{"object":"secret_rules","pack_version":"2026.07.16","updated":"2026-07-16","rules":[{"rule_id":"aws-access-key-id","provider":"AWS","category":"cloud","severity":"high","description":"AWS access key id (AKIA/ASIA/… + 16 base32 chars)","entropy_gated":false,"has_validator":true},{"rule_id":"aws-secret-access-key","provider":"AWS","category":"cloud","severity":"high","description":"AWS secret access key (40-char base64, context-gated)","entropy_gated":true,"has_validator":false},{"rule_id":"gcp-api-key","provider":"Google","category":"cloud","severity":"high","description":"Google API key (AIza + 35 chars)","entropy_gated":false,"has_validator":false},{"rule_id":"gcp-oauth-client-secret","provider":"Google","category":"cloud","severity":"high","description":"Google OAuth client secret (GOCSPX- prefix)","entropy_gated":false,"has_validator":false},{"rule_id":"gcp-service-account-key","provider":"Google","category":"cloud","severity":"high","description":"GCP service-account JSON private_key marker","entropy_gated":false,"has_validator":false},{"rule_id":"azure-storage-key","provider":"Azure","category":"cloud","severity":"high","description":"Azure storage account connection string with AccountKey","entropy_gated":false,"has_validator":false},{"rule_id":"digitalocean-token","provider":"DigitalOcean","category":"cloud","severity":"high","description":"DigitalOcean personal access / OAuth token","entropy_gated":false,"has_validator":false},{"rule_id":"heroku-api-key","provider":"Heroku","category":"cloud","severity":"medium","description":"Heroku API key (UUID, context-gated)","entropy_gated":false,"has_validator":false},{"rule_id":"datadog-api-key","provider":"Datadog","category":"cloud","severity":"medium","description":"Datadog API key (32 hex, context-gated)","entropy_gated":false,"has_validator":false},{"rule_id":"github-pat","provider":"GitHub","category":"vcs","severity":"high","description":"GitHub personal access / app token (ghp_/gho_/… / github_pat_)","entropy_gated":false,"has_validator":false},{"rule_id":"gitlab-pat","provider":"GitLab","category":"vcs","severity":"high","description":"GitLab personal / project access token (glpat-)","entropy_gated":false,"has_validator":false},{"rule_id":"npm-token","provider":"npm","category":"vcs","severity":"high","description":"npm access token (npm_)","entropy_gated":false,"has_validator":false},{"rule_id":"pypi-token","provider":"PyPI","category":"vcs","severity":"high","description":"PyPI upload token (pypi-)","entropy_gated":false,"has_validator":false},{"rule_id":"dockerhub-pat","provider":"Docker","category":"vcs","severity":"high","description":"Docker Hub personal access token (dckr_pat_)","entropy_gated":false,"has_validator":false},{"rule_id":"stripe-secret-key","provider":"Stripe","category":"payment","severity":"high","description":"Stripe live secret / restricted key (sk_live_/rk_live_)","entropy_gated":false,"has_validator":false},{"rule_id":"stripe-test-key","provider":"Stripe","category":"payment","severity":"medium","description":"Stripe TEST secret key (sk_test_/rk_test_) — lower risk","entropy_gated":false,"has_validator":false},{"rule_id":"stripe-publishable-key","provider":"Stripe","category":"payment","severity":"low","description":"Stripe publishable key (pk_live_/pk_test_) — safe to publish","entropy_gated":false,"has_validator":false},{"rule_id":"square-access-token","provider":"Square","category":"payment","severity":"high","description":"Square production access token (sq0atp-/EAAA…)","entropy_gated":false,"has_validator":false},{"rule_id":"paypal-braintree-token","provider":"Braintree","category":"payment","severity":"high","description":"Braintree/PayPal access token","entropy_gated":false,"has_validator":false},{"rule_id":"slack-token","provider":"Slack","category":"messaging","severity":"high","description":"Slack API token (xoxb-/xoxp-/xoxa-/xoxr-/xoxs-/xapp-)","entropy_gated":false,"has_validator":false},{"rule_id":"slack-webhook","provider":"Slack","category":"messaging","severity":"medium","description":"Slack incoming-webhook URL","entropy_gated":false,"has_validator":false},{"rule_id":"discord-bot-token","provider":"Discord","category":"messaging","severity":"high","description":"Discord bot token","entropy_gated":false,"has_validator":false},{"rule_id":"discord-webhook","provider":"Discord","category":"messaging","severity":"medium","description":"Discord webhook URL","entropy_gated":false,"has_validator":false},{"rule_id":"twilio-api-key","provider":"Twilio","category":"messaging","severity":"high","description":"Twilio account SID / API key SID (AC…/SK…)","entropy_gated":false,"has_validator":false},{"rule_id":"sendgrid-api-key","provider":"SendGrid","category":"messaging","severity":"high","description":"SendGrid API key (SG.