.gitleaks.toml

# ported from https://git.io/J4rOB @ 2021-08-31T09:20:42+0300

title = "gitleaks config"

[[rules]]
  description = "AWS Manager ID"
  regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}'''
  tags = ["key", "AWS"]
  [rules.allowlist]
    regexes = ['''(arn:aws:)''']
    description = "ignore arns"

[[rules]]
  description = "AWS Secret Key"
  regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]'''
  tags = ["key", "AWS"]

[[rules]]
  description = "AWS MWS key"
  regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'''
  tags = ["key", "AWS", "MWS"]

[[rules]]
  description = "Facebook Secret Key"
  regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]'''
  tags = ["key", "Facebook"]

[[rules]]
  description = "Facebook Client ID"
  regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]'''
  tags = ["key", "Facebook"]

[[rules]]
  description = "Twitter Secret Key"
  regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]'''
  tags = ["key", "Twitter"]

[[rules]]
  description = "Twitter Client ID"
  regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]'''
  tags = ["client", "Twitter"]
  [rules.allowlist]
    regexes = ['''from [\\w_\\.]+ import [\\w_\\.]+''']
    description = "Ignore python imports"

[[rules]]
  description = "Github"
  regex = '''(?i)github.{0,3}((?i)token|api|key).{0,10}?(?-i)([0-9a-zA-Z]{35,40})'''
  tags = ["key", "Github"]

[[rules]]
  description = "LinkedIn Client ID"
  regex = '''(?i)linkedin(.{0,20})?(?-i)['\"][0-9a-z]{12}['\"]'''
  tags = ["client", "LinkedIn"]

[[rules]]
  description = "LinkedIn Secret Key"
  regex = '''(?i)linkedin(.{0,20})?['\"][0-9a-z]{16}['\"]'''
  tags = ["secret", "LinkedIn"]

[[rules]]
  description = "NPM Token"
  regex= '''//registry.npmjs.org/:_authToken=[0-9a-f-]+'''
  tags = ["key", "NPM"]

[[rules]]
  description = "Slack"
  regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?'''
  tags = ["key", "Slack"]

[[rules]]
  description = "EC"
  regex = '''-----BEGIN EC PRIVATE KEY-----'''
  tags = ["key", "EC"]

[[rules]]
  description = "DSA"
  regex = '''-----BEGIN DSA PRIVATE KEY-----'''
  tags = ["key", "DSA"]

[[rules]]
  description = "OPENSSH"
  regex = '''-----BEGIN OPENSSH PRIVATE KEY-----'''
  tags = ["key", "OPENSSH"]

[[rules]]
  description = "RSA"
  regex = '''-----BEGIN RSA PRIVATE KEY-----'''
  tags = ["key", "RSA"]

[[rules]]
  description = "PGP"
  regex = '''-----BEGIN PGP PRIVATE KEY BLOCK-----'''
  tags = ["key", "PGP"]

[[rules]]
  description = "Google API key"
  regex = '''AIza[0-9A-Za-z\\-_]{35}'''
  tags = ["key", "Google"]


[[rules]]
  description = "Heroku API key"
  regex = '''(?i)heroku(.{0,20})?['"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]'''
  tags = ["key", "Heroku"]

[[rules]]
  description = "MailChimp API key"
  regex = '''(?i)(mailchimp|mc)(.{0,20})?['"][0-9a-f]{32}-us[0-9]{1,2}['"]'''
  tags = ["key", "Mailchimp"]

[[rules]]
  description = "Mailgun API key"
  regex = '''(?i)(mailgun|mg)(.{0,20})?['"][0-9a-z]{32}['"]'''
  tags = ["key", "Mailgun"]

[[rules]]
  description = "PayPal Braintree access token"
  regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}'''
  tags = ["key", "Paypal"]

[[rules]]
  description = "Picatic API key"
  regex = '''sk_live_[0-9a-z]{32}'''
  tags = ["key", "Picatic"]

[[rules]]
  description = "Slack Webhook"
  regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}'''
  tags = ["key", "slack"]

