# Bare token prefixes that the vendored rulesets (betterleaks, detect-secrets) do not know yet.
# One rule per line:  <id>  <regex>   - the whole match is the secret; anchor on the prefix.
# Add a line by pull request when a real token of a service went through undetected. Keep the
# tail length at the service's minimum so a short look-alike is not a hit. No test values here.
gitlab-runner-token          glrt-[0-9A-Za-z_.-]{20,}
gitlab-deploy-token-any      gldt-[0-9A-Za-z_-]{20,}
webhook-signing-secret       whsec_[A-Za-z0-9+/=_-]{24,}
cloudflare-user-api-token    cfut_[A-Za-z0-9_-]{30,}
# 0.6.19, from a survey of other detectors. Each format is a fact from the vendor's documentation where it has one
# (Tailscale key prefixes, Cloudflare token formats, Doppler token formats, Square OAuth, Mapbox sk/pk, SonarQube
# Cloud sqco_, the PyPI token and the warehouse source); the rest are formats other detectors know (trufflehog,
# detect-secrets), each regex written here. A client id (Salesforce 3MVG9, Square sq0idp) is public and has no line.
google-oauth-access-token    ya29\.[0-9A-Za-z_-]{30,2048}
tailscale-key                tskey-(?:(?:api|auth|client|scim|webhook)-[0-9A-Za-z]{4,40}-|k[0-9A-Za-z]{4,16}CNTRL-)[0-9A-Za-z]{16,64}
discord-webhook-url          https://(?:ptb\.|canary\.)?discord(?:app)?\.com/api/(?:v[0-9]{1,2}/)?webhooks/[0-9]{17,20}/[0-9A-Za-z_-]{60,80}
salesforce-refresh-token     5(?i:aep861)[0-9A-Za-z._=]{80,400}
cloudflare-api-token         (?:cfk|cfat)_[0-9A-Za-z]{40,64}
hubspot-private-app-token    pat-(?:na|eu|ap)[0-9]-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
new-relic-user-key           NRAK-[0-9A-Z]{27}
new-relic-insert-key         NRII-[0-9A-Za-z_-]{32}
new-relic-rest-api-key       NRRA-[0-9a-fA-F]{42}
new-relic-admin-key          NRAA-[0-9a-fA-F]{27}
new-relic-query-key          NRIQ-[0-9A-Za-z_-]{32}
new-relic-pixie-api-key      px-api-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
anthropic-oauth-token        sk-ant-o(?:at|rt)01-[0-9A-Za-z_-]{40,}
flutterwave-secret-key       FLWSECK(?:_TEST)?-[0-9A-Za-z]{20,40}-X
doppler-token                dp\.(?:ct|pt|sa|said|scim|audit|st)\.(?:[a-z0-9_-]{2,35}\.)?[0-9A-Za-z]{40,44}
square-oauth-secret          (?:sandbox-)?sq0csp-[0-9A-Za-z_-]{43}
contentful-personal-token    CFPAT-[0-9A-Za-z_-]{43}
mapbox-secret-token          sk\.eyJ[0-9A-Za-z_-]{20,}\.[0-9A-Za-z_-]{20,}
kong-konnect-token           (?:kpat|spat)_[0-9A-Za-z]{40,60}
sonarcloud-org-token         sqco_[0-9A-Za-z]{40,64}
adafruit-io-key              (?<![0-9A-Za-z_])aio_(?=[A-Za-z]*[0-9])[0-9A-Za-z]{28}
