +``` + +**Min entropy:** 5.1 + +**Tests:** +- assert: 4 cases +- assert_not: 4 cases + + ### Intercom API Key @@ -2530,6 +2592,31 @@ Total rules: 142 - assert_not: 4 cases + +### NVIDIA API Key + +**ID:** `ghost.nvidia.1` + +**Description:** Nvidia API key. + +**Tags:** api, nvidai + +**Pattern:** +``` +(?x) + \b + (nvapi-(?i)[A-Z0-9_-]{64}) + \b + +``` + +**Min entropy:** 4.8 + +**Tests:** +- assert: 2 cases +- assert_not: 3 cases + + ### OpenAI API Key @@ -2940,6 +3027,35 @@ Total rules: 142 - assert_not: 2 cases + +### Raindrop AI API Key + +**ID:** `ghost.raindrop.1` + +**Description:** Raindrop AI API key variable declaration. + +**Tags:** api, raindrop + +**Pattern:** +``` +(?x) + \b + ( + (?i)(?:raindrop)\w* + [\W]{0,40}? + [A-F0-9]{96} + ) + \b + +``` + +**Min entropy:** 3.5 + +**Tests:** +- assert: 8 cases +- assert_not: 4 cases + + ### RapiAPI API Key @@ -2969,6 +3085,31 @@ Total rules: 142 - assert_not: 3 cases + +### Readme.io API Key + +**ID:** `ghost.readmeio.1` + +**Description:** ReadMe.io API key + +**Tags:** api, readmeio + +**Pattern:** +``` +(?x) + \b + (rdme_(?i)[A-Z0-9]{70}) + \b + +``` + +**Min entropy:** 3.5 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### ReCaptcha API Key @@ -3110,6 +3251,35 @@ Total rules: 142 - assert_not: 2 cases + +### Sendbird API Key + +**ID:** `ghost.sendbird.1` + +**Description:** Sendbird API key variable declaration. + +**Tags:** api, sendbird + +**Pattern:** +``` +(?x) + \b + ( + (?i)sendbird\w*(?:token|key|secret)\w* + [\W]{0,40}? + [a-f0-9]{40} + ) + \b + +``` + +**Min entropy:** 3.5 + +**Tests:** +- assert: 4 cases +- assert_not: 4 cases + + ### Sendgrid API Key @@ -3380,6 +3550,62 @@ Total rules: 142 - assert_not: 3 cases + +### SonarQube PAT + +**ID:** `ghost.sonarqube.1` + +**Description:** SonarQube Personal Access Token variable declaration. + +**Tags:** api, sonarqube, pat + +**Pattern:** +``` +(?x) + \b + ( + (?i)sonar\w*(?:token|key|secret)\w* + [\W]{0,40}? + [a-f0-9]{40} + ) + \b + +``` + +**Min entropy:** 4.1 + +**Tests:** +- assert: 4 cases +- assert_not: 3 cases + + + +### SonarQube Scoped Access Token + +**ID:** `ghost.sonarqube.2` + +**Description:** SonarQube Scoped Access Token + +**Tags:** api, sonarqube, token + +**Pattern:** +``` +(?x) + \b + ( + (sqco_(?i)[A-Z0-9]{59}) + ) + \b + +``` + +**Min entropy:** 4.5 + +**Tests:** +- assert: 3 cases +- assert_not: 3 cases + + ### Sourcegraph Legacy Token diff --git a/pkg/rules/alibaba.yaml b/pkg/rules/alibaba.yaml new file mode 100644 index 0000000..f2c5104 --- /dev/null +++ b/pkg/rules/alibaba.yaml @@ -0,0 +1,27 @@ +rules: + - name: Alibaba API Key + id: ghost.alibaba.1 + description: Alibaba API Key + tags: + - api + - alibaba + pattern: | + (?x) + \b + (sk-(?i)[a-f0-9]{32}) + \b + entropy: 3.5 + redact: [6, 4] + tests: + assert: + - sk-3e3f172c956e4d32a87135c37eec4a5f + - sk-9e2596f50f014cb2a8f02d59e4f872db + - sk-40d84e35978d8e7cf0afe45c52989cad + assert_not: + - sk-3e3f172c956e4d32a87135c37eec4a5fx + - sk-9e2596f50f014cb2a8f02d59e4f872d + - sk-40d84e35978d8e-7cf0afe45c52989ca + history: + - 2026-03-28 initial version + refs: + - https://www.alibabacloud.com/help/en/ram/user-guide/create-an-accesskey-pair diff --git a/pkg/rules/cohere.yaml b/pkg/rules/cohere.yaml index 5583040..87437a2 100644 --- a/pkg/rules/cohere.yaml +++ b/pkg/rules/cohere.yaml @@ -18,14 +18,14 @@ rules: entropy: 4.1 tests: assert: - - 'cohere: w9piJHtWe0p01rRO420M6PTJmCTerjuHOH0wZsgB' - - 'cohere=szJiK1fy6FaEedPWSw8e41kAXTbtArCX5ks7wQP3' - - 'cohere = fVst85KDGHJxfjrXtSJGjwQ27W92ORERq4bV6Ais' + - "cohere: w9piJHtWe0p01rRO420M6PTJmCTerjuHOH0wZsgB" + - "cohere=szJiK1fy6FaEedPWSw8e41kAXTbtArCX5ks7wQP3" + - "cohere = fVst85KDGHJxfjrXtSJGjwQ27W92ORERq4bV6Ais" - 'let cohere = "s8Cuh6T6Tz4ZP5Xg7HTxsX0JZY3J92KGX0p1yt47"' - 'export COHERE_KEY="s8Cuh6T6Tz4ZP5Xg7HTxsX0JZY3J92KGX0p1yt47"' - - 'CO_API_KEY=w9piJHtWe0p01rRO420M6PTJmCTerjuHOH0wZsgB' + - "CO_API_KEY=w9piJHtWe0p01rRO420M6PTJmCTerjuHOH0wZsgB" - 'const CO_API_KEY = "szJiK1fy6FaEedPWSw8e41kAXTbtArCX5ks7wQP3"' - - 'CO_API_KEY=fVst85KDGHJxfjrXtSJGjwQ27W92ORERq4bV6Ais' + - "CO_API_KEY=fVst85KDGHJxfjrXtSJGjwQ27W92ORERq4bV6Ais" assert_not: - 9MbXxamGfTkx2cfasR7oUUzylk14gqTAK9GMlSDuX - 9MbXxamGfTkx2cfasR7oUUzylk14gqTAK9GMlSD @@ -34,3 +34,5 @@ rules: - 2025-08-06 initial version - 2025-08-07 simplify pattern with fewer capture groups - 2025-08-12 combined into one pattern to match when either "COHERE" or "CO_API" are used in the variable name + refs: + - https://docs.cohere.com/docs/rate-limits diff --git a/pkg/rules/influxdb.yaml b/pkg/rules/influxdb.yaml new file mode 100644 index 0000000..00e094d --- /dev/null +++ b/pkg/rules/influxdb.yaml @@ -0,0 +1,33 @@ +rules: + - name: InfluxDB API Token + id: ghost.influxdb.1 + description: InfluxDB API token variable declaration. + tags: + - api + - influxdb + pattern: | + (?x) + \b + ( + (?i)(?:influx)\w* + [\W]{0,40}? + [A-Z0-9_-]{86,} + ) + \b + redact: [20, 4] + entropy: 5.1 + tests: + assert: + - "INFLUXDB_TOKEN=5qpcUD0RL7iXRRhu_k0c5eekGIP3Xg0Re-4JKqp0JFx181SseU_f8QcZr5CKgGAJJEVn7_61UIykH58VcWHncA==" + - "INFLUXDB_TOKEN=oYacagiEUlR5DFwIu18dd52uS457AQt-jlixv57t3SAXc3q-2G8Wb-tgpSIAE1RSGqPhmCLsCsrRmUIBi5Lr0w==" + - "INFLUXDB_TOKEN=VUM15AazTlWk1kYBG6pL3CSE_LBkbwng5_hucqhBDv95ib6i4jSUNUcyuy6n7qqUvNAMEjDPgMbbeDUFpLJdgw==" + - "INFLUXDB_TOKEN=8Sv8yy6NXUmAkUFqQCPoZAqYFgdfJbh-3xk1x7dLgqnJZw2JR5sbMTJ-UWgTYqAjo3mkRC0VSGRj4F639qu2LA==" + assert_not: + - "INFLUXDB_TOKEN=5qpcUD0RL7iXRRhu_k0c5eekGIP3Xg0Re-4JKqp0JFx181SseU_f8QcZr5CKgGAJJEVn7==" + - "INFLUXDB_TOKEN=oYacagiEUlR5DFwIu18dd52uS457AQt-jlixv57t3SAXc3q-2G8Wb-tgpSIAE1RSGqPh%CLsCsrRmUIBi5Lr0w==" + - "INFLUXDB_TOKEN=VUM15AazTlWk1kYBG6pL3CSE_LBkbwng5_hucqhBDv95ib6i4jSUNU^yuy6n7qqUvNAMEjDPgMbbeDUFpLJdgw==" + - "8Sv8yy6NXUmAkUFqQCPoZAqYFgdfJbh-3xk1x7dLgqnJZw2JR5sbMTJ-UWgTYqAjo3mkRC0VSGRj4F639qu2LA==" + history: + - 2026-03-28 initial version + refs: + - https://docs.influxdata.com/influxdb/cloud/admin/tokens/ diff --git a/pkg/rules/nvidia.yaml b/pkg/rules/nvidia.yaml new file mode 100644 index 0000000..8f2914e --- /dev/null +++ b/pkg/rules/nvidia.yaml @@ -0,0 +1,26 @@ +rules: + - name: NVIDIA API Key + id: ghost.nvidia.1 + description: Nvidia API key. + tags: + - api + - nvidai + pattern: | + (?x) + \b + (nvapi-(?i)[A-Z0-9_-]{64}) + \b + entropy: 4.8 + redact: [8, 4] + tests: + assert: + - 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 + - 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 + assert_not: + - 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 + - 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 + - nvapi-OFyUWnNcwU__LwIiHjibHB-6ODljEcTZUBdC09&j8PwsIDFL4qsTVjb4EQXvtncC + history: + - 2025-08-18 initial version + refs: + - https://docs.api.nvidia.com/nim/docs/api-quickstart diff --git a/pkg/rules/raindrop.yaml b/pkg/rules/raindrop.yaml new file mode 100644 index 0000000..0e62c81 --- /dev/null +++ b/pkg/rules/raindrop.yaml @@ -0,0 +1,37 @@ +rules: + - name: Raindrop AI API Key + id: ghost.raindrop.1 + description: Raindrop AI API key variable declaration. + tags: + - api + - raindrop + pattern: | + (?x) + \b + ( + (?i)(?:raindrop)\w* + [\W]{0,40}? + [A-F0-9]{96} + ) + \b + redact: [14, 4] + entropy: 3.5 + tests: + assert: + - "raindrop=6d89b01696fcf5f775bb123dbac9df184371325f9af413caf7334ff86852445df8554b0e74d7b589f69ddfc1691dd4bb" + - "raindrop: f0fdaac6eead4b4fd8b88a8e8c05761fbc8aa7e1ac9622e5bff19b488e79c60e9502ce00fdc2e3bf7552834da0eb7591" + - "raindrop = 85371bfdf76bc47125a8b71a94967335c103507e4bd8886dd88de4fc351775a72c5602d126946157c5bced3e2bbeb95f" + - 'let raindrop = "1cf76e570309a9ca09c0a5bc08938ee9e4e4f28f16c177dbe64cab33d3ff0df8837619ebfe4f0c1c0ffc835909346cac"' + - 'export