[[rules]]
  description = "Stripe API key"
  regex = '''(?i)stripe(.{0,20})?['\"][sk|rk]_live_[0-9a-zA-Z]{24}'''
  tags = ["key", "Stripe"]

[[rules]]
  description = "Square access token"
  regex = '''sq0atp-[0-9A-Za-z\-_]{22}'''
  tags = ["key", "square"]

[[rules]]
  description = "Square OAuth secret"
  regex = '''sq0csp-[0-9A-Za-z\\-_]{43}'''
  tags = ["key", "square"]

[[rules]]
  description = "Twilio API key"
  regex = '''(?i)twilio(.{0,20})?['\"][0-9a-f]{32}['\"]'''
  tags = ["key", "twilio"]

[[rules]]
  description = "Dynatrace token"
  regex = '''dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64}'''
  tags = ["key", "Dynatrace"]

[[rules]]
  description = "Shopify shared secret"
  regex = '''shpss_[a-fA-F0-9]{32}'''
  tags = ["key", "Shopify"]

[[rules]]
  description = "Shopify access token"
  regex = '''shpat_[a-fA-F0-9]{32}'''
  tags = ["key", "Shopify"]

[[rules]]
  description = "Shopify custom app access token"
  regex = '''shpca_[a-fA-F0-9]{32}'''
  tags = ["key", "Shopify"]

[[rules]]
  description = "Shopify private app access token"
  regex = '''shppa_[a-fA-F0-9]{32}'''
  tags = ["key", "Shopify"]

[[rules]]
  description = "Env Var"
  regex = '''(?i)(apikey|secret|password|certificate_osx_p12|certificate_password|codacy_project_token|coveralls_api_token|coveralls_repo_token|coveralls_token|coverity_scan_token|cypress_record_key|database_password|db_password|deploy_password|deploy_token|digitalocean_access_token|docker_hub_password|docker_password|dockerhub_password|sonatype_password|firebase_api_token|firebase_token|firefox_secret|flask_secret_key|fossa_api_key|gcloud_service_key|gcr_password|gh_api_key|gh_next_oauth_client_secret|gh_next_unstable_oauth_client_secret|gh_oauth_client_secret|gpg_private_key|gpg_passphrase|gpg_secret_keys|heroku_api_key|okta_client_token|pypi_password|sonatype_nexus_password|travis_token|refresh_token|client_id|client_secret)(.*)?[(:=](\s)?['\"][0-9a-zA-Z-_!$^%=]{10,120}['\")]'''
    tags = ["key", "env"]
    [[rules.entropies]]
        Min = "4.2"
        Max = "7.0"
    [rules.allowlist]
    regexes = ['''(?i)(expect|assert|Component|Control|passwd|attrgetter|itemgetter|ifloordiv|imatmul|itruediv|yourpassword|foo|bar|serial|mpan|secret_key|grant_type|ngModel)''']
    description = "ignore default"

[[rules]]
  description = "Static key"
  regex = '''(?i)(cookieParser)(.*)?[(](\s)?['\"][0-9a-zA-Z-_!$^%=]{5,20}['\")]'''
    tags = ["key", "sign"]
    file = '''\.(js|ts)$'''
    [rules.allowlist]
    regexes = ['''(?i)(require|import|expect|assert|Component|Control|passwd|attrgetter|itemgetter|ifloordiv|imatmul|itruediv|yourpassword|foo|bar|serial|mpan|secret_key)''']
    description = "ignore default"

[[rules]]
  description = "High Entropy"
  regex = '''[0-9a-zA-Z-_!=]{10,120}'''
  tags = ["entropy"]
    [[rules.entropies]]
        Min = "4.8"
        Max = "7.0"
    [rules.allowlist]
        description = "ignore ssh key and pems"
        regexes = ['''(ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789|abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890|0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz)''']
        paths = ['''(.*)?(ssh|i18n|locales)''']

