Packages / Security Credentials And Secrets
Passwords, API keys, tokens, certificates, private keys, and credential material.
Detects secrets and credentials surfaced in AI/LLM context: private-key headers (RSA / EC / OpenSSH / generic) and connection-string passwords (password= / pwd=) pasted into prompts, chat exports, or AI-generated output. Reuses the intent of built-in credential SITs, re-scoped to the AI surface.
Detects Azure App Service deployment passwords in configuration files and publish profiles. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Batch account shared access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Bot Framework secret key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Bot Service application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cognitive Search (AI Search) API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cognitive Services subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Container Registry (ACR) access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cosmos DB account access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Databricks personal access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DevOps application secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DevOps personal access token (PAT) patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure DocumentDB (now Cosmos DB) authentication key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) client access token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) client secret patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Microsoft Entra (formerly Azure AD) user credential patterns including username/password combinations targeting Microsoft login endpoints. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Event Grid access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Functions master key and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IaaS database and Azure SQL connection string patterns containing credentials. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure IoT Hub shared access key patterns outside of connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Logic App shared access signature (SAS) URL patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Machine Learning web service API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Maps subscription key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure publish settings file password patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string password patterns extracted from connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Cache for Redis connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus connection string patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Shared Access Signature (SAS) token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure shared access key and webhook token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SignalR Service access key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure SQL Database connection string patterns specifically targeting the .database.windows.net domain. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account access key patterns in connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects generic Azure Storage account key patterns including keys assigned to variables or configuration properties. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage account key patterns outside of full connection strings. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for high-risk resources with write or delete permissions. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Account Shared Access Signature (SAS) patterns for standard resources. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure subscription management certificate patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects documents containing credential-related terminology. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based bundled detector that aggregates multiple credential SITs. This keyword-based version flags documents that may contain credentials for further review.
Detects Anthropic (Claude) API keys. Standard keys use the sk-ant-api03- prefix followed by a long base64url body ending in AA; admin keys use sk-ant-admin01-. A leaked key grants billed access to the Anthropic API and any connected data.
Detects ASP.NET Machine Key patterns in configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Atlassian API tokens (ATATT3 prefix), used for Jira, Confluence and other Atlassian Cloud REST APIs. A leaked token grants the associated user's access to projects, issues, wiki content and attachments.
Detects Auth0 client secrets. Auth0 issues an unprefixed 64-character base64url-style client secret, indistinguishable from other long random strings, so this pattern requires an adjacent Auth0 label plus an assignment separator to structurally qualify a match. A leaked client secret lets an attacker mint tokens as the application and impersonate it against every API it is authorized for.
Detects AWS Access Key patterns.
Detects AWS Secret Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Service Bus Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Connection String patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Azure Storage Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects JWT-shaped values presented with the Bearer authentication scheme. A bare scheme/value pair is discovery-only; an Authorization header enforces at medium confidence and a complete HTTP request or response context reaches high.
Detects Binance API keys, which are 64-character case-sensitive alphanumeric strings with no distinctive prefix. Because a bare 64-char alphanumeric token is generic (it collides with any random token of that length), this pattern is context-gated: it requires a nearby Binance label and an assignment (= or :) before the value. A leaked key grants API access to the account (trading and, if enabled, withdrawal).
Detects a BIP-39 mnemonic (crypto wallet recovery / seed phrase): a run of 11-24 space-separated lowercase words. Because the full 2048-word BIP-39 list cannot be embedded in a single regex, detection fires either when the word run is explicitly labelled as a seed/mnemonic/recovery phrase, or when the run contains one of a set of distinctive BIP-39 anchor words. A leaked seed phrase grants full, irreversible control of the wallet's funds.
Detects Braintree (PayPal) OAuth access tokens, which use a distinctive literal dollar-delimited structure: access_token$<environment>$<merchant-id>$<token>. A leaked token allows payment processing and transaction-history access on the connected merchant's behalf.
