Secrets

Database passwords should not be disclosed

Google Cloud service accounts keys should not be disclosed

{
"type": "service_account",
"project_id": "example-project",
"private_key_id": "2772b8e6f42dc67369b98f0b91694f7805b28844",
"private_key": "-----BEGIN PRIVATE KEY-----\nKBww9jggAgBEHBCBAASIMDsoCBAuAQINAgFAGSXQTkiAE0cEIkoQghJAqGavB/r3\n2W6raHa1Qrfj6pii5U2Ok53SxCyK3TxYc3Bfxq8orZeYC9LQ/I3tz7w4/BnT71AD\nfP1i8SWHsRMIicSuVFcRoYMA+A1eNSmdrujdBNWgedfuSyHbPnNY7s8BBUIoBN7I\n8gJG5DUUKAZfZDB2c/n7Yu0=\n-----END PRIVATE KEY-----\n",
"client_email": "example@example.iam.gserviceaccount.example.com",
"client_id": "492539091821492546176",
"auth_uri": "https://accounts.google.com/o/oauth2/auth",
"token_uri": "https://oauth2.googleapis.com/token",
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/example%40example.iam.gserviceaccount.example.com",
"universe_domain": "googleapis.com"
}

PostgreSQL database passwords should not be disclosed

Shippo tokens should not be disclosed

Shippo.setApiKey('shippo_live_258d9b4c41a8cb88ca7fb4b12c65083f658435ac'); // Noncompliant

HashMap<String, Object> addressMap = new HashMap<String, Object>();
addressMap.put("name", "Mr. Hippo");
addressMap.put("company", "Shippo");
addressMap.put("street1", "215 Clayton St.");
addressMap.put("city", "San Francisco");
addressMap.put("state", "CA");
addressMap.put("zip", "94117");
addressMap.put("country", "US");
addressMap.put("phone", "+1 555 341 9393");
addressMap.put("email", "support@goshipppo.com");

Address createAddress = Address.create(addressMap);

OpenWeather API keys should not be disclosed

Grafana tokens should not be disclosed

import requests

token = 'glsa_geygSnIfuK5vBG0KgaflRCQfIb8mzaM7_b0999d91'  # Noncompliant
response = requests.get('https://grafana.example.org/api/dashboards/home', headers={
'Authorization': f'Bearer {token}',
'Content-Type': 'application/json'
})

Django secret keys should not be disclosed

SSH private keys should not be disclosed

String key = """
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDktj2RM1D2wRTQ0H+YZsFqnAuZrqBNEB4PpJ5xm73nWwAAAJgJVPFECVTx
RAAAAAtzc2gtZWQyNTUxOQAAACDktj2RM1D2wRTQ0H+YZsFqnAuZrqBNEB4PpJ5xm73nWw
AAAECQ8Nzp6a1ZJgS3SWh2pMxe90W9tZVDZ+MZT35GjCJK2uS2PZEzUPbBFNDQf5hmwWqc
C5muoE0QHg+knnGbvedbAAAAFGdhZXRhbmZlcnJ5QFBDLUwwMDc3AQ==
-----END OPENSSH PRIVATE KEY-----""";

PyPI tokens should not be disclosed

[pypi]
username = __token__
password = pypi-YBf3ZAIKOMPwNZ1VaQ0RAtjww5lI1az1CMLEOWgDQN56EPADfzRmgsENVcmIUh2mSBwYlTtyNKGmVlLm2MZD2aJOTWmD2EO5PMyWjvUY3Ii2CjsidALCNCNmvX8N8gcijBliFN2ciBCLgQdi2YYfGjA1kz19z1UBKg

Hashicorp tokens should not be disclosed

import hvac

client = hvac.Client(url='https://vault.example.com', token='hvb.AAAAAQJyBEVF-vTWUrg0hcoIPuvKjjNxXXZ5MfsYVg2gJ0fGZpVi0IGTFfh4TqsoQIWaocNRXD1qzGXvhIHWJBM_rWU9YJY8sXOYVy_s1JAHasXJwGmZ_fBLJfSG6aCwQkCGwtAhYw') # Noncompliant

secret = client.secrets.kv.v2.read_secret_version(path='secret/myapp')
data = secret['data']
username = data.get('username')
password = data.get('password')

DigitalOcean tokens should not be disclosed

require 'droplet_kit'

token = 'dop_v1_1adc4095c3c676ff1c31789a1a86480195a5b3d955010c94fcfa554b34640e1e'  # Noncompliant
client = DropletKit::Client.new(access_token: token)