[[rules]]
  description = "WP-Config"
  regex='''define(.{0,20})?(DB_CHARSET|NONCE_SALT|LOGGED_IN_SALT|AUTH_SALT|NONCE_KEY|DB_HOST|DB_PASSWORD|AUTH_KEY|SECURE_AUTH_KEY|LOGGED_IN_KEY|DB_NAME|DB_USER)(.{0,20})?['|"].{10,120}['|"]'''
  tags = ["key", "API", "generic"]

[[rules]]
  description = "ShiftLeft token"
  regex = '''.'''
  file = '''shiftleft\.json'''
  tags = ["file", "ShiftLeft"]

[[rules]]
  description = "Shell history"
  regex = '''.'''
  file = '''\.?(bash_|zsh_|z|mysql_|psql_|irb_)?history$'''
  tags = ["file", "Shell"]

[[rules]]
  description = "Postgres password"
  regex = '''.'''
  file = '''\.pgpass$'''
  tags = ["file", "password"]

[[rules]]
  description = "OpenVPN"
  regex = '''.'''
  file = '''\.ovpn$'''
  tags = ["file", "openvpn"]

[[rules]]
  description = "Unknown Key"
  regex = '''.'''
  file = '''\.key$'''
  tags = ["file", "key"]

[[rules]]
  description = "Keychain file"
  regex = '''.'''
  file = '''\.(kdb|agilekeychain|keychain|kwallet|git-credentials|proftpdpasswd|dockercfg|credentials)$'''
  tags = ["file", "keychain"]

[[rules]]
  description = "s3cfg"
  regex = '''.'''
  file = '''\.s3cfg$'''
  tags = ["file", "s3cfg"]

[[rules]]
  description = "secret token"
  regex = '''.'''
  file = '''(omniauth|secret_token|carrierwave)\.rb$'''
  tags = ["file", "Ruby"]

[[rules]]
  description = "CSCAN0210: GitCredential"
  regex = '''https?://.+:.+@.*'''
  file = '''\.gitCredentials$'''
  tags = ["file", "gitCredentials"]

[[rules]]
  description = "CSCAN0010: KeyStoreFile"
  regex = '''.'''
  file = '''\.keystore$'''
  tags = ["file", "KeyStoreFile"]

[[rules]]
  description = "CSCAN0020: Base64EncodedCertificateInCode"
  regex = '''['">;=]MII[a-z0-9/+]{200}'''
  file = '''\.(?:cs|ini|json|ps1|publishsettings|template|trd|ts|xml)$'''
  tags = ["key", "Base64EncodedCertificateInCode"]

[[rules]]
  description = "CSCAN0020: Base64EncodedCertificateInFile"
  regex = '''MII[A-Za-z0-9/+]{60}'''
  file = '''\.(?:cert|cer)$'''
  tags = ["key", "Base64EncodedCertificateInFile"]

[[rules]]
  description = "CSCAN0030: PublishSettings"
  regex = '''userPWD="[a-zA-Z0-9\+\/]{60}"'''
  file = '''(?i)(publishsettings|\.pubxml$)'''
  tags = ["key", "PublishSettings"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0060: PemFile 1"
  file = '''\.pem$'''
  regex = '''-{5}BEGIN(?: (?:[dr]sa|ec|openssh))? PRIVATE KEY-{5}'''
  tags = ["key", "PemFile"]

[[rules]]
  description = "CSCAN0091: AspNetMachineKeyInConfig 1"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''<machineKey[^>]+(?:decryptionKey\s*\=\s*"[a-fA-F0-9]{48,}|validationKey\s*\=\s*"[a-fA-F0-9]{48,})[^>]+>'''
  tags = ["key", "AspNetMachineKeyInConfig"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0091: AspNetMachineKeyInConfig 2"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''(?:decryptionKey|validationKey)="[a-zA-Z0-9]+"'''
  tags = ["key", "AspNetMachineKeyInConfig"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0092: SqlConnectionStringInConfig 1"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''(?i)(?:connection[sS]tring|connString)[^=]*=["'][^"']*[pP]assword\s*=\s*[^\s;][^"']*(?:'|")'''
  tags = ["key", "SqlConnectionStringInConfig"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''

