cloud/anonymizer/patterns/db/secrets.yml

patterns:
  # === SPECIALIZED API KEYS & TOKENS ===
  - name: GitHub Token
    regex: '(?P<replace>gh[psorun]_[a-zA-Z0-9]{30,})\b'
  - name: Slack Token
    regex: '\b(?P<replace>xox[baprs]-[0-9a-zA-Z-]{10,72})\b'
  - name: Discord Bot Token
    regex: '\b(?P<replace>[A-Za-z0-9_-]{24}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27})\b'
  - name: Telegram Bot Token
    regex: '\b(?P<replace>[0-9]{8,10}:[a-zA-Z0-9_-]{35})\b'
  - name: SendGrid API Key
    regex: '\b(?P<replace>SG\.[a-zA-Z0-9_-]{20,24}\.[a-zA-Z0-9_-]{39,50})\b'
  - name: Stripe API Key
    regex: '\b(?P<replace>(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{24,})\b'
  - name: Square API Key
    regex: '\b(?P<replace>sq0[a-z]{3}-[0-9A-Za-z\-_]{20,50})\b'
  - name: Twilio SID/Token
    regex: '\b(?P<replace>AC[0-9a-f]{32}|SK[0-9a-fA-F]{32})\b'
  - name: Mailgun API Key
    regex: '(?P<replace>key-[0-9a-zA-Z]{32,})\b'
  - name: MailChimp API Key
    regex: '(?P<replace>[0-9a-f]{32}-us[0-9]{1,2})\b'
  - name: PayPal Braintree Token
    regex: '(?P<replace>access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32,})\b'
  - name: Artifactory API Token
    regex: '\b(?P<replace>AKC[a-zA-Z0-9]{10,})\b'
  - name: Artifactory Password
    regex: '\b(?P<replace>AP[\dABCDEF][a-zA-Z0-9]{8,})\b'
  - name: New Relic API Key
    regex: '(?P<replace>NR(?:AA|RA|II|IQ|SP)-[a-f0-9A-Z]{2,})\b'
  - name: Firebase Database URL
    regex: '(?P<replace>[a-z0-9.-]+\.firebase(?:io|app)\.com)\b'
  - name: Postman API Key
    regex: '(?P<replace>PMAK-[a-zA-Z0-9]{50,})\b'
  - name: Notion Token
    regex: '\b(?P<replace>secret_[A-Za-z0-9]{43})\b'
  - name: Linear API Key
    regex: '\b(?P<replace>lin_api_[0-9A-Za-z]{40})\b'
  - name: Doppler Token
    regex: '(?P<replace>dp\.pt\.[a-zA-Z0-9]{40,})\b'
  - name: PyPI Upload Token
    regex: '(?P<replace>pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000})'
  - name: RubyGems API Key
    regex: '(?P<replace>rubygems_[a-zA-Z0-9]{48,})\b'
  - name: GitLab Token
    regex: '(?P<replace>glpat-[a-zA-Z0-9\-=_]{20,})\b'
  - name: Dynatrace Token
    regex: '(?P<replace>dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24,}\.[A-Z0-9]{64,})\b'
  - name: FCM Server Key
    regex: '(?P<replace>AAAA[a-zA-Z0-9_-]{7}:[a-zA-Z0-9_-]{140,})\b'
  - name: Bitly Secret Key
    regex: '(?P<replace>R_[0-9a-f]{32,})\b'
  - name: Shopify Access Token
    regex: '(?P<replace>shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32,})\b'
  - name: Microsoft Teams Webhook
    regex: '(?P<replace>https://outlook\.office\.com/webhook/[A-Za-z0-9\-@]+/IncomingWebhook/[A-Za-z0-9\-]+/[A-Za-z0-9\-]+)'
  - name: Discord Webhook
    regex: '(?P<replace>https://discord(?:app)?\.com/api/webhooks/[0-9]{17,18}/[A-Za-z0-9\-_]{64,68})'
  - name: Zapier Webhook
    regex: '(?P<replace>https://hooks\.zapier\.com/hooks/catch/[A-Za-z0-9]+/[A-Za-z0-9]+/)'
  - name: Zoho Webhook
    regex: '(?P<replace>https://creator\.zoho\.com/api/[A-Za-z0-9/\-_\.]+\?authtoken=[A-Za-z0-9]+)'