Detects CircleCI personal access tokens (CCIPAT_ prefix). These tokens authenticate to the CircleCI API and can read/modify pipelines, contexts and project settings; a leak enables CI/CD compromise.
Detects documents containing client secret and API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad bundled detector. This keyword-based version flags documents that may contain client secrets or API keys for further review.
Detects Cloudflare API tokens - 40-character tokens that authenticate to the Cloudflare API. Because the raw token has no distinctive prefix, this pattern gates on nearby Cloudflare context to keep false positives low.
Detects Cohere API keys. Cohere issues an opaque 40-character alphanumeric token with no distinctive vendor prefix, so this pattern requires an adjacent Cohere label (cohere / CO_API_KEY / COHERE_API_KEY) to structurally qualify a match.
Detects Coinbase Developer Platform (CDP) API key names, which use the distinctive resource-path form organizations/{org-uuid}/apiKeys/{key-uuid}. This key name is paired with an EC/ECDSA (or Ed25519) signing secret and is used to mint ES256 JWTs for the Coinbase API. A leaked CDP key can grant programmatic access to accounts, trading and funds. The associated EC PRIVATE KEY PEM secret is detected separately by global-ec-private.
Detects credential combolist / infostealer-log lines: email:password pairs and host-or-url:user:pass triples, the format in which stolen credentials are aggregated and traded after info-stealer infections. These dumps fuel credential stuffing and account-takeover attacks. A lone email/password candidate is discovery-only; service-bound triples and multi-row dump structure support enforcement.
Detects Datadog API keys, which are 32 hexadecimal characters with no fixed prefix. Because a bare 32-hex string is generic, this pattern requires a nearby Datadog label to confirm the match. A leaked key grants metric, log and event ingestion access.
Detects DigitalOcean personal access tokens (dop_v1_ prefix). These tokens authenticate to the DigitalOcean API and can manage droplets, databases, DNS and billing; a leak enables full account control.
Detects Discord bot tokens: three dot-separated base64url segments where the first segment is the bot's numeric snowflake ID base64-encoded (always starting M, N, or O because it encodes an ASCII digit), the second is a 6-character timestamp, and the third is an HMAC of 27 to 38 characters. A leaked bot token grants full control of the bot account, including reading every channel the bot can see and sending messages as the bot.
Detects Docker Hub personal access tokens (dckr_pat_ prefix). These tokens authenticate to Docker Hub and can pull/push images; a leak enables image tampering and supply-chain compromise.
Detects SEC1 elliptic-curve private-key armor. The BEGIN marker is discovery-only, a SEC1-like Base64 body supports medium confidence, and a complete container with curve or signing context reaches high confidence.
Detects Elasticsearch URI with Credentials patterns.
Detects GCP Api Key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects GCP service-account JSON key files, distinguishing bare type=service_account record markers (discovery only) from complete keys whose object also carries an escaped PEM private_key and a .iam.gserviceaccount.com client_email (enforcing), with project_id/private_key_id as additional high-confidence evidence.
Detects general password patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain passwords for further review.
Detects general symmetric encryption key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain symmetric keys for further review.
Detects database connection URLs with embedded user:password@host credentials, restricted to database schemes (mongodb/mongodb+srv, postgres/postgresql, mysql, redis/rediss, mssql/sqlserver, oracle, jdbc). Placeholder passwords and localhost/example hosts are rejected; non-database credential URLs (AMQP, LDAP, FTP) belong to a separate service-URL credential classifier.
Detects GitHub Fine-Grained PAT patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Github Pat patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects GitLab deploy tokens (gldt- prefix). Deploy tokens grant read/write access to a project's repository, container registry and package registry; a leak enables artifact theft or tampering.
Detects GitLab personal access tokens (glpat- prefix). A leaked PAT grants repository, CI/CD pipeline and package-registry access scoped to the issuing user.
