Atlassian API Token
Detects Atlassian API tokens (ATATT3 prefix), used for Jira, Confluence and other Atlassian Cloud REST APIs. A leaked token grants the associated user's access to projects, issues, wiki content and attachments.
Packages / SaaS And API Credentials
SaaS And API Credentials
API keys, application secrets, access tokens, and credentials for hosted business services.
- Patterns
- 17
- As primary component
- 17
Patterns in this package
Auth0 Token
Detects Auth0 client secrets. Auth0 issues an unprefixed 64-character base64url-style client secret, indistinguishable from other long random strings, so this pattern requires an adjacent Auth0 label plus an assignment separator to structurally qualify a match. A leaked client secret lets an attacker mint tokens as the application and impersonate it against every API it is authorized for.
Datadog API Key
Detects Datadog API keys, which are 32 hexadecimal characters with no fixed prefix. Because a bare 32-hex string is generic, this pattern requires a nearby Datadog label to confirm the match. A leaked key grants metric, log and event ingestion access.
Discord Bot Token
Detects Discord bot tokens: three dot-separated base64url segments where the first segment is the bot's numeric snowflake ID base64-encoded (always starting M, N, or O because it encodes an ASCII digit), the second is a 6-character timestamp, and the third is an HMAC of 27 to 38 characters. A leaked bot token grants full control of the bot account, including reading every channel the bot can see and sending messages as the bot.
Grafana API Key
Detects Grafana Cloud API tokens (glc_ prefix) and Grafana service account tokens (glsa_ prefix). A leaked token grants access to dashboards, data sources and, for Grafana Cloud, metrics/logs ingestion endpoints.
Mailchimp API Key
Detects Mailchimp API keys, formatted as 32 hex characters followed by -us and a 1-2 digit datacenter code. A leaked key grants access to audience lists, campaigns and subscriber PII.
Mailgun API Key
Detects Mailgun private API keys (key- prefix followed by 32 hex characters). A leaked key allows sending email and accessing logs and account data via the Mailgun API.
Microsoft Bing Maps Key
Detects Microsoft Bing Maps API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
New Relic API Key
Detects New Relic user API keys (NRAK- prefix followed by 27 characters). A leaked key grants access to the New Relic GraphQL (NerdGraph) API and account telemetry.
Notion Token
Detects Notion integration tokens in both live formats: the current ntn_ prefix (issued to all new integrations since 25 September 2024) and, when labelled with Notion context, the legacy secret_ prefix (existing tokens remain valid indefinitely). A leaked integration token grants API access to every page and database the integration has been connected to.
Okta API Token
Detects Okta API-token candidates, which begin with 00 and are followed by 40 base64url characters. Okta or SSWS context is required for enforcement because the 42-character shape can represent unrelated identifiers; the bare value shape surfaces only as discovery inventory. A leaked token grants Okta admin API access.
SendGrid API Key
Detects SendGrid (Twilio SendGrid) API keys, formatted as SG. then a 22-character key id, a dot, and a 43-character secret. A leaked key allows sending email and reading account data through the SendGrid API.
Sentry Token
Detects Sentry auth tokens: organization tokens (sntrys_), user auth tokens (sntryu_), the user-app and internal-integration prefixes from Sentry's own token-type source (sntrya_, sntryi_), and, when labelled with Sentry context in an assignment, the legacy unprefixed 64-hex tokens issued before prefixing. A leaked token grants API access to error and performance data -- which routinely embeds further secrets, PII, and source context -- and to release/CI operations. Sentry DSNs are explicitly NOT matched: Sentry documents DSNs as safe to keep public.
Slack Token
Detects Slack Token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Telegram Bot Token
Detects Telegram Bot API tokens: the numeric bot ID, a colon, and a 35-character [A-Za-z0-9_-] secret. A leaked bot token grants full control of the bot -- reading its message traffic, sending messages to every chat it belongs to, and hijacking any workflow automation built on it.
Domain registrar credentials
Detects domain registrar credentials: registrar account or transfer-code wording with populated login, password, PIN, API key or EPP/auth code values for managed domains. Topic wording alone is discovery-only.
Twilio API Key
Detects Twilio API key SIDs (SK prefix followed by 32 hex characters). Paired with its secret, a leaked Twilio API key allows sending SMS/voice and accessing account data and call logs.