Security
Audited patterns for the security layer: detect and validate API keys, tokens, secrets, OAuth/OIDC artifacts, certificates and PKI, security headers, and common injection signatures. Built to be ReDoS-safe.
Generic Bearer Token (Authorization Header)
Matches an HTTP Bearer token in an Authorization header value.
JSON Web Token (JWT) — Structure Validation
Matches a JWT string: three base64url-encoded segments separated by dots.
JWT Header (Decoded Algorithm Field)
Matches a decoded JWT header JSON string for algorithm validation.
Stripe API Key
Matches a Stripe secret key, publishable key, or restricted key.
GitHub Personal Access Token (Classic & Fine-Grained)
Matches a GitHub personal access token in classic (ghp_) or fine-grained (github_pat_) format.
AWS Access Key ID
Matches an AWS Access Key ID: AKIA/ASIA/AROA/AIDA prefix + 16 uppercase alphanumeric characters.
AWS Secret Access Key
Matches an AWS Secret Access Key: 40 characters, base64-like character set.
Google API Key
Matches a Google API key: AIza prefix + 35 characters.
Anthropic API Key
Matches an Anthropic Claude API key: sk-ant- prefix + alphanumeric.
OpenAI API Key
Matches an OpenAI API key: sk- prefix + 48 alphanumeric characters.
Slack Bot / Webhook Token
Matches a Slack API token, webhook URL, or app token.
Twilio Auth Token / SID
Matches a Twilio Account SID or Auth Token.
SendGrid API Key
Matches a SendGrid API key: SG. prefix + 69 characters.
Shopify Access Token
Matches a Shopify Private App access token or API password.
bcrypt Hash
Matches a bcrypt password hash in Modular Crypt Format (MCF).
Argon2 Hash (Argon2i, Argon2d, Argon2id)
Matches an Argon2 password hash in PHC (Password Hashing Competition) string format.
PBKDF2 Hash (Django / passlib format)
Matches a PBKDF2 hash in Django or passlib MCF format.
scrypt Hash (passlib format)
Matches a scrypt hash in passlib/libsodium format.
Password Policy Strength Check
Validates password complexity: minimum 12 chars, requires uppercase, lowercase, digit, and special character.
MD5 Hash (Deprecated — Detection Only)
Matches an MD5 hash: exactly 32 lowercase hexadecimal characters.
SHA-1 Hash (Deprecated — Detection Only)
Matches a SHA-1 hash: exactly 40 lowercase hexadecimal characters.
SHA-256 Hash
Matches a SHA-256 hash: exactly 64 lowercase hexadecimal characters.
SHA-512 Hash
Matches a SHA-512 hash: exactly 128 lowercase hexadecimal characters.
SHA-3 / Keccak Hash (256 and 512)
Matches a SHA-3 (Keccak) hash: 64 hex chars (SHA3-256) or 128 hex chars (SHA3-512).
PEM Certificate Block
Matches a PEM-encoded X.509 certificate block (BEGIN to END markers).
PEM Private Key Block
Matches a PEM-encoded private key block (RSA, EC, PKCS8, or legacy formats).
X.509 Certificate Serial Number
Matches an X.509 certificate serial number in colon-separated hex format.
Certificate Fingerprint (SHA-256)
Matches a certificate SHA-256 fingerprint in colon-separated hex format (32 bytes = 32 pairs).
SSH Public Key
Matches an SSH public key in OpenSSH authorized_keys format.
SSH Private Key (OpenSSH Format)
Matches an OpenSSH private key file in the modern format.
Generic Secret Assignment in Code
Detects common patterns for hardcoded secrets in source code: variable name + assignment + quoted string.
Environment Variable Secret Pattern (.env file)
Matches key=value pairs in .env files that likely contain secrets.
Private Key PEM Header Detection (Any Type)
Matches any PEM private key header line — a lightweight scan trigger for secret detection.
Database Connection String with Credentials
Matches a database connection URI containing a username and password.
Base64-Encoded Potential Secret
Matches a high-entropy base64 string likely containing an encoded credential or key.
HashiCorp Vault Token
Matches a HashiCorp Vault token: s. prefix + base62 string.
OAuth 2.0 Authorization Code
Matches an OAuth 2.0 authorization code: short-lived, typically 32-64 alphanumeric characters.
OAuth 2.0 Refresh Token (Generic)
Matches a typical OAuth 2.0 refresh token: long-lived opaque string.
PKCE Code Verifier
Matches an OAuth 2.0 PKCE (Proof Key for Code Exchange) code verifier: 43-128 base64url characters.
OpenID Connect ID Token (JWT)
Matches an OIDC ID token — same structure as JWT (sec-api-02) but with semantic context.
Private / Reserved IPv4 Ranges
Matches IPv4 addresses in private or reserved ranges (RFC 1918, loopback, link-local, etc.).
CIDR Notation (IPv4)
Matches an IPv4 CIDR block: IP address + prefix length /0 to /32.
CIDR Notation (IPv6)
Matches an IPv6 CIDR block: compressed IPv6 address + prefix length /0 to /128.
CVE Identifier
Matches a CVE (Common Vulnerabilities and Exposures) identifier.
CVSS Score (v3.1 Vector String)
Matches a CVSS v3.1 base vector string.
User-Agent String (Suspicious Patterns)
Matches User-Agent strings commonly associated with scanners, bots, or automated tools.
SQL Injection Pattern (Basic Detection)
Detects common SQL injection payloads in input strings.
XSS Payload Pattern (Basic Detection)
Detects common XSS (Cross-Site Scripting) payloads in input strings.
Path Traversal Pattern
Detects path traversal sequences in file path inputs.
LDAP Injection Pattern
Detects LDAP injection characters and patterns in input.
Server-Side Template Injection (SSTI) Pattern
Detects common SSTI payloads for popular template engines.
HTTP Strict-Transport-Security Header
Validates the format of an HSTS header value.
Content Security Policy (CSP) Directive
Matches a CSP directive with its source list.
X-Frame-Options Header
Validates the X-Frame-Options header value for clickjacking protection.
Permissions Policy (Feature Policy) Header
Matches a Permissions Policy directive controlling browser feature access.
ISO 27001 Control Reference
Matches an ISO 27001:2022 control reference number (domain + control number).
NIST SP 800-53 Control Identifier
Matches a NIST SP 800-53 control identifier: family code + control number + optional enhancement.
OWASP Top 10 Reference
Matches an OWASP Top 10 category reference for the 2021 edition.
PCI-DSS Requirement Reference
Matches a PCI-DSS v4.0 requirement reference number.