RAINDROP_API_KEY="073d5b09a4e5784fb781e525fa42db7259d3961c2c4b921d18bb54e64ab7bebb9848eda2f484f7d16b2bb1b052c9f4da"' + - "RAINDROP_KEY=1cc5720db4892d1636b453967b348c08cb90ef77baf7d53dd0d2e6bec64880f1702cf36b14de94c56d772efe62349a5c" + - 'const RAINDROP_API_KEY = "7548930a071fb8c16261e279f68e69fc0d29a60516b6d0665782e06c23d6e3b45da60bc8acdc44c5b10689d340f433a9"' + - "RAINDROP_API_KEY=c360f3235aaba2e3f1e5b525e2f068df70fc6960478b5f399582c5d70cffbf70ff9714cfa85ca78fe3fb978122a3aeb7" + assert_not: + - d89cd81769e476eb94a488024b06df6bf51a075c2b5767296df5a074f9a54a9681037d9c96df4513126297c9cc207157 + - 'let raindrop = "1cf76e570309a9ca09c0a5bc08938ee9e4e4f28f16c177dbe64cab33d3ff0df8837619ebfe4f0c1c0ffc835909346cax"' + - 'export RAINDROP_API_KEY="073d5b09a4e5784fb781e525fa42db7259d3961c2c4b921d18bb54e64ab7bebb9848eda2f484f7d16b2bb1b052c9f4d"' + - "RAINDROP_KEY=1cc5720db4892d1636b453967b348c08cb90ef77baf7d53dd0d2e6bec64880f1702cf36b14de94c56d772efe62349a5cd" + history: + - 2026-03-27 initial version + refs: + - https://www.raindrop.ai/docs/sdk/http-api#authentication diff --git a/pkg/rules/readmeio.yaml b/pkg/rules/readmeio.yaml new file mode 100644 index 0000000..7e284a7 --- /dev/null +++ b/pkg/rules/readmeio.yaml @@ -0,0 +1,27 @@ +rules: + - name: Readme.io API Key + id: ghost.readmeio.1 + description: ReadMe.io API key + tags: + - api + - readmeio + pattern: | + (?x) + \b + (rdme_(?i)[A-Z0-9]{70}) + \b + entropy: 3.5 + redact: [8, 4] + tests: + assert: + - rdme_xn8s9h25591dd12be975c84bfed0e62757c52d2b0cf4a5accdce7ac24a3bbc3e53d520 + - rdme_xn8s9hf98e484695211ea342539e7bfc9ab08c2415260a318f3366ee58dcdc9bd0c9d3 + - rdme_xn8s9h4e7f33c9e6a359a6d322bf7dda66d3ee6c0761500a32b9b49d6d88d9d8ba181e + assert_not: + - rdme_xn8s9h25591dd12be975c84bfed0e62757c52d2b0cf4a5accdce7ac24a3bbc3e53d520x + - rdme_xn8s9hf98e484695211ea342539e7b-c9ab08c2415260a318f3366ee58dcdc9bd0c9d3 + - rdme_xn8s9h4e7f33c9e6a359a6d322bf7dda66d3ee6c0761500a32b9b49d6d88d9d8ba181 + history: + - 2026-03-28 initial version + refs: + - https://docs.readme.com/main/reference/authentication diff --git a/pkg/rules/sendbird.yaml b/pkg/rules/sendbird.yaml new file mode 100644 index 0000000..35e5860 --- /dev/null +++ b/pkg/rules/sendbird.yaml @@ -0,0 +1,33 @@ +rules: + - name: Sendbird API Key + id: ghost.sendbird.1 + description: Sendbird API key variable declaration. + tags: + - api + - sendbird + pattern: | + (?x) + \b + ( + (?i)sendbird\w*(?:token|key|secret)\w* + [\W]{0,40}? + [a-f0-9]{40} + ) + \b + redact: [20, 4] + entropy: 3.5 + tests: + assert: + - "SENDBIRD_KEY=3cb4a43feb676d8f8ffe1c3153905fe99b37aad7" + - "SENDBIRD_TOKEN=0c570ad597eea60692b46d66584f7095d2599c1f" + - "let sendbirdApiKey = 8d642762930554af9abb1c8bac460169a2b5c616" + - "const sendbirdToken = 1d02b8254f25f2b60af540dd41cb46c5e6bb0f5e" + assert_not: + - "SENDBIRD_KEY=3cb4a43feb676d8f8ffe1c3153905fe99b37aaz7" + - "SENDBIRD_TOKEN=0c570ad597eea60692b46d66584f7095d2599c1" + - "let sendbirdApiKey = 8d642762930554af9abb1c8-ac460169a2b5c616" + - "const sendbirdToken = 1d02b8254f25f2b60af540dd41cb46c5e6bb0f5exxx" + history: + - 2026-03-28 initial version + refs: + - https://sendbird.com/docs/chat/platform-api/v3/prepare-to-use-api diff --git a/pkg/rules/sonarqube.yaml b/pkg/rules/sonarqube.yaml new file mode 100644 index 0000000..d92fdd7 --- /dev/null +++ b/pkg/rules/sonarqube.yaml @@ -0,0 +1,62 @@ +rules: + - name: SonarQube PAT + id: ghost.sonarqube.1 + description: SonarQube Personal Access Token variable declaration. + tags: + - api + - sonarqube + - pat + pattern: | + (?x) + \b + ( + (?i)sonar\w*(?:token|key|secret)\w* + [\W]{0,40}? + [a-f0-9]{40} + ) + \b + redact: [20, 4] + entropy: 4.1 + tests: + assert: + - "SONARQUBE_TOKEN=fdfa0411cc61d63a812e28c8ff1d105c449eb2b6" + - "SONAR_TOKEN=fdfa0411cc61d63a812e28c8ff1d105c449eb2b6" + - "let sonarqubeApiKey = 291730f7fe18deadc15ae79eeb2aca5b00812122" + - "const sonarQubeToken = 3cce61edfd0794f69b1c338dd75efe8bf6923557" + assert_not: + - "SONARQUBE=fdfa0411cc61d63a812e28c8ff1d105c449eb2b6" + - "let sonarqubeApiKey = 291730f7fe18deadc15ae79eeb2aca5b0081212" + - "const sonarQubeToken = 3cce61edfd0794f69b1c338dd75efe8bf6923557x" + history: + - 2026-03-28 initial version + refs: + - https://docs.influxdata.com/influxdb/cloud/admin/tokens/ + - name: SonarQube Scoped Access Token + id: ghost.sonarqube.2 + description: SonarQube Scoped Access Token + tags: + - api + - sonarqube + - token + pattern: | + (?x) + \b + ( + (sqco_(?i)[A-Z0-9]{59}) + ) + \b + redact: [8, 4] + entropy: 4.5 + tests: + assert: + - sqco_CaF1swqmEKeziPpYbWAmST0b24vlynPZk5tdsLnWL16i1i9cOTjVVr7YNzq + - sqco_j6ZSGozSQZqBB2c2cwq597b5ejoPfP41B6EK6ozU6GisgnYBTEeBN64sUqY + - sqco_wr11vcXlByW8ZSVuBpAEH4DFeZQcxYfrN7r3VcTaqjSlII79hhOA4bZMbhQ + assert_not: + - sqcx_CaF1swqmEKeziPpYbWAmST0b24vlynPZk5tdsLnWL16i1i9cOTjVVr7YNzq + - sqco_j6ZSGozSQZqBB2c2cwq597b5ejoPfP41B6EK6ozU6GisgnYBTEeBN64sUqYx + - sqco_wr11vcXlByW8ZSVuBpAEH4DFeZQcxYfrN7r3VcTaqjSlII79hhOA4bZMbh + history: + - 2026-03-28 initial version + refs: + - https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/managing-organization/scoped-organization-tokens