Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/mazen160/secrets-patterns-db
Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
https://github.com/mazen160/secrets-patterns-db
gitleaks regex regular-expression regular-expressions secrets secrets-detection trufflehog trufflehog3
Last synced: 7 days ago
JSON representation
Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more.
- Host: GitHub
- URL: https://github.com/mazen160/secrets-patterns-db
- Owner: mazen160
- License: cc-by-sa-4.0
- Created: 2023-02-07T15:57:57.000Z (almost 2 years ago)
- Default Branch: master
- Last Pushed: 2024-01-26T12:15:35.000Z (12 months ago)
- Last Synced: 2025-01-05T11:11:37.407Z (14 days ago)
- Topics: gitleaks, regex, regular-expression, regular-expressions, secrets, secrets-detection, trufflehog, trufflehog3
- Language: Python
- Homepage: https://mazinahmed.net/blog/secrets-patterns-db/
- Size: 175 KB
- Stars: 1,070
- Watchers: 13
- Forks: 134
- Open Issues: 7
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
- awesome-cicd-attacks - Secrets Patterns Database - The largest open-source database for detecting secrets, API keys, passwords, tokens, and more. (Tools / Defense Evasion)
- awesome-rainmana - mazen160/secrets-patterns-db - Secrets Patterns DB: The largest open-source Database for detecting secrets, API keys, passwords, tokens, and more. (Python)
README
# 🗄️ Secrets Patterns Database 🗄️
The largest open-source database for detecting secrets, API keys, passwords, tokens, and more. Use secrets-patterns-db to feed your secret scanning engine with regex patterns for identifying secrets.
---
# 🚀 Features
- Over 1600 regular expressions for detecting secrets, passwords, API keys, tokens, and more.
- Format agnostic. A Single format that supports secret detection tools, including Trufflehog and Gitleaks.
- Tested and reviewed Regular expressions.
- Categorized by confidence levels of each pattern.
- All regular expressions are tested against ReDos attacks.
# ❔ Why?
There are limited resources online for Regular Expressions patterns for secrets. TruffleHog offers ~700 as built-in rules. GitLeaks offers ~60 rules. While it's a good start, it's not enough. There's a lot of work that needs to be done for maintenance and keeping up with new secrets patterns.
I have collected and curated Regular Expressions Patterns for Secrets, API Tokens, Keys, and Passwords. I'm open-sourcing the database I built (Secrets-Patterns-DB), and hope that security teams contribute to it!
The Secrets-Patterns-DB contains over 1600 Regular Expressions. I have also written scripts to validate Regexes against ReDoS attacks, and CI jobs to load and validate Regexes, and I also manually cleaned-up invalid ones.
It's in Beta. There’s a lot of room for improvement on the project. I'm looking forward to your Pull Requests and Issues on Github to enhance Secrets-Patterns-DB for everyone.
Are you planning to enhance your secrets detection in your AppSec program? Please take some time to contribute to the project! :pray:
---
# 💻 Contribution
Contribution is always welcome! Please feel free to report issues on Github and create Pull Requestss for new features.
## 📌 Ideas to Start on
# Using
For Trufflehog v2
$> ./convert-rules.py --db ../db/rules-stable.yml --type trufflehog
For Gitleaks
$> ./convert-rules.py --db ../db/rules-stable.yml --type gitleaks
Optional:
--export - Set filename, extension will be added by type (gitleaks = toml, trufflehog = json)
Would like to contribute to secrets-patterns-db? Here are some ideas that you may start with:
- Support severity
- Categorize patterns by type?
- Categorize patterns by tags?
- Support more tools?
---
# 📄 License
This work is licensed under a Creative Commons Attribution 4.0 International License.
# 💚 Author
**Mazin Ahmed**
- **Website**: [https://mazinahmed.net](https://mazinahmed.net)
- **Email**: `mazin [at] mazinahmed [dot] net`
- **Twitter**: [https://twitter.com/mazen160](https://twitter.com/mazen160)
- **Linkedin**: [http://linkedin.com/in/infosecmazinahmed](http://linkedin.com/in/infosecmazinahmed)