MongoDB database passwords should not be disclosed

WakaTime tokens should not be disclosed

from rauth import OAuth2Service

service = OAuth2Service(
client_id='d130uKF73fueZSCM9tUodIFN',
client_secret='waka_sec_ez0kI3tQlYVvYSJOAjoI5n3PpyG69HQl91TZKFjSdb0X0XXgY7dahXiPpAhYL2kNxqDBzHuHNuzCPr5d', # Noncompliant
name='wakatime',
authorize_url='https://wakatime.com/oauth/authorize',
access_token_url='https://wakatime.com/oauth/token',
base_url='https://wakatime.com/api/v1/')

Azure Storage Account Keys should not be disclosed

using Azure.Storage.Blobs;
using Azure.Storage;

class Example
{
static void Main(string[] args)
{
    string account = "accountname";
    string accountKey = "4dVw+l0W8My+FwuZ08dWXn+gHxcmBtS7esLAQSrm6/Om3jeyUKKGMkfAh38kWZlItThQYsg31v23A0w/uVP4pg=="; // Noncompliant
    StorageSharedKeyCredential sharedKeyCredential = new StorageSharedKeyCredential(account, accountKey);

    BlobServiceClient blobServiceClient = new BlobServiceClient(
        new Uri($"https://{account}.blob.core.windows.net"),
        sharedKeyCredential);
}
}

Cryptographic private keys should not be disclosed

private_key = "-----BEGIN EC PRIVATE KEY-----" \
"MF8CAQEEGEfVxjrMPigNhGP6DqH6DPeUZPbaoaCCXaAKBggqhkjOPQMBAaE0AzIA" \
"BCIxho34upZyXDi/AUy/TBisGeh4yKJN7pit9Z+nKs4QajVy97X8W9JdySlbWeRt" \
"2w==" \
"-----END EC PRIVATE KEY-----"

Figma tokens should not be disclosed

import requests

token = 'figd_OLDXZWOP4fxW4c9ER0xzxRda96M-f0eFwZpFQjHJ'  # Noncompliant
response = requests.get('https://api.figma.com/v1/me', headers={
'X-FIGMA-TOKEN': token,
'Content-Type': 'application/json'
})

Yandex tokens should not be disclosed

import { Session, cloudApi, serviceClients } from '@yandex-cloud/nodejs-sdk';

const { resourcemanager: { cloud_service: { ListCloudsRequest } } } = cloudApi;

const session = new Session({ iamToken: 't1.7euelSbPyceKx87JqpuRl1qZiY-Ryi3rnpWaksrKaZqUppnLncmDnpeajZvl8_dZNAFl-e8ENXMH_t3z9xljfmT57wQ1cwf-.-LErty1vRh4S__VEp-aDnM5huB5MEfm_Iu1u2IzNgyrn0emiWDYA6rSQXDvzjE0O3HBbUlqoDeCmXYYInzZ6Cg' }); // Noncompliant
const cloudService = session.client(serviceClients.CloudServiceClient);

const response = await cloudService.list(ListCloudsRequest.fromPartial({
pageSize: 100,
}));

Clarifai API keys should not be disclosed

Postman tokens should not be disclosed

const axios = require('axios');

const apiKey = 'PMAK-6502e63761882f002a69f0cb-6d9bc58cd0cc60ff5547f81cf2ca141bb9'; // Noncompliant
const options = {
method: 'get',
url: 'https://api.getpostman.com/me',
headers: {
    'Content-Type': 'application/json',
    'X-API-Key': apiKey
}
};

(async() => { await axios(options); })();

MySQL database passwords should not be disclosed

Shopify tokens should not be disclosed

import requests

token = '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'  # Noncompliant
response = requests.get('https://test-shop.myshopify.com/admin/api/2021-07/shop.json', headers={
'X-Shopify-Access-Token': token,
'Content-Type': 'application/json'
})

Typeform tokens should not be disclosed

import requests

token = 'tfp_DEueEgDipkmx52r7rgU5EC7VC5K2MzzsR61ELEkqmh3Y_3mJqwKJ2vtfX5N'  # Noncompliant
response = requests.get('https://api.typeform.com/forms', headers={
'Authorization': f'Bearer {token}',
'Content-Type': 'application/json'
})

NPM access tokens should not be disclosed

Docker Hub tokens should not be disclosed

Start Here

Setup

Pull Request Review

Scan center

Integrations

IDE

Rule Reference

Resources