[[rules]]
  description = "CSCAN0092: SqlConnectionStringInConfig 2 / CSCAN0043 SqlConnectionStringInCode"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties|policy_and_key\.hpp|AccountConfig\.h)$|hubot'''
  regex = '''(?i)(?:User ID|uid|UserId).*(?:Password|[^a-z]pwd)=[^'\$%<@'";\[\{][^;/"]{4,128}(?:;|")'''
  tags = ["key", "SqlConnectionStringInConfig"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:prefix <<|guestaccesstoken|skiptoken|cookie|tsm|fake|example|badlyFormatted|Invalid|sha512|sha256|"input"|ENCRYPTED|"EncodedRequestUri"|looks like|myStorageAccountName|(?:0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0093: StorageAccountKeyInConfig 1"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9/+]{86}=='''
  tags = ["key", "StorageAccountKeyInConfig"]

[[rules]]
  description = "CSCAN0041: StorageAccountKeyInCode 1"
  file = '''(?:\.(?:cs|js|ts|cpp)|policy_and_key\.hpp|AccountConfig\.h)$'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9/+]{86}=='''
  tags = ["key", "StorageAccountKeyInCode"]

[[rules]]
  description = "CSCAN0094: SharedAccessSignatureInCode 1"
  file = '''(?:\.(?:cs|js|ts|cpp)|policy_and_key\.hpp|AccountConfig\.h)$'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9/+]{43}=[^{@]'''
  tags = ["key", "SharedAccessSignatureInCode"]

[[rules]]
  description = "CSCAN0094: SharedAccessSignatureInCode 2"
  file = '''(?:\.(?:cs|js|ts|cpp)|policy_and_key\.hpp|AccountConfig\.h)$'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9%]{43,53}%3d[^a-z0-9%]'''
  tags = ["key", "SharedAccessSignatureInCode"]

[[rules]]
  description = "CSCAN0094: SharedAccessSignatureInConfig 1"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9/+]{43}=[^{@]'''
  tags = ["key", "SharedAccessSignatureInConfig"]

[[rules]]
  description = "CSCAN0094: SharedAccessSignatureInConfig 2"
  file = '''\.(?:xml|pubxml|definitions|ps1|wadcfgx|ccf|config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''[^a-z0-9/\+\._\-\$,\\][a-z0-9%]{43,53}%3d[^a-z0-9%]'''
  tags = ["key", "SharedAccessSignatureInConfig"]

[[rules]]
  description = "CSCAN0095: GeneralSecretInConfig 1"
  file = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''<add\skey="[^"]+(?:key(?:s|[0-9])?|credentials?|secret(?:s|[0-9])?|password|token|KeyPrimary|KeySecondary|KeyOrSas|KeyEncrypted)"\s*value\s*="[^"]+"[^>]*/>'''
  tags = ["key", "GeneralSecretInConfig"]
  [[rules.whitelist]]
    regex = '''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"'''
  [[rules.whitelist]]
    regex = '''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")'''
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''value="(?:true|false|@\(api|ssh\-rsa 2048|invalid|to be|a shared secret|secreturi|clientsecret|Overr?idden by|someValue|SOME\-SIGNING\-KEY|TokenBroker|UNKNOWN|Client Secret of|Junk Credentials|Default\-|__BOOTSTRAPKEY_|CacheSecret|CatalogCert|CosmosCredentials|DeleteServiceCert|EmailCredentials|MetricsConnection|SangamCredentials|SubscriptionConnection|Enter_your_|My_Issuer|ScaleUnitXstoreSharedKey|private_powerapps|TestSecret|foo_|bar_|temp_|__WinfabricTestInfra|configured|SecretFor|Test|XSTORE_KEY|ServiceBusDiagnosticXstoreSharedKey|BoxApplicationKey|googleapps)'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''
  [[rules.whitelist]]
    regex = '''AccountKey\s*=\s*MII[a-z0-9/+]{43,}={0,2}'''