Detects GitLab pipeline trigger tokens (glptt- prefix). These tokens let external systems start CI/CD pipelines via the trigger API; a leak allows unauthorized pipeline execution.
Detects GitLab runner authentication tokens (glrt- prefix). These tokens authenticate a CI/CD runner to a GitLab instance; a leak lets an attacker impersonate a runner and capture job payloads.
Detects Grafana Cloud API tokens (glc_ prefix) and Grafana service account tokens (glsa_ prefix). A leaked token grants access to dashboards, data sources and, for Grafana Cloud, metrics/logs ingestion endpoints.
Detects Groq (GroqCloud) API keys, which use a distinctive gsk_ prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to Groq's hosted inference API and any prompts or data routed through it.
Detects HashiCorp Vault service tokens (hvs. prefix) and batch tokens (hvb. prefix). These tokens authenticate to a Vault server and can read secrets, keys and credentials. A bare prefixed candidate is discovery-only; binding fields and Vault auth-response metadata provide balanced and high-confidence enforcement.
Detects Heroku platform API keys in the prefixed HRKU- form. These keys authenticate to the Heroku Platform API and can deploy apps, read config vars and manage add-ons; a leak enables full account compromise.
Detects HTTP Authorization header patterns containing Bearer tokens, Basic credentials, and other authentication schemes. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Hugging Face user access tokens (hf_ prefix), used to authenticate to the Hugging Face Hub API. A leaked token grants access to private models, datasets and Spaces, and can incur inference billing.
Detects JSON Web Token candidates with three Base64url segments. A generic encoded-JSON candidate is discovery-only; a standard encoded algorithm header plus encoded JSON payload enforces at medium confidence, and HTTP or session transport binding raises the result to high confidence.
Detects Kraken REST API credentials: the public API key (56 base64 characters) and the private key / API secret (86-88 base64 characters, base64 of 64 bytes). Because base64 strings have no distinctive prefix, this pattern is context-gated: it requires a nearby Kraken label and an assignment (= or :) before the value. A leaked private key allows signing authenticated requests to the account.
Detects embedded credentials inside a Kubernetes kubeconfig file - base64 client certificate / key data blocks and inline bearer tokens. A leaked kubeconfig grants cluster access at the scope of the embedded identity.
Detects LangSmith API keys (personal access tokens and service keys), which use a distinctive lsv2_pt_ or lsv2_sk_ prefix followed by a hyphenated hex body. A leaked key grants unauthorized access to LangSmith trace data -- which can include full LLM prompts and completions -- and billed access to the LangSmith/LangChain platform.
Detects Mailchimp API keys, formatted as 32 hex characters followed by -us and a 1-2 digit datacenter code. A leaked key grants access to audience lists, campaigns and subscriber PII.
Detects Mailgun private API keys (key- prefix followed by 32 hex characters). A leaked key allows sending email and accessing logs and account data via the Mailgun API.
Detects Microsoft Bing Maps API key patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Mongodb patterns.
Detects Mysql patterns.
Detects Netlify authentication tokens: the current nf-prefixed family announced by Netlify in November 2023 (nfp_ personal access tokens, nfc_ CLI tokens, nfo_ OAuth tokens, nfu_ app.netlify.com tokens, nfb_ build tokens) and, when labelled with Netlify context, the legacy unprefixed 43-45 character token form that remains valid. A leaked token grants control of the account's sites, deploys and environment variables.
Detects New Relic user API keys (NRAK- prefix followed by 27 characters). A leaked key grants access to the New Relic GraphQL (NerdGraph) API and account telemetry.
Detects Notion integration tokens in both live formats: the current ntn_ prefix (issued to all new integrations since 25 September 2024) and, when labelled with Notion context, the legacy secret_ prefix (existing tokens remain valid indefinitely). A leaked integration token grants API access to every page and database the integration has been connected to.