  # === CLOUD PROVIDER SPECIFIC ===
  - name: AWS Secret Access Key
    regex: '(?i)(?:aws[_-]?)?secret[_-]?(?:access[_-]?)?key[=:]\s*(?P<replace>[A-Za-z0-9/+=]{40})\b'
  - name: Azure Client Secret
    regex: '(?i)(?:azure[_-]?)?client[_-]?secret[=:]\s*(?P<replace>[a-zA-Z0-9~._-]{34,40})\b'
  - name: Google OAuth Access Token
    regex: '\b(?P<replace>ya29\.[0-9A-Za-z\-_]+)\b'
  - name: Google API Key
    regex: '(?P<replace>AIza[0-9a-zA-Z-_]{30,})\b'
  - name: Cloudinary URL
    regex: '(?P<replace>cloudinary://[0-9]+:[A-Za-z0-9\-_\.]+@[A-Za-z0-9\-_\.]+)'
  - name: DigitalOcean Token
    regex: '(?P<replace>dop_v1_[a-f0-9]{60,})\b'
  - name: Heroku API Key
    regex: '(?i)heroku[_-]?(?:api[_-]?)?key[=:]\s*(?P<replace>[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})\b'

  # === CONTAINER & CI/CD TOKENS ===
  - name: Docker Hub Token
    regex: '\b(?P<replace>dckr_pat_[a-zA-Z0-9_-]{36,})\b'
  - name: CircleCI Token
    regex: '(?i)circle[_-]?(?:ci[_-]?)?token[=:]\s*(?P<replace>[a-fA-F0-9]{40})\b'
  - name: Travis CI Token
    regex: '(?i)travis[_-]?(?:ci[_-]?)?token[=:]\s*(?P<replace>[a-zA-Z0-9_]{20,})\b'
  - name: Jenkins API Token
    regex: '(?i)jenkins[_-]?(?:api[_-]?)?token[=:]\s*(?P<replace>[a-f0-9]{32})\b'

  # === INFRASTRUCTURE SECRETS ===
  - name: Kubernetes Service Account Token
    regex: '\b(?P<replace>eyJhbGciOiJSUzI1NiIs[A-Za-z0-9+/=_-]+)\b'
  - name: Ansible Vault Key
    regex: '(?P<replace>\$ANSIBLE_VAULT;[0-9.]+;[A-Z0-9]+\$[a-f0-9]+)\b'
  - name: Terraform Cloud Token
    regex: '(?P<replace>[A-Za-z0-9]{10,}\.atlasv1\.[A-Za-z0-9]{60,})\b'
  - name: HashiCorp Vault Token
    regex: '\b(?P<replace>hvs\.[A-Za-z0-9_-]{90,})\b'

  # === DATABASE & CACHE TOKENS ===
  - name: Redis Auth Token
    regex: '\b(?P<replace>redis://:[a-zA-Z0-9+/=_-]+@[^\s]+)\b'
  - name: MongoDB Connection with Auth
    regex: '(?P<replace>mongodb(?:\+srv)?://[^:]+:[^@]+@[^/\s]+(?:/[^\s?]+)?(?:\?[^\s]+)?)'
  - name: Elasticsearch API Key
    regex: '(?i)elastic[_-]?(?:search[_-]?)?(?:api[_-]?)?key[=:\s]*"?(?P<replace>[A-Za-z0-9+/]{50,}={0,2})"?\b'

  # === API TOKENS BY PATTERN ===
  - name: Short API Key Pattern
    regex: '(?i)(?:api[_-]?)?(?:key|token)[=:]\s*(?P<replace>[A-Z0-9]{32})\b'
  - name: Long API Key Pattern
    regex: '(?i)(?:api[_-]?)?(?:key|token)[=:]\s*(?P<replace>[A-Za-z0-9+/=_-]{64,128})\b'
  - name: Hex Token Pattern
    regex: '(?i)(?:token|secret|key)[=:]\s*(?P<replace>[a-f0-9]{40,64})\b'
  - name: Base64 Token Pattern
    regex: '(?i)(?:token|bearer|auth)[=:]\s*(?P<replace>[A-Za-z0-9+/]{32,}={0,2})\b'

  # === CERTIFICATES & KEYS ===
  - name: SSH Private Key Content
    regex: '(?P<replace>-----BEGIN (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----[A-Za-z0-9+/=\s]+-----END (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----)'
  - name: Certificate Content
    regex: '(?P<replace>-----BEGIN CERTIFICATE-----[A-Za-z0-9+/=\s]+-----END CERTIFICATE-----)'
  - name: PGP Private Key
    regex: '(?s)(?P<replace>-----BEGIN PGP PRIVATE KEY BLOCK-----.*?-----END PGP PRIVATE KEY BLOCK-----)'

  # === SECURITY TOKENS ===
  - name: CSRF Token
    regex: '(?i)csrf[_-]?token[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{20,}[''"]?)\b'
  - name: XSRF Token
    regex: '(?i)xsrf[_-]?token[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{20,}[''"]?)\b'
  - name: Anti-Forgery Token
    regex: '(?i)__RequestVerificationToken[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{20,}[''"]?)\b'