[[rules]]
  description = "CSCAN0095: GeneralSecretInConfig 2"
  file = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''<add\skey="[^"]+"\s*value="[^"]*EncryptedSecret:[^"]+"\s*/>'''
  tags = ["key", "GeneralSecretInConfig"]
  [[rules.whitelist]]
    regex = '''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"'''
  [[rules.whitelist]]
    regex = '''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")'''
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''value="(?:true|false|@\(api|ssh\-rsa 2048|invalid|to be|a shared secret|secreturi|clientsecret|Overr?idden by|someValue|SOME\-SIGNING\-KEY|TokenBroker|UNKNOWN|Client Secret of|Junk Credentials|Default\-|__BOOTSTRAPKEY_|CacheSecret|CatalogCert|CosmosCredentials|DeleteServiceCert|EmailCredentials|MetricsConnection|SangamCredentials|SubscriptionConnection|Enter_your_|My_Issuer|ScaleUnitXstoreSharedKey|private_powerapps|TestSecret|foo_|bar_|temp_|__WinfabricTestInfra|configured|SecretFor|Test|XSTORE_KEY|ServiceBusDiagnosticXstoreSharedKey|BoxApplicationKey|googleapps)'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''
  [[rules.whitelist]]
    regex = '''AccountKey\s*=\s*MII[a-z0-9/+]{43,}={0,2}'''

[[rules]]
  description = "CSCAN0095: GeneralSecretInConfig 3"
  file = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''<Credential\sname="[^"]*(?:key(?:s|[0-9])?|credentials?|secret(?:s|[0-9])?|password|token|KeyPrimary|KeySecondary|KeyOrSas|KeyEncrypted)"(\s*value\s*="[^"]+".*?/>|[^>]*>.*?</Credential>)'''
  tags = ["key", "GeneralSecretInConfig"]
  [[rules.whitelist]]
    regex = '''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"'''
  [[rules.whitelist]]
    regex = '''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")'''
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''value="(?:true|false|@\(api|ssh\-rsa 2048|invalid|to be|a shared secret|secreturi|clientsecret|Overr?idden by|someValue|SOME\-SIGNING\-KEY|TokenBroker|UNKNOWN|Client Secret of|Junk Credentials|Default\-|__BOOTSTRAPKEY_|CacheSecret|CatalogCert|CosmosCredentials|DeleteServiceCert|EmailCredentials|MetricsConnection|SangamCredentials|SubscriptionConnection|Enter_your_|My_Issuer|ScaleUnitXstoreSharedKey|private_powerapps|TestSecret|foo_|bar_|temp_|__WinfabricTestInfra|configured|SecretFor|Test|XSTORE_KEY|ServiceBusDiagnosticXstoreSharedKey|BoxApplicationKey|googleapps)'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''
  [[rules.whitelist]]
    regex = '''AccountKey\s*=\s*MII[a-z0-9/+]{43,}={0,2}'''

[[rules]]
  description = "CSCAN0095: GeneralSecretInConfig 4"
  file = '''\.(?:config|cscfg|json|js|txt|cpp|sql|dtsx|md|java|FF|template|settings|ini|BF|ste|isml|test|ts|resx|Azure|sample|backup|rd|hpp|psm1|cshtml|htm|bat|waz|yml|Beta|py|sh|m|php|xaml|keys|cmd|rds|loadtest|properties)$|hubot'''
  regex = '''<setting\sname="[^"]*Password".*[\r?\n]*\s*<value>.+</value>'''
  tags = ["key", "GeneralSecretInConfig"]
  [[rules.whitelist]]
    regex = '''key\s*=\s*"[^"]*AppKey[^"]*"\s+value\s*=\s*"[a-z]+"'''
  [[rules.whitelist]]
    regex = '''value\s*=\s*"(?:[a-z]+(?: [a-z]+)+"|_+[a-z]+_+"|[a-z]+-[a-z]+-[a-z]+["-]|[a-z]+-[a-z]+"|[a-z]+\\[a-z]+"|\d+"|[^"]*ConnectionString")'''
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''
  [[rules.whitelist]]
    regex = '''value="(?:true|false|@\(api|ssh\-rsa 2048|invalid|to be|a shared secret|secreturi|clientsecret|Overr?idden by|someValue|SOME\-SIGNING\-KEY|TokenBroker|UNKNOWN|Client Secret of|Junk Credentials|Default\-|__BOOTSTRAPKEY_|CacheSecret|CatalogCert|CosmosCredentials|DeleteServiceCert|EmailCredentials|MetricsConnection|SangamCredentials|SubscriptionConnection|Enter_your_|My_Issuer|ScaleUnitXstoreSharedKey|private_powerapps|TestSecret|foo_|bar_|temp_|__WinfabricTestInfra|configured|SecretFor|Test|XSTORE_KEY|ServiceBusDiagnosticXstoreSharedKey|BoxApplicationKey|googleapps)'''
  [[rules.whitelist]]
    regex = '''AccountKey\s*=\s*MII[a-z0-9/+]{43,}={0,2}'''