Detects bounded npm access-token values (npm_ prefix, fixed 36-character body) and credential-bearing .npmrc authToken assignments; documentation and placeholder examples remain excluded. These tokens authenticate to the npm registry and can publish, unpublish or grant access to packages; a leak enables supply-chain attacks via malicious publishes.
Detects NuGet.org API keys (oy2 prefix), used to push packages to the NuGet gallery. A leaked key lets an attacker publish or unlist packages under the owner's account.
Detects Okta API-token candidates, which begin with 00 and are followed by 40 base64url characters. Okta or SSWS context is required for enforcement because the 42-character shape can represent unrelated identifiers; the bare value shape surfaces only as discovery inventory. A leaked token grants Okta admin API access.
Detects Openai Key patterns.
Detects OpenSSH private-key armor. The fixed BEGIN line alone is discovery-only; the encoded openssh-key-v1 container magic supports medium confidence and normally wrapped near-header body lines support high confidence.
Detects Oracle Connection String patterns.
Detects Perplexity API keys, which use a distinctive pplx- prefix followed by a 48-character alphanumeric body. A leaked key grants unauthorized, billed access to Perplexity's search and chat completion API and any prompts or data routed through it.
Detects the ASCII-armored header of an OpenPGP (PGP/GnuPG) private key block, as defined in RFC 4880 / RFC 9580. A leaked PGP private key allows an attacker to decrypt the holder's encrypted mail and files and to forge signatures in their name. The registry already covers RSA, EC, OpenSSH and PKCS#8 private keys; this adds the OpenPGP armor format. Header-only hits are discovery-only; armored packet data near the header provides the enforcement tiers.
Detects Pinecone API keys in both current live formats: pcsk_ (the dominant format issued by the Pinecone console, CLI, and SDK key-creation flows) and pckey_ (the Enterprise-plan Admin API variant, format pckey_<public-label>_<unique-key>). A leaked key grants unauthorized access to a Pinecone vector database, including any embeddings or vectorised source data it stores.
Detects unencrypted PKCS#8 private-key armor. The generic BEGIN PRIVATE KEY marker is discovery-only; a DER algorithm prelude supports medium confidence, and near-header wrapped body data or an exact compact-key prelude reaches high.
Detects Plaid API credentials: Item access tokens (access-sandbox-/access-production- followed by an RFC 4122 UUID) and, when labelled with Plaid context, the 30-character hex API secret. A leaked access token exposes a user's linked bank account data; a leaked secret compromises the whole Plaid integration.
Detects Postgresql patterns.
Detects the header line of a PuTTY private key file (.ppk), as produced by PuTTYgen. The header begins with 'PuTTY-User-Key-File-' followed by the format version (2 or 3) and the SSH key algorithm. A leaked .ppk grants SSH access to whatever hosts trust the corresponding public key. Header-only candidates are discovery-only; ordered PPK metadata and the first public-blob line support enforcement.
Detects PyPI (Python Package Index) upload tokens. The fixed marker pypi-AgEIcHlwaS5vcmc is the base64 encoding of "pypi.org", making these tokens near-unmistakable. A leaked token lets an attacker publish malicious package releases.
Detects Redis patterns.
Detects Replicate API tokens, which use a distinctive r8_ prefix followed by a fixed-length body of alphanumerics, underscores, and hyphens. A leaked token grants unauthorized, billed access to Replicate's hosted model inference API and any prompts, images, or data routed through it.
Detects PKCS#1 RSA private-key armor. A BEGIN line is discovery-only, the first DER-like Base64 line supports medium confidence, and several normally wrapped body lines near the header support high confidence.
Detects RubyGems.org API keys (rubygems_ prefix), used to push gems. A leaked key lets an attacker publish or yank gems under the owner's account.
Detects SendGrid (Twilio SendGrid) API keys, formatted as SG. then a 22-character key id, a dot, and a 43-character secret. A leaked key allows sending email and reading account data through the SendGrid API.
