secret-patterns

# Secret Detection Patterns Patterns for finding leaked credentials in codebases, git history, and CI logs. ## AWS Credentials ```bash # Access Key ID: always starts with AKIA (long-term) or ASIA (session) AKIA[0-9A-Z]{16} ASIA[0-9A-Z]{16} # Secret Access Key: 40-char base64-ish string after aws_secret aws_secret_access_key\s*=\s*[A-Za-z0-9/+=]{40} # ripgrep one-liner rg --no-heading -n '(AKIA|ASIA)[0-9A-Z]{16}' . ``` ## GitHub Tokens ```bash # Personal access tokens (classic and fine-grained) ghp_[A-Za-z0-9]{36} github_pat_[A-Za-z0-9_]{82} # OAuth / app tokens gho_[A-Za-z0-9]{36} ghs_[A-Za-z0-9]{36} ghu_[A-Za-z0-9]{36} ghr_[A-Za-z0-9]{36} rg --no-heading -n 'gh[pousr]_[A-Za-z0-9]{36}' . ``` ## Stripe Keys ```bash # Live secret (never commit) sk_live_[A-Za-z0-9]{24,} # Test secret (flag but lower severity) sk_test_[A-Za-z0-9]{24,} # Publishable keys (public, lower severity) pk_live_[A-Za-z0-9]{24,} pk_test_[A-Za-z0-9]{24,} rg --no-heading -n 'sk_(live|test)_[A-Za-z0-9]{24,}' . ``` ## OpenAI / Anthropic Keys ```bash # OpenAI sk-proj-[A-Za-z0-9\-_]{50,} sk-[A-Za-z0-9]{48} # Anthropic sk-ant-[A-Za-z0-9\-_]{90,} rg --no-heading -n '(sk-proj-|sk-ant-)' . ``` ## JWT Tokens ```bash # Three base64url segments separated by dots eyJ[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+ # Decode header to verify (Python) import base64, json header = token.split('.')[0] + '==' print(json.loads(base64.urlsafe_b64decode(header))) ``` ## PEM Private Keys ```bash # RSA, ...