detect-secrets
ID detectsecrets
detector
detect-secrets is an open-source (Apache-2.0) secret scanner from Yelp, built to stop new secrets from entering a code base: it records known findings in a baseline file and is usually run as a pre-commit hook. Its plugins find secrets with service-specific regular expressions, with keywords such as password in assignments and with string entropy, and some plugins can verify a secret with the service. The plugins are in detect_secrets/plugins/ of the repository; the list of supported types covers only the registry datatypes that match a plugin.
- Website
- https://github.com/Yelp/detect-secrets
- Supported types
- 22
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| azure_storage_account_key | Azure Storage account key draft | secrets | global | Access key of an Azure Storage account: 512 bits encoded in Base64, which gives 86 characters followed by two equals signs. |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| ipv4 | IPv4 address PII | internet, pii | global | 32-bit address of Internet Protocol version 4 (RFC 791), written in dotted-decimal notation as four numbers from 0 to 255, such as... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| uri_with_password | URI with embedded password PII draft | secrets, internet | global | URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/detectsecrets.yamlon GitHub