Detects Sentry auth tokens: organization tokens (sntrys_), user auth tokens (sntryu_), the user-app and internal-integration prefixes from Sentry's own token-type source (sntrya_, sntryi_), and, when labelled with Sentry context in an assignment, the legacy unprefixed 64-hex tokens issued before prefixing. A leaked token grants API access to error and performance data -- which routinely embeds further secrets, PII, and source context -- and to release/CI operations. Sentry DSNs are explicitly NOT matched: Sentry documents DSNs as safe to keep public.
Detects high-value session cookies by name-plus-value: framework and SSO session cookies (ESTSAUTH / ESTSAUTHPERSISTENT, JSESSIONID, PHPSESSID, connect.sid, _session_id, sessionid) assigned a long token value. A captured session cookie lets an attacker resume an authenticated session and bypass MFA entirely. Bare assignments are discovery-only; HTTP cookie framing and response attributes provide the enforcement tiers.
Detects the Shopify access-token family: Admin API access tokens (shpat_), custom app access tokens (shpca_), legacy private app passwords (shppa_) and app shared secrets (shpss_), each followed by a 32-character hex body. A leaked token grants API access to a Shopify store, including customers, orders and payment-adjacent data.
Detects Slack Token patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Snowflake OAuth access and refresh tokens, which carry the recognizable ver:1-hint: / ver:2-hint: prefix used by Snowflake authentication. These tokens (and programmatic access tokens used in their place) grant query and data access to a Snowflake account.
Detects SQL Server patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
Detects Square credential formats: application secrets (sq0csp-, with sandbox- prefixed sandbox variants), legacy personal access tokens (sq0atp-), and current OAuth/personal access tokens (EAAA + 60-character body, context-gated on a nearby Square label because the EAAA base64 shape also occurs in non-Square tokens and encoded blobs). A leaked token or secret enables payment processing and transaction data access in the associated Square account.
Detects Stripe Key patterns.
Detects Supabase credentials: personal access tokens (sbp_), the new opaque secret API keys (sb_secret_) introduced in 2025 to replace the legacy service_role JWT, and, when labelled with Supabase context in an assignment, the legacy anon/service_role JWT keys that remain valid until late 2026. A leaked secret key or service_role JWT grants full admin access to the project's production Postgres database, bypassing Row Level Security; a leaked personal access token grants account-wide Management API control.
Detects Telegram Bot API tokens: the numeric bot ID, a colon, and a 35-character [A-Za-z0-9_-] secret. A leaked bot token grants full control of the bot -- reading its message traffic, sending messages to every chat it belongs to, and hijacking any workflow automation built on it.
Detects HashiCorp Terraform Cloud / Terraform Enterprise API tokens (atlasv1 format). These tokens authenticate to the Terraform Cloud API and can read/write workspace state and variables; a leak can expose all infrastructure secrets.
Identifies plaintext passwords patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies password hash databases patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects password reset tokens and recovery URLs in documents, emails, and logs. Reset tokens are high-risk credentials — a leaked token enables account takeover without knowing the current password. No Microsoft built-in SIT exists for this pattern.
Identifies multi-factor authentication seeds patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies one-time recovery codes patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies oauth client secrets patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies session cookies patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies key-recovery and escrow references, while reserving enforcement for records that contain a structured recovery value. A phrase alone is discovery-only; system identity and custody/escrow fields distinguish a high-confidence recovery-material record.
Identifies references to secrets-vault exports and backups. Product or operation phrases are discovery-only; structured export-record fields support medium confidence and a populated secret entry plus export-manifest metadata supports high.
Identifies database connection strings with credentials patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Identifies kerberos ticket-granting artifacts patterns in security and access control contexts. Detects potential exposure of sensitive security information in international systems.
Detects domain registrar credentials: registrar account or transfer-code wording with populated login, password, PIN, API key or EPP/auth code values for managed domains. Topic wording alone is discovery-only.
Identifies documents containing references to customer account credentials in Australian contexts. This information type is classified as personally identifiable information under applicable data protection regulations.