  # === WEBHOOKS & CALLBACKS ===
  - name: Generic Webhook Secret
    regex: '(?i)webhook[_-]?secret[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{20,}[''"]?)\b'
  - name: Callback Token
    regex: '(?i)callback[_-]?token[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{20,}[''"]?)\b'

  # === ENCRYPTION KEYS ===
  - name: AES Key Pattern
    regex: '(?i)aes[_-]?(?:key|encrypt|cipher)[=:]\s*(?P<replace>[A-Fa-f0-9]{32,64})\b'
  - name: Encryption Salt
    regex: '(?i)salt[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{16,}[''"]?)\b'
  - name: IV/Nonce Pattern
    regex: '(?i)(?:iv|nonce)[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{16,}[''"]?)\b'

  # === SIGNING KEYS ===
  - name: Signing Secret
    regex: '(?i)signing[_-]?secret[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{32,}[''"]?)\b'
  - name: HMAC Secret
    regex: '(?i)hmac[_-]?secret[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{32,}[''"]?)\b'

  # === OAUTH & SSO TOKENS ===
  - name: OIDC Client Secret
    regex: '(?i)oidc[_-]?client[_-]?secret[=:]\s*(?P<replace>[''"]?[a-zA-Z0-9+/=_-]{32,}[''"]?)\b'
  - name: SAML Certificate
    regex: '(?i)saml[_-]?cert[=:]\s*(?P<replace>[''"]?[A-Za-z0-9+/=\s]+[''"]?)\b'

  # === BACKUP & RECOVERY CODES ===
  - name: Recovery Code Pattern
    regex: '\b(?P<replace>[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4})\b'
  - name: Backup Code Pattern
    regex: '(?i)backup[_-]?code[=:]\s*(?P<replace>[0-9]{8,12})\b'

  # === SPECIAL FORMATS ===
  - name: License Key Format
    regex: '\b(?P<replace>[A-Z0-9]{4,5}-[A-Z0-9]{4,5}-[A-Z0-9]{4,5}-[A-Z0-9]{4,5}(?:-[A-Z0-9]{4,5})?)\b'
  - name: Windows Product Key
    regex: '\b(?P<replace>[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5})\b'
  - name: Certificate Thumbprint
    regex: '(?i)thumbprint[=:]\s*(?P<replace>[A-F0-9]{40})\b'
  - name: Database Password in DSN
    regex: '(?P<replace>(?:mysql|postgresql|mssql|oracle)://[^:]+:([^@]+)@[^/\s]+)\b'

  # === MONITORING & ANALYTICS ===
  - name: DataDog API Key
    regex: '(?i)datadog[_-]?(?:api[_-]?)?key[=:]\s*(?P<replace>[a-zA-Z0-9]{32})\b'
  - name: New Relic License Key
    regex: '(?i)(?:newrelic|new[_-]?relic)[_-]?(?:license[_-]?)?key[=:]\s*(?P<replace>[a-f0-9]{40})\b'
  - name: Sentry DSN
    regex: '(?P<replace>https://[a-f0-9A-F]{32,}:[a-f0-9A-F]{32,}@[^/\s]+/[0-9]+)'

  # === COMMUNICATION TOKENS ===
  - name: PubNub Keys
    regex: '\b(?P<replace>(?:pub|sub)-c-[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12})\b'
  - name: Pusher Key
    regex: '(?i)pusher[_-]?(?:key|token)[=:]\s*(?P<replace>[a-z0-9]{20})\b'

  # === FINANCIAL & PAYMENT ===
  - name: Plaid Secret
    regex: '(?i)plaid[_-]?(?:secret|key)[=:]\s*(?P<replace>[a-z0-9]{30})\b'
  - name: Razorpay Key
    regex: '(?P<replace>rzp_\w{2,6}_\w{10,})\b'

  # === GENERIC HIGH-ENTROPY STRINGS ===
  - name: High Entropy Base64
    regex: '(?i)(secret|token|key|auth|credential|pass)[_-]?[=:]\s*(?P<replace>[A-Za-z0-9+/]{48,}={0,2})\b'
  - name: High Entropy Hex
    regex: '(?i)(secret|token|key|auth|credential|pass)[_-]?[=:]\s*(?P<replace>[a-f0-9]{48,})\b'
  - name: Mixed Case High Entropy
    regex: '(?i)(secret|token|key|auth|credential|pass)[_-]?[=:]\s*(?P<replace>[A-Za-z0-9]{32,})\b'