Packages / DevOps And Supply Chain Credentials
Source-control, CI/CD, package registry, signing, build, and software supply-chain secrets.
Detects Azure DevOps application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DevOps personal access token (PAT) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects CircleCI personal access tokens (CCIPAT_ prefix). These tokens authenticate to the CircleCI API and can read/modify pipelines, contexts and project settings; a leak enables CI/CD compromise.
Detects Docker Hub personal access tokens (dckr_pat_ prefix). These tokens authenticate to Docker Hub and can pull/push images; a leak enables image tampering and supply-chain compromise.
Detects GitHub Fine-Grained PAT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Github Pat patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects GitLab deploy tokens (gldt- prefix). Deploy tokens grant read/write access to a project's repository, container registry and package registry; a leak enables artifact theft or tampering.
Detects GitLab personal access tokens (glpat- prefix). A leaked PAT grants repository, CI/CD pipeline and package-registry access scoped to the issuing user.
Detects GitLab pipeline trigger tokens (glptt- prefix). These tokens let external systems start CI/CD pipelines via the trigger API; a leak allows unauthorized pipeline execution.
Detects GitLab runner authentication tokens (glrt- prefix). These tokens authenticate a CI/CD runner to a GitLab instance; a leak lets an attacker impersonate a runner and capture job payloads.
Detects bounded npm access-token values (npm_ prefix, fixed 36-character body) and credential-bearing .npmrc authToken assignments; documentation and placeholder examples remain excluded. These tokens authenticate to the npm registry and can publish, unpublish or grant access to packages; a leak enables supply-chain attacks via malicious publishes.
Detects NuGet.org API keys (oy2 prefix), used to push packages to the NuGet gallery. A leaked key lets an attacker publish or unlist packages under the owner's account.
Detects PyPI (Python Package Index) upload tokens. The fixed marker pypi-AgEIcHlwaS5vcmc is the base64 encoding of "pypi.org", making these tokens near-unmistakable. A leaked token lets an attacker publish malicious package releases.
Detects RubyGems.org API keys (rubygems_ prefix), used to push gems. A leaked key lets an attacker publish or yank gems under the owner's account.
Detects HashiCorp Terraform Cloud / Terraform Enterprise API tokens (atlasv1 format). These tokens authenticate to the Terraform Cloud API and can read/write workspace state and variables; a leak can expose all infrastructure secrets.
Detects embedded credentials (username:password) in Git repository URLs. Mirrors Snaffler rule KeepGitCredsByName.
Detects secrets embedded in Infrastructure as Code files including Terraform/HCL variable assignments and Azure Cloud Service configuration (.cscfg) XML settings. Mirrors Snaffler rule KeepInfraAsCodeByExtension.
Detects Jenkins-encrypted credential values in the {base64...} format used by Jenkins credentials.xml and similar configuration files. Mirrors Snaffler rule KeepJenkinsByName.