Detects cryptographic keying material records: keying-material, COMSEC or key-ceremony wording with actual key values (PEM private keys, hex key components) or populated custody details (custodians, HSM serials, KCVs, envelope numbers). Topic wording alone is discovery-only.
Detects Twilio API key SIDs (SK prefix followed by 32 hex characters). Paired with its secret, a leaked Twilio API key allows sending SMS/voice and accessing account data and call logs.
Detects user login credential patterns in documents and configuration files. This pattern is based on a Microsoft Purview built-in sensitive information type. In Purview, this is a broad, function-based detector. This keyword-based version flags documents that may contain login credentials for further review.
Detects Vercel credentials: the current prefixed token family introduced in February 2026 (vcp_ personal access tokens, vci_ integration tokens, vca_ app access tokens, vcr_ app refresh tokens, vck_ API keys), Vercel Blob read-write tokens (vercel_blob_rw_), and, when labelled with Vercel context in an assignment, the legacy unprefixed 24-character token form. A leaked token grants control of the account's projects, deployments and environment variables; a leaked Blob token grants read/write access to the associated storage.
Detects X.509 certificate private key PEM headers. This is a broad pattern covering RSA, EC, PKCS#8, and OpenSSH private key formats. This pattern is based on a Microsoft Purview built-in sensitive information type. For more specific detection, see global-rsa-private, global-ec-private, global-pkcs8-private, and global-openssh-private.
Detects xAI (Grok) API keys, which use a distinctive xai- prefix followed by a long alphanumeric body. A leaked key grants unauthorized, billed access to xAI's Grok models and any prompts or data routed through the API.
Detects credentials and sensitive configuration directives in Cisco IOS/NX-OS configuration files, including enable passwords/secrets, SNMP community strings with write access, PAC keys, and NVRAM/LDAP authentication indicators. Mirrors Snaffler rule KeepNetConfigCreds.
Detects credentials passed as command-line arguments in Windows batch scripts, PowerShell, and shell scripts. Covers net use /user:, schtasks /rp, psexec -p, cmdkey, and bare password= assignments. Mirrors Snaffler rule KeepCmdCredentials.
Detects Microsoft Defender for Identity (MDI) SensorConfiguration.json files containing DirectoryServicesAccount credentials and Microsoft Defender for Endpoint (MDE) mdatp_managed.json files containing onboardingInfo blobs, both of which represent high-value security tool configuration secrets. Mirrors Snaffler rule KeepDefenderConfigByName.
Detects Microsoft Deployment Toolkit (MDT) customsettings.ini files that embed domain join credentials, including DomainAdminPassword and DomainAdmin account values used during automated OS deployments. Mirrors Snaffler rule KeepDomainJoinCredsByName / KeepDomainJoinCredsByPath.
Detects Firefox logins.json encrypted password entries in the JSON format used by Firefox's NSS (Network Security Services) credential store. Mirrors Snaffler rule KeepFFRegexRed.
Detects passwords stored in FTP server and client configuration files, including FileZilla server/client recentservers.xml base64-encoded passwords, proftpd-style shadow passwd lines with hashed credentials, and sftp-config.json plaintext password fields. Mirrors Snaffler rules KeepFtpServerConfigByName and KeepFtpClientConfigConfigByName.
Detects embedded credentials (username:password) in Git repository URLs. Mirrors Snaffler rule KeepGitCredsByName.
Detects Apache htpasswd file entries containing hashed passwords in MD5 ($apr1$), bcrypt ($2y$, $2b$, $2a$), or SHA ({SHA}) formats. Mirrors Snaffler rule KeepConfigByName.
Detects secrets embedded in Infrastructure as Code files including Terraform/HCL variable assignments and Azure Cloud Service configuration (.cscfg) XML settings. Mirrors Snaffler rule KeepInfraAsCodeByExtension.
Detects Jenkins-encrypted credential values in the {base64...} format used by Jenkins credentials.xml and similar configuration files. Mirrors Snaffler rule KeepJenkinsByName.