[[rules]]
  description = "CSCAN0110: ScriptPassword 1"
  file = '''(?:\.cmd|\.ps|\.ps1|\.psm1)$'''
  regex = '''\s-Password\s+(?:"[^"]*"|'[^']*')'''
  tags = ["key", "ScriptPassword"]

[[rules]]
  description = "CSCAN0110: ScriptPassword 2"
  file = '''(?:\.cmd|\.ps|\.ps1|\.psm1)$'''
  regex = '''\s-Password\s+[^$\(\)\[\{<\-\r?\n]+\s*(?:\r?\n|\-)'''
  tags = ["key", "ScriptPassword"]

[[rules]]
  description = "CSCAN0120: ExternalApiSecret"
  file = '''\.cs$|\.cpp$|\.c$'''
  regex = '''(private\sconst\sstring\sAccessTokenSecret|private\sconst\sstring\saccessToken|private\sconst\sstring\sconsumerSecret|private\sconst\sstring\sconsumerKey|pageAccessToken|private\sstring\stwilioAccountSid|private\sstring\stwilioAuthToken)\s=\s".*";'''
  tags = ["key", "ExternalApiSecret"]

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 1"
  file = '''\.(?:ps1|psm1|)$'''
  regex = '''ConvertTo-SecureString(?:\s*-String)?\s*"[^"\r?\n]+"'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 2"
  file = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''new\sX509Certificate2\([^()]*,\s*"[^"\r?\n]+"[^)]*\)'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 3"
  file = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''AdminPassword\s*=\s*"[^"\r?\n]+"'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 4"
  file = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''(?i)<password>.+</password>'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 5"
  file = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''ClearTextPassword"?\s*[:=]\s*"[^"\r?\n]+"'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 6"
  file = '''\.(?:cs|xml|config|json|ts|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''certutil.*?\-p\s+("[^"%]+"|'[^'%]+'|[^"']\S*\s)'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0220: DefaultPasswordContexts 7"
  file = '''\.(?:cs|xml|config|json|cfg|txt|ps1|bat|cscfg|publishsettings|cmd|psm1|aspx|asmx|vbs|added_cluster|clean|pubxml|ccf|ini|svd|sql|c|xslt|csv|FF|ExtendedTests|settings|cshtml|template|trd|argfile)$|(config|certificate|publish|UT)\.js$|(commands|user|tests)\.cpp$'''
  regex = '''password\s*=\s*N?(["][^"\r?\n]{4,}["]|['][^'\r?\n]{4,}['])'''
  tags = ["key", "DefaultPasswordContexts"]
  [[rules.whitelist]]
    regex = '''Credentials?Type|ConnectionStringKey|notasecret|PartitionKey|notreal|insertkey|LookupKey|IgnoreKeys|SecretsService|SecretsTenantId|(?:Password|pwd|secret|credentials?)(?:Key|Location)|KeyManager'''
  [[rules.whitelist]]
    regex = '''(?:_AppKey"|(?:(?:credential|password|token)s?|(?:Account|access)Key=)"[\s\r?\n]*/|Username"|\.dll|(?:Secret|Token|Key|Credential)s?(?:Encryption|From|(?:Signing)?Certificate|Options|Thumbprint|Contacts|String|UserId)|Key(1;value1|word|s?Path|Index|Id|Store|WillDoWithoutValidation|:NamePattern|Name"|Ref")|(Secret|Credential)s?(Name|Path)"|(StrongName|Chaos\s?Mon|Redis|Registry|Registery|User|Insights?|Instrumentation|Match\()Key|(Certificate|cert)(Issuer|Subject)|rollingdate|skuId|HKEY_|AddServicePrincipalCredentials|Password Resets|SecretStore|(0|x|\*){8,})'''

