Gitleaks
ID gitleaks
detector
Open-source (MIT) secret scanner that finds hard-coded credentials, such as API keys, access tokens and private keys, in git history, directories and standard input. Its rules combine regular expressions with keywords and entropy checks. The list of supported types covers only the registry datatypes that match a gitleaks rule.
- Website
- https://github.com/gitleaks/gitleaks
- Supported types
- 48
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| age_secret_key | age secret key (X25519 identity) draft | secrets, cryptography | global | Secret key (identity) of the age file encryption format and tool, which decrypts files encrypted to the matching age1... public key. It... |
| anthropic_api_key | Anthropic API key draft | secrets | global | Secret key of the Anthropic (Claude) API, sent in the x-api-key header. Standard keys start with sk-ant-api03- and Admin API keys, which... |
| atlassian_api_token | Atlassian API token draft | secrets | global | API token of an Atlassian account (Jira, Confluence and other Atlassian cloud products). Current tokens start with ATATT3; secret... |
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| cloudflare_origin_ca_key | Cloudflare Origin CA key draft | secrets | global | Key for the Cloudflare Origin CA certificates API, often sent in the X-Auth-User-Service-Key header and also used by the Keyless SSL key... |
| databricks_access_token | Databricks personal access token draft | secrets | global | Personal access token of Databricks, used to authenticate to a Databricks workspace. It starts with dapi followed by 32 hexadecimal... |
| digitalocean_token | DigitalOcean API token draft | secrets | global | API token of DigitalOcean. The prefix tells the token type: dop_v1_ for a personal access token, doo_v1_ for an OAuth access token and... |
| doppler_token | Doppler token draft | secrets | global | Access token of the Doppler secrets manager. Doppler documents one format per token type, each starting with dp. and a type code: dp.pt.... |
| dynatrace_token | Dynatrace token draft | secrets | global | Access token of Dynatrace in the format used since Dynatrace version 1.210: a prefix that names the token type (dt0 followed by a letter... |
| facebook_app_access_token | Facebook app access token draft | secrets | global | App access token of the Meta (Facebook) Graph API written as the app ID, a vertical bar and the app secret. Meta allows this form in... |
| github_fine_grained_pat | GitHub fine-grained personal access token draft | secrets | global | Fine-grained personal access token of GitHub, limited to selected repositories and permissions: github_pat_ followed by 82 letters,... |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| grafana_service_account_token | Grafana service account token draft | secrets | global | Token of a Grafana service account, sent as a bearer token to the Grafana HTTP API: glsa_ followed by 32 letters and digits, an... |
| hashicorp_vault_token | HashiCorp Vault token draft | secrets | global | Token that authenticates a client to HashiCorp Vault. Since Vault 1.10 the prefix names the token type - hvs. for service tokens, hvb.... |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| huggingface_access_token | Hugging Face access token draft | secrets | global | User access token of the Hugging Face Hub, used in place of a password for git, as a bearer token for Inference Providers and in the... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jfrog_reference_token | JFrog reference token draft | secrets | global | Short token of the JFrog Platform (Artifactory) that refers to a full JWT access token. It has 64 characters: the prefix cmVmd followed... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| linear_api_key | Linear API key draft | secrets | global | Personal API key of Linear, the issue tracking service: lin_api_ followed by 40 letters and digits. |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| new_relic_user_api_key | New Relic user key draft | secrets | global | User key of New Relic, a personal API key that NerdGraph, New Relic's GraphQL API, requires for querying data and changing... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| onepassword_service_account_token | 1Password service account token draft | secrets | global | Token of a 1Password service account. 1Password gives it the prefix ops_ so that code analyzers can find it; the rest is a... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| planetscale_password | PlanetScale database password draft | secrets | global | Password of a PlanetScale database: pscale_pw_ followed by 32 to 64 letters, digits and the characters _ = . -. |
| planetscale_token | PlanetScale API token draft | secrets | global | Token for the PlanetScale API and CLI: a service token starts with pscale_tkn_ and an OAuth token with pscale_oauth_. Secret scanners... |
| postman_api_key | Postman API key draft | secrets | global | API key of the Postman API, sent in the X-API-Key header: PMAK- followed by 24 hexadecimal digits, a hyphen and 34 more hexadecimal digits. |
| pulumi_access_token | Pulumi access token draft | secrets | global | Access token of Pulumi Cloud (a personal, organization or team token): pul- followed by 40 hexadecimal digits. |
| pypi_token | PyPI API token draft | secrets | global | API token of the Python Package Index, used to upload packages. It is a serialized macaroon with the prefix pypi-; PyPI documents that... |
| rubygems_api_key | RubyGems API key draft | secrets | global | API key of RubyGems.org, used by the gem CLI to push and manage gems, for example through the GEM_HOST_API_KEY environment variable:... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| sendinblue_api_key | Sendinblue API key draft | secrets | global | API key of the Sendinblue email marketing service: xkeysib- followed by 64 hexadecimal digits, a hyphen and 16 letters and digits. |
| sentry_auth_token | Sentry auth token draft | secrets | global | Auth token of Sentry, the error monitoring service. Personal (user) tokens are sntryu_ followed by 64 hexadecimal digits. Organization... |
| shopify_access_token | Shopify access token draft | secrets | global | Access token of a Shopify app. The prefix tells the kind of token: shpat_ for an app access token, shpca_ for a custom app and shppa_... |
| shopify_shared_secret | Shopify app shared secret draft | secrets | global | Shared secret of a Shopify app: the prefix shpss_ followed by 32 hexadecimal digits. |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| sonarqube_token | SonarQube token draft | secrets | global | Token of SonarQube Server used to run an analysis or call the web API instead of a login and password. Current tokens start with one of... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| terraform_cloud_api_token | HashiCorp Terraform Cloud API token draft | secrets | global | User or organization API token of HashiCorp Terraform Cloud: 14 letters and digits, the marker .atlasv1. and 60 to 70 more letters,... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/gitleaks.yamlon GitHub