Semgrep
ID semgrep
detector
Semgrep is a static analysis engine that runs pattern rules over source code and plain text. Its public rule registry has secret rules under generic/secrets/ (the p/secrets and p/gitleaks rulesets) that find credential formats, such as cloud keys, service tokens and private key blocks, with regular expressions and entropy checks. Semgrep Secrets, the commercial product, adds proprietary rules, data-flow analysis and live validation; its full detector list is shown only inside a customer deployment. The list of supported types covers only the registry datatypes that match a public rule.
- Website
- https://github.com/semgrep/semgrep-rules/tree/develop/generic/secrets
- Supported types
- 28
Supported semantic types
| ID | Name | Categories | Countries | Description |
|---|---|---|---|---|
| aws_access_key_id | AWS access key ID draft | secrets | global | Public half of an Amazon Web Services access key pair, sent with every signed API request together with the secret access key. It has 20... |
| aws_account_id | AWS account ID draft | identifiers | global | Twelve-digit number that identifies an Amazon Web Services account, for example in the account field of an ARN. AWS states that account... |
| aws_secret_access_key | AWS secret access key draft | secrets | global | Secret part of an Amazon Web Services access key pair, used with the access key ID to sign API requests (for example to Amazon S3): 40... |
| bcrypt_hash | bcrypt password hash draft | secrets, cryptography | global | Password hash produced by bcrypt in Modular Crypt Format: $2, an optional version letter (a, b, x or y), $, a two-digit cost, $ and 53... |
| facebook_app_access_token | Facebook app access token draft | secrets | global | App access token of the Meta (Facebook) Graph API written as the app ID, a vertical bar and the app secret. Meta allows this form in... |
| github_token | GitHub token draft | secrets | global | Token issued by GitHub, such as a personal access token. It starts with a prefix that names the token type (ghp_, gho_, ghu_, ghs_ or... |
| gitlab_pat | GitLab personal access token draft | secrets | global | Personal access token of GitLab, which authenticates a user to the GitLab API and to Git over HTTPS. GitLab gives these tokens the... |
| google_api_key | Google API key draft | secrets | global | API key for Google Cloud and Google Maps APIs: the prefix AIza followed by 35 letters, digits, hyphens or underscores. |
| heroku_oauth_token | Heroku API OAuth access token draft | secrets | global | OAuth access token of the Heroku Platform API, which the Heroku CLI also uses. Tokens granted from April 2024 start with HRKU-: until... |
| jfrog_api_key | JFrog Artifactory API key draft | secrets | global | Deprecated API key of JFrog Artifactory: the prefix AKCp followed by 69 letters and digits (the format that the gitleaks secret scanner... |
| jfrog_reference_token | JFrog reference token draft | secrets | global | Short token of the JFrog Platform (Artifactory) that refers to a full JWT access token. It has 64 characters: the prefix cmVmd followed... |
| jwt | JSON Web Token (JWT) draft | secrets | global | Compact JSON Web Token (RFC 7519) signed with JWS: three Base64url parts (header, claims and signature) separated by dots. The header... |
| mailchimp_api_key | Mailchimp API key draft | secrets | global | API key of the Mailchimp Marketing API: 32 hexadecimal digits, a hyphen and the data center of the account (for example us6), which is... |
| npm_access_token | npm access token draft | secrets | global | Access token of the npm package registry in the format introduced in 2021: the prefix npm_ followed by 36 letters and digits, the last... |
| openai_api_key | OpenAI API key draft | secrets | global | Secret key of the OpenAI API. Keys start with sk-; project, service account and admin keys start with sk-proj-, sk-svcacct- or... |
| pgp_private_key_block | OpenPGP private key block draft | secrets, cryptography | global | OpenPGP secret key in ASCII armor: Radix-64 text between the lines -----BEGIN PGP PRIVATE KEY BLOCK----- and -----END PGP PRIVATE KEY... |
| sendgrid_api_key | SendGrid API key draft | secrets | global | API key of Twilio SendGrid, also used as the SMTP password. Keys are always 69 characters long and start with SG. followed by letters,... |
| slack_token | Slack token draft | secrets | global | Access token of the Slack API. The prefix names the token type, for example xoxb- for bot tokens and xoxp- for user tokens. |
| slack_webhook_url | Slack incoming webhook URL draft | secrets | global | URL of a Slack incoming webhook or workflow trigger on hooks.slack.com. Anyone who knows the URL can post messages to the channel, so... |
| sonarqube_token | SonarQube token draft | secrets | global | Token of SonarQube Server used to run an analysis or call the web API instead of a login and password. Current tokens start with one of... |
| square_access_token | Square access token draft | secrets | global | Personal or OAuth access token of the Square APIs. Square does not document the format; secret scanners such as gitleaks recognize it by... |
| square_oauth_secret | Square OAuth application secret draft | secrets | global | Application secret of a Square developer application, which the application uses to exchange OAuth authorization codes for access... |
| stripe_api_key | Stripe secret or restricted API key draft | secrets | global | Server-side API key of Stripe. Secret keys start with sk_ and restricted keys with rk_, followed by test_ for a sandbox or live_ for... |
| telegram_bot_token | Telegram bot token draft | secrets | global | Token that authorizes a bot in the Telegram Bot API: the numeric bot ID, a colon and a secret that starts with A. Telegram documents the... |
| twilio_api_key_sid | Twilio API key SID draft | secrets | global | String identifier (SID) of a Twilio API key: SK followed by 32 hexadecimal digits. The SID is used together with the API key secret as... |
| unix_shadow_entry | Unix shadow password file entry PII draft | secrets | global | One line of /etc/shadow on Linux and other Unix systems: nine colon-separated fields with the login name, the hashed password (or ! or *... |
| uri_with_password | URI with embedded password PII draft | secrets, internet | global | URI whose user information part contains a password, as in scheme://user:password@host/. RFC 3986 deprecates this form, but database and... |
| x509_private_key | X.509 certificate private key draft | secrets, cryptography | global | Private key of an X.509 certificate, usually written as a PEM block that starts with -----BEGIN PRIVATE KEY----- (or RSA PRIVATE KEY, EC... |
Use this record
- JSON: API v1 · legacy shape
- Improve it: edit
data/tools/detectors/semgrep.yamlon GitHub