Secrets-Patterns-DB curates and organizes a large collection of regular expressions designed for identifying secrets in code and configuration files. The project addresses the scarcity of readily available and comprehensive regex patterns for effective secret detection, empowering security teams to enhance their AppSec programs. It offers a centralized resource for use with various secret scanning tools.
This project distinguishes itself through its format-agnostic approach, supporting multiple secret detection tools with a single database. The regular expressions are thoroughly tested against ReDoS attacks, ensuring both accuracy and security. The categorized patterns, based on confidence levels, allow for prioritized scanning and effective risk assessment.
- Extensive Coverage: Includes over 1600 regular expressions for detecting secrets, API keys, passwords, and tokens.
- Tool Agnostic: Supports Trufflehog v2, Trufflehog v3, and Gitleaks, facilitating seamless integration.
- ReDoS Protection: All regular expressions are tested and validated against ReDoS attacks to prevent denial-of-service vulnerabilities.
- Categorization: Patterns are categorized by confidence levels for prioritized detection and risk management.
- Scripting Support: Provides scripts for converting rules to different formats required by various tools.
- Community Driven: Encourages contributions through Github issues and pull requests for continuous improvement.
- Format Flexibility: Supports exporting data in formats suitable for different secret scanning tools (Toml, JSON, YAML).
Secrets-Patterns-DB is currently in beta, indicating ongoing development and refinement. The project demonstrates active maintenance with recent commits and welcoming community contributions. While documentation is in progress, the core functionality is functional, and the project shows potential for significant growth with community involvement. The commitment to ReDoS testing and validation adds to its reliability.
Security professionals, developers, and security engineering teams benefit from Secrets-Patterns-DB by providing a readily available and tested resource for secret detection. It simplifies the process of building and maintaining secret scanning capabilities, addressing a critical need in AppSec programs and reducing reliance on manual rule creation or limited built-in patterns. This project offers significant value by increasing the efficiency and effectiveness of security assessments.