Git Credentials in URL

Name: Git Credentials in URL
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects embedded credentials (username:password) in Git repository URLs. Mirrors Snaffler rule KeepGitCredsByName.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: the user:password@ URL structure is highly specific. The constraint on allowed characters in username and password fields (no whitespace, colon, slash, or @) tightly bounds the match. Corroborative evidence further reduces false positives.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF
Data categories: credentials
Scope: specific
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible

Pattern

https?://[^\s:/@]{1,64}:[^\s:/@]{1,128}@[A-Za-z0-9.-]{1,255}

github.com, gitlab, dev.azure.com, bitbucket, git-credentials

Proximity: 300 characters

https://alice:S3cretValue@code.internal — Exact 65 probe - generic credential-bearing URL retained for discovery only
https://deploy:hunter2@gitlab.internal — Exact 75 probe - embedded credentials on a recognised source-control host
git clone https://oauth2:glpat-aB3dE6gH9jK2mN5pQ8sT@gitlab.com/group/repo.git — Exact 85 probe - source-control host plus repository path and Git operation

https://github.com/org/repo.git — No credentials embedded
https://example.com/page?ref=main — Query string, not credentials
git clone https://deploy:********@github.com/org/repo.git — Masked secret in a credential URL must not enforce
Documentation example: git clone https://user:password@github.com/org/repo.git — Instructional placeholder URL is excluded
https://user@github.com/org/repo.git — Malformed credential URL is missing the password separator

Service accounts or CI/CD pipeline logs that mask credentials with asterisks but retain URL structure. Mitigation: Check for placeholder patterns like asterisks or literal "password" in the credential field.
Documentation examples showing URL format with placeholder credentials. Mitigation: Require proximity to git-specific hosting domains to reduce documentation false positives.