Packages / Cloud Platform Credentials
Credentials and secrets for public-cloud control planes, workloads, identities, and managed services.
Detects Azure App Service deployment passwords in configuration files and publish profiles. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Batch account shared access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Container Registry (ACR) access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Databricks personal access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Event Grid access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Functions master key and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub shared access key patterns outside of connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Logic App shared access signature (SAS) URL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Maps subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure publish settings file password patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure shared access key and webhook token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account access key patterns in connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects generic Azure Storage account key patterns including keys assigned to variables or configuration properties. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account key patterns outside of full connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for high-risk resources with write or delete permissions. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for standard resources. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure subscription management certificate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects AWS Access Key patterns.
Detects AWS Secret Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Cloudflare API tokens - 40-character tokens that authenticate to the Cloudflare API. Because the raw token has no distinctive prefix, this pattern gates on nearby Cloudflare context to keep false positives low.
Detects DigitalOcean personal access tokens (dop_v1_ prefix). These tokens authenticate to the DigitalOcean API and can manage droplets, databases, DNS and billing; a leak enables full account control.
Detects GCP Api Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects GCP service-account JSON key files, distinguishing bare type=service_account record markers (discovery only) from complete keys whose object also carries an escaped PEM private_key and a .iam.gserviceaccount.com client_email (enforcing), with project_id/private_key_id as additional high-confidence evidence.
Detects Heroku platform API keys in the prefixed HRKU- form. These keys authenticate to the Heroku Platform API and can deploy apps, read config vars and manage add-ons; a leak enables full account compromise.
Detects embedded credentials inside a Kubernetes kubeconfig file - base64 client certificate / key data blocks and inline bearer tokens. A leaked kubeconfig grants cluster access at the scope of the embedded identity.
Detects Netlify authentication tokens: the current nf-prefixed family announced by Netlify in November 2023 (nfp_ personal access tokens, nfc_ CLI tokens, nfo_ OAuth tokens, nfu_ app.netlify.com tokens, nfb_ build tokens) and, when labelled with Netlify context, the legacy unprefixed 43-45 character token form that remains valid. A leaked token grants control of the account's sites, deploys and environment variables.
Detects Supabase credentials: personal access tokens (sbp_), the new opaque secret API keys (sb_secret_) introduced in 2025 to replace the legacy service_role JWT, and, when labelled with Supabase context in an assignment, the legacy anon/service_role JWT keys that remain valid until late 2026. A leaked secret key or service_role JWT grants full admin access to the project's production Postgres database, bypassing Row Level Security; a leaked personal access token grants account-wide Management API control.
Detects Vercel credentials: the current prefixed token family introduced in February 2026 (vcp_ personal access tokens, vci_ integration tokens, vca_ app access tokens, vcr_ app refresh tokens, vck_ API keys), Vercel Blob read-write tokens (vercel_blob_rw_), and, when labelled with Vercel context in an assignment, the legacy unprefixed 24-character token form. A leaked token grants control of the account's projects, deployments and environment variables; a leaked Blob token grants read/write access to the associated storage.
Detects S3 and S3A URI references in source code or configuration files when accompanied by AWS credential context. S3 URIs alone are high-FP enumeration signals; this pattern only fires at 75+ confidence when AWS credential evidence (access key, secret, AKIA prefix) is present within 300 characters. URI-only matches surface at 65 as discovery inventory. Mirrors Snaffler rule KeepS3UriPrefixInCode.