…)","entropy_gated":false,"has_validator":false},{"rule_id":"mailgun-api-key","provider":"Mailgun","category":"messaging","severity":"high","description":"Mailgun API key (key-…)","entropy_gated":false,"has_validator":false},{"rule_id":"mailchimp-api-key","provider":"Mailchimp","category":"messaging","severity":"high","description":"Mailchimp API key (32hex-usNN)","entropy_gated":false,"has_validator":false},{"rule_id":"telegram-bot-token","provider":"Telegram","category":"messaging","severity":"high","description":"Telegram bot token (id:AA…)","entropy_gated":false,"has_validator":false},{"rule_id":"openai-api-key","provider":"OpenAI","category":"ai","severity":"high","description":"OpenAI API key (sk-…/sk-proj-…)","entropy_gated":false,"has_validator":false},{"rule_id":"anthropic-api-key","provider":"Anthropic","category":"ai","severity":"high","description":"Anthropic API key (sk-ant-…)","entropy_gated":false,"has_validator":false},{"rule_id":"huggingface-token","provider":"HuggingFace","category":"ai","severity":"high","description":"Hugging Face access token (hf_…)","entropy_gated":false,"has_validator":false},{"rule_id":"groq-api-key","provider":"Groq","category":"ai","severity":"high","description":"Groq API key (gsk_…)","entropy_gated":false,"has_validator":false},{"rule_id":"db-connection-uri-password","provider":"Generic","category":"db","severity":"high","description":"DB connection URI with an inline password (postgres/mysql/mongo/redis/…)","entropy_gated":false,"has_validator":false},{"rule_id":"basic-auth-url-password","provider":"Generic","category":"db","severity":"medium","description":"HTTP(S) URL with inline basic-auth credentials","entropy_gated":false,"has_validator":false},{"rule_id":"private-key-block","provider":"Generic","category":"pki","severity":"high","description":"PEM private-key header (RSA/EC/OPENSSH/DSA/PGP/generic)","entropy_gated":false,"has_validator":false},{"rule_id":"ssh-private-key-putty","provider":"Generic","category":"pki","severity":"high","description":"PuTTY private key header","entropy_gated":false,"has_validator":false},{"rule_id":"jwt","provider":"Generic","category":"pki","severity":"medium","description":"JSON Web Token (eyJ… header.payload.signature)","entropy_gated":false,"has_validator":false},{"rule_id":"generic-assigned-secret","provider":"Generic","category":"generic","severity":"medium","description":"key/secret/token/password = <high-entropy value>","entropy_gated":true,"has_validator":false},{"rule_id":"generic-bearer-token","provider":"Generic","category":"generic","severity":"medium","description":"Authorization: Bearer <high-entropy value>","entropy_gated":true,"has_validator":false}],"rules_total":39,"providers":["AWS","Anthropic","Azure","Braintree","Datadog","DigitalOcean","Discord","Docker","Generic","GitHub","GitLab","Google","Groq","Heroku","HuggingFace","Mailchimp","Mailgun","OpenAI","PyPI","SendGrid","Slack","Square","Stripe","Telegram","Twilio","npm"],"categories":["cloud","vcs","payment","messaging","ai","db","pki","generic"],"counts_by_category":{"ai":4,"cloud":9,"db":2,"generic":2,"messaging":9,"payment":5,"pki":3,"vcs":5},"counts_by_severity":{"high":29,"medium":9,"low":1},"output_modes":["scan","diff"],"verdicts":["pass","caution","block"],"limits":{"max_input_bytes":262144,"max_files":100,"max_findings":1000},"provenance":"Provider prefixes/formats are public facts about how each vendor shapes its credentials, cross-referenced against the open gitleaks taxonomy (MIT) for WHICH providers exist. No third-party rule file is imported or vendored; every regex is our own. The engine is a lightweight stdlib re + Shannon-entropy matcher.","non_goal":"Liveness-probe is a deliberate NON-GOAL: we never call the provider to check whether a found key is active — that would add a network + SSRF + unauthorized-access surface. The verdict is PURE-STATIC.","disclaimer":"Automated secret indicators, not a guarantee. Detects hardcoded credentials via deterministic patterns + entropy on the text YOU supply; it does NOT verify a key is live (no network probe), and an absence of findings is NOT proof the code is secret-free. Always review before relying on the result.","note":"Freshness = a data update of the rule registry (no live daemon). The paid /secret/scan and /secret/diff routes match against this pack."}