[ { "id": "SEC001", "pattern": "AKIA[0-9A-Z]{16}|AKIA[A-Z0-9]+['\"]|\\bAKIA", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded secrets", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC002", "pattern": "sk-[a-zA-Z0-9]{20,}|sk_live_[a-zA-Z0-9]{20,}|ghp_[a-zA-Z0-9]{20,}|AIzaSy[a-zA-Z0-9]{33}", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded secrets", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC003", "pattern": "-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----|SuperSecretProd\\d+!|hardcoded-jwt-secret", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded secrets", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC004", "pattern": "(?:JWT_SECRET|HMAC_SECRET|SECRET_KEY|API_SECRET|WEBHOOK_SECRET)\\s*=\\s*['\"][^'\"]{12,}['\"]", "flags": "i", "category": "hardcoded_secret", "description": "Generic JWT/HMAC secrets (long strings in secret/key variables)", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC005", "pattern": "(?:admin_sk_live|xoxb-[0-9]{11,}|rk_live_[a-zA-Z0-9]{32,})", "flags": "i", "category": "hardcoded_secret", "description": "Generic JWT/HMAC secrets (long strings in secret/key variables)", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC006", "pattern": "(?:JWT_SECRET|JWT_REFRESH_SECRET|SIGNING_KEY|SigningKey|jwtSecret|jwt_secret|secret(?:Key|_key)|signingSecret)\\s*[=:]\\s*['\"`][^'\"`]{12,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "JWT signing secrets / refresh secrets assigned to variables", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC007", "pattern": "GOCSPX-[A-Za-z0-9_-]{20,}|SG\\.[A-Za-z0-9_-]{20,}\\.[A-Za-z0-9_-]{20,}", "flags": "", "category": "hardcoded_secret", "description": "OAuth client secrets, SendGrid, GOCSPX, GitHub secret tokens", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC008", "pattern": "(?:clientSecret|client_secret|refreshToken|refresh_token)\\s*[=:]\\s*['\"`][A-Za-z0-9/_\\-\\.]{16,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "OAuth client secrets, SendGrid, GOCSPX, GitHub secret tokens", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC009", "pattern": "(?:password|passwd|pwd)\\s*[:=]\\s*['\"`][^'\"`\\s]{6,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded passwords / connection strings with embedded passwords in source code", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC010", "pattern": "redis:\\/\\/:?[^@\\s'\"]{6,}@|mongodb:\\/\\/[^:\\s'\"]+:[^@\\s'\"]{6,}@", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded passwords / connection strings with embedded passwords in source code", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC011", "pattern": "(?:ENCRYPTION_KEY|HMAC_KEY|ENCRYPT_KEY|AES_KEY|encKey|EncKey|hmacKey)\\s*[=:]\\s*(?:['\"`]|b['\"])[^\\s'\"]{12,}", "flags": "i", "category": "hardcoded_secret", "description": "Encryption keys / HMAC keys in const/var", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC012", "pattern": "auth\\s*:\\s*\\{[^}]*pass\\s*:\\s*['\"`][^'\"`\\s]{4,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "SMTP auth passwords in transport config", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC013", "pattern": "(?:const|let|var|val|final)\\s+\\w*(?:[Tt]oken|[Aa][Pp][Ii][Kk]ey|[Ss]ecret|[Pp]assword|[Pp]asswd)\\w*\\s*[=:]\\s*['\"`][A-Za-z0-9+\\/=_\\-\\.@#!$%^&*]{12,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "Generic hardcoded token/key/secret/apiKey assignment", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC014", "pattern": "Password=[^;\\s'\"]{6,}[;'\"]|pwd=[^;\\s'\"]{6,}[;'\"]", "flags": "i", "category": "hardcoded_secret", "description": "Connection strings with embedded Password= (SQL Server, ODBC)", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC015", "pattern": "AccountKey=[A-Za-z0-9+\\/=]{20,}", "flags": "i", "category": "hardcoded_secret", "description": "Azure AccountKey= in connection strings (base64 encoded key)", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC016", "pattern": "hooks\\.slack\\.com\\/services\\/[A-Z0-9]+\\/[A-Z0-9]+\\/[A-Za-z0-9]+", "flags": "i", "category": "hardcoded_secret", "description": "Slack webhook URL", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC017A", "pattern": "pdkey-[a-z]-[A-Za-z0-9]{16,}", "flags": "i", "category": "hardcoded_secret", "description": "PagerDuty / generic pdkey token", "language": [ "js", "ts", "python", "java", "go", "csharp", "php", "ruby", "rust", "kotlin" ], "severity": "critical" }, { "id": "SEC018", "pattern": "private\\s+static\\s+final\\s+String\\s+\\w*(?:SECRET|KEY|TOKEN|PASSWORD|SIGNING)\\w*\\s*=\\s*[\"'][^\"']{12,}[\"']|static\\s+final\\s+String\\s+\\w*(?:SECRET|KEY|TOKEN|PASSWORD|SIGNING)\\w*\\s*=\\s*[\"'][^\"']{12,}[\"']", "flags": "i", "category": "hardcoded_secret", "description": "Java static final String SECRET/KEY/TOKEN with hardcoded value", "language": [ "java" ], "severity": "critical" }, { "id": "SEC019", "pattern": "\\[\\s*\\]byte\\s*\\(\\s*[\"'][^\"']{12,}[\"']\\s*\\)", "flags": "", "category": "hardcoded_secret", "description": "Go []byte(\"hardcoded secret string\") for JWT signing keys", "language": [ "go" ], "severity": "critical" }, { "id": "SEC020", "pattern": "(?:AesKey|AesIv|EncKey|HmacKey|aesKey|hmacKey)\\s*=\\s*new\\s+byte\\s*\\[\\s*\\]", "flags": "i", "category": "hardcoded_secret", "description": "Hardcoded byte array AES key (C#: new byte[] { 0x2b, 0x7e, ... })", "language": [ "csharp" ], "severity": "critical" }, { "id": "SEC021", "pattern": "define\\s*\\(\\s*['\"](?:REDIS_PASSWORD|SESSION_SECRET|CSRF_SECRET|DB_PASS|APP_SECRET|SMTP_PASS|JWT_SECRET)['\"]\\s*,\\s*['\"][^'\"]{6,}['\"]", "flags": "i", "category": "hardcoded_secret", "description": "PHP hardcoded secrets: define() with password/secret constants", "language": [ "php" ], "severity": "critical" }, { "id": "SEC022", "pattern": "const\\s+\\w*(?:SECRET|_SECRET)\\w*\\s*:\\s*string\\s*=\\s*['\"`][^'\"`]{12,}['\"`]", "flags": "i", "category": "hardcoded_secret", "description": "TypeScript: hardcoded secret with type annotation", "language": [ "typescript" ], "severity": "critical" } ]