[[rules]]
  description = "CSCAN0160: DomainPassword"
  regex = '''new(?:-object)?\s+System.Net.NetworkCredential\(?:.*?,\s*"[^"]+"'''
  file = '''\.cs$|\.c$|\.cpp$|\.ps1$|\.ps$|\.cmd$|\.bat$|\.log$|\.psd$|\.psm1$'''
  tags = ["key", "DomainPassword"]
  [[rules.whitelist]]
    regex = '''(%1%|\$MIGUSER_PASSWORD|%miguser_pwd%)'''
    description = "ignore placeholders"

[[rules]]
  description = "CSCAN0240: VstsPersonalAccessToken 1"
  file = '''\.(?:cs|ps1|bat|config|xml|json)$'''
  regex = '''(?i)(?:AccessToken|pat|token).*?[':="][a-z0-9]{52}(?:'|"|\s|[\r?\n]+)'''
  tags = ["key", "VstsPersonalAccessToken"]

[[rules]]
  description = "CSCAN0240: VstsPersonalAccessToken 1"
  file = '''\.(?:cs|ps1|bat|config|xml|json)$'''
  regex = '''(?i)(?:AccessToken|pat|token).*?[':="][a-z0-9/+]{70}==(?:'|"|\s|[\r?\n]+)'''
  tags = ["key", "VstsPersonalAccessToken"]

[[rules]]
  description = "CSCAN0250: OAuthToken 1"
  file = '''\.(?:config|js|json|txt|cs|xml|java|py)$'''
  regex = '''eyj[a-z0-9\-_%]+\.eyj[a-z0-9\-_%]+\.[a-z0-9\-_%]+'''
  tags = ["key", "OAuthToken"]

[[rules]]
  description = "CSCAN0250: OAuthToken 2"
  file = '''\.(?:config|js|json|txt|cs|xml|java|py)$'''
  regex = '''refresh_token["']?\s*[:=]\s*["']?(?:[a-z0-9_]+-)+[a-z0-9_]+["']?'''
  tags = ["key", "OAuthToken"]

[[rules]]
  description = "CSCAN0260: AnsibleVault"
  file = '''\.yml$'''
  regex = '''\$ANSIBLE_VAULT;[0-9]\.[0-9];AES256[\r?\n]+[0-9]+'''
  tags = ["key", "AnsibleVault"]

[[rules]]
  description = "CSCAN0230: SlackToken 1"
    regex = '''xoxp-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+-[a-z0-9]+'''
  file = '''\.(?:ps1|psm1|js|json|coffee|xml|js|md|html|py|php|java|ipynb|rb)$|hubot'''
  tags = ["key", "SlackToken"]

[[rules]]
  description = "CSCAN0230: SlackToken 2"
  regex = '''xoxb-[a-z0-9]+-[a-z0-9]+'''
  file = '''\.(?:ps1|psm1|js|json|coffee|xml|js|md|html|py|php|java|ipynb|rb)$|hubot'''
  tags = ["key", "SlackToken"]

[allowlist]
  description = "Allowlisted files"
  files = ['''(.*?)(png|jpg|gif|doc|docx|pdf|bin|xls|zip)$''', '''buildsearchers.xml''','''(?i)(credscan-config.toml|go.mod|go.sum|yarn.lock|package-lock.json|.terraform.lock.hcl)''']
  paths = ['''(?i)(test|reports|node_modules|venv|.venv|.m2|.gradle)''']