Detects MediaWiki LocalSettings.php files containing database passwords ($wgDBpassword), secret keys ($wgSecretKey), and upgrade keys ($wgUpgradeKey). These are high-value secrets that grant database and administrative access to a MediaWiki installation. Mirrors Snaffler rule KeepPhpByName.
Detects credential list files — documents containing multiple username/password pairs in a structured, enumerated format (passwords.txt, secrets.*, BitlockerLAPSPasswords.csv, etc.). Distinguishes a credential roster from prose mentioning "password". Mirrors Snaffler rule KeepPasswordFilesByName.
Detects PostgreSQL .pgpass file entries containing hostname, port, database, username, and password in colon-separated format. Mirrors Snaffler rule KeepDbMgtConfigByName.
Detects PowerShell credential constructs that embed plaintext passwords, including ConvertTo-SecureString with -AsPlainText and [Net.NetworkCredential]::new() calls. Mirrors Snaffler rule KeepPsCredentials.
Detects secret credentials embedded in Ruby on Rails configuration files: secret_token/secret_key_base assignments (config/initializers/secret_token.rb, config/secrets.yml), database passwords (config/database.yml), and Chef knife client keys (knife.rb). These files are frequently committed to source control and expose application secrets and infrastructure access. Mirrors Snaffler rule KeepRubyByName.
Detects DPAPI-encrypted saved passwords stored in Windows Remote Desktop Protocol (.rdp) configuration files. The characteristic line "password 51:b:<base64-blob>" contains a DPAPI ciphertext blob representing a saved RDP credential. These files are frequently found on file shares, workstations, and in source-control repositories and represent a high-severity finding because the blob can be decrypted on the originating machine under the same user context. Mirrors Snaffler rule KeepRdpPasswords.
Detects passwords and credentials stored in remote access configuration files including RDCMan .rdg files (logonCredentials blocks), mRemoteNG confCons.xml (Node Password attributes), and OpenVPN .ovpn files with embedded auth directives. MobaXterm .ini files are a Snaffler filename target only — passwords are stored obfuscated (proprietary XOR cipher) with no plaintext fingerprint detectable by content regex. Mirrors Snaffler rules KeepRemoteAccessConfByExtension and KeepRemoteAccessConfByName.
Detects S3 and S3A URI references in source code or configuration files when accompanied by AWS credential context. S3 URIs alone are high-FP enumeration signals; this pattern only fires at 75+ confidence when AWS credential evidence (access key, secret, AKIA prefix) is present within 300 characters. URI-only matches surface at 65 as discovery inventory. Mirrors Snaffler rule KeepS3UriPrefixInCode.
Detects credentials embedded in shell history files (.bash_history, .zsh_history, ConsoleHost_History.txt) including exported environment variable secrets, mysql command-line passwords, curl basic auth credentials, and sshpass invocations. Mirrors Snaffler rule KeepShellHistoryByName.
Detects database connection credentials embedded in source code across Java (JDBC), PHP, Perl, Ruby, and Python. Matches database driver connect() calls containing credentials inline. Mirrors Snaffler rules KeepJavaDbConnStrings, KeepPhpDbConnStrings, KeepPerlDbConnStrings, KeepRubyDbConnStrings, KeepPyDbConnStrings.
Detects SQL statements that create database user accounts or logins with embedded passwords, covering SQL Server CREATE LOGIN, MySQL CREATE USER IDENTIFIED BY, and PostgreSQL CREATE USER WITH PASSWORD. Mirrors Snaffler rule KeepSqlAccountCreation.
Detects plaintext passwords stored in Windows unattend.xml answer files, specifically the AdministratorPassword and AutoLogon <Value> XML elements used during Windows automated setup. These files frequently contain Administrator or auto-logon credentials in cleartext and represent a high severity finding when discovered on file shares or in software repositories. Mirrors Snaffler rule KeepUnattendXmlRegexRed.