pypi-test-upload-token       pypi-AgENdGVzdC5weXBp[L]m9yZw[0-9A-Za-z_-]{50,1000}
# 0.6.20, from a coverage measurement against other secret catalogs. Each regex is written here from the vendor's
# documentation (GitHub's ghs_<app id>_<JWT> installation token, Heroku's HRKU- token) or from a catalog under the
# Apache or MIT license: GitLab's secret detection rules (MIT), Kingfisher and Nosey Parker (Apache-2.0).
google-oauth-client-secret   GOCSPX-(?:(?<![A-Za-z0-9_-]GOCSPX-)|(?<=\\[nrt]GOCSPX-))[A-Za-z0-9_-]{28}(?![A-Za-z0-9_-])
sonarqube-token              squ_(?:(?<![A-Za-z0-9_]squ_)|(?<=\\[nrt]squ_))[0-9a-f]{40}(?![A-Za-z0-9_])
dynatrace-platform-token     dt0s(?:(?<![A-Za-z0-9]dt0s)|(?<=\\[nrt]dt0s))[0-9]{2}\.[A-Z0-9]{8}\.[A-Z0-9]{64}(?![A-Za-z0-9])
postman-collection-token     PMAT-(?:(?<![A-Za-z0-9]PMAT-)|(?<=\\[nrt]PMAT-))[0-9A-Z]{26}(?![A-Za-z0-9])
shopify-partner-api-token    prtapi_(?:(?<![A-Za-z0-9_]prtapi_)|(?<=\\[nrt]prtapi_))[a-f0-9]{32}(?![A-Za-z0-9_])
planetscale-app-secret       pscale_app_[s]ecret_(?:(?<![A-Za-z0-9_-]pscale_app_[s]ecret_)|(?<=\\[nrt]pscale_app_[s]ecret_))[0-9A-Za-z_-]{43}(?![0-9A-Za-z_-])
intercom-access-token        dG9rO(?:(?<![A-Za-z0-9+/]dG9rO)|(?<=\\[nrt]dG9rO))(?:[0-9A-Za-z]{55}(?![0-9A-Za-z+/=])|[0-9A-Za-z]{54}=|[0-9A-Za-z]{53}==)
netlify-personal-token       nfp_(?:(?<![A-Za-z0-9_]nfp_)|(?<=\\[nrt]nfp_))(?=[0-9a-f]{0,47}[g-zA-Z])[A-Za-z0-9]{40,48}(?![A-Za-z0-9_])
teamcity-access-token        eyJ0eXAi[O]iAiVENWMiJ9\.(?:(?<![A-Za-z0-9_.-]eyJ0eXAi[O]iAiVENWMiJ9\.)|(?<=\\[nrt]eyJ0eXAi[O]iAiVENWMiJ9\.))[A-Za-z0-9_-]{36}\.[A-Za-z0-9_-]{48}(?![A-Za-z0-9_-])
dependency-track-api-key     odt_(?:(?<![A-Za-z0-9_]odt_)|(?<=\\[nrt]odt_))(?=[0-9a-f]{0,254}[g-zA-Z])(?=[A-Za-z]{0,254}[0-9])[A-Za-z0-9]{32,255}(?![A-Za-z0-9_])(?!\.[A-Za-z0-9])
tavily-api-key               tvly-(?:(?<![A-Za-z0-9_-]tvly-)|(?<=\\[nrt]tvly-))(?:dev-)?[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
jina-api-key                 jina_(?:(?<![A-Za-z0-9_]jina_)|(?<=\\[nrt]jina_))(?=[A-Za-z]{0,59}[0-9])[A-Za-z0-9]{60}(?![A-Za-z0-9_])
aws-appsync-api-key          da2-(?:(?<![A-Za-z0-9_-]da2-)|(?<=\\[nrt]da2-))(?=[a-z]{0,25}[0-9])[a-z0-9]{26}(?![A-Za-z0-9_-])
stackhawk-api-key            hawk\.(?:(?<![A-Za-z0-9_.-]hawk\.)|(?<=\\[nrt]hawk\.))[0-9A-Za-z_-]{20}\.[0-9A-Za-z_-]{20}(?![0-9A-Za-z_-])(?!\.[0-9A-Za-z_-])
heroku-api-key-uuid          HRKU-(?:(?<![A-Za-z0-9_-]HRKU-)|(?<=\\[nrt]HRKU-))[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}(?![0-9A-Za-z_-])
github-app-installation-jwt  ghs_(?:(?<![A-Za-z0-9_]ghs_)|(?<=\\[nrt]ghs_))[0-9]{1,20}_[A-Za-z0-9_-]{10,2048}\.[A-Za-z0-9_-]{10,2048}\.[A-Za-z0-9_-]{10,2048}(?![A-Za-z0-9_-])(?!\.[A-Za-z0-9_-])
# GitLab's pipeline trigger and CI job tokens in their newer forms (routable, or a JWT after glcbt-); the vendored rules
# take glptt- and 40 hex digits, glcbt- with a partition prefix, and claimed the first part of a longer token
gitlab-pipeline-trigger-token-any glptt-(?:(?<![A-Za-z0-9_-]glptt-)|(?<=\\[nrt]glptt-))[0-9A-Za-z_-]{20,400}(?:\.[0-9a-z]{2}\.[0-9a-z]{9})?(?![0-9A-Za-z_-])
gitlab-ci-job-token-any      glcbt-(?:(?<![A-Za-z0-9_-]glcbt-)|(?<=\\[nrt]glcbt-))[0-9A-Za-z_-]{20,2048}(?:\.[0-9A-Za-z_-]{2,2048}){0,2}(?![0-9A-Za-z_-])(?!\.[0-9A-Za-z_-])
# 0.6.39: the legacy Office 365 connector URL of Microsoft Teams; the whole URL posts to the channel (#11)
microsoft-teams-webhook-legacy  https(?:(?<![A-Za-z0-9]https)|(?<=\\[nrt]https))://outlook\.office(?:365)?\.com/webhook/[0-9A-Fa-f]{8}-(?:[0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}@[0-9A-Fa-f]{8}-(?:[0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}/IncomingWebhook/[0-9A-Fa-f]{32}/[0-9A-Fa-f]{8}-(?:[0-9A-Fa-f]{4}-){3}[0-9A-Fa-f]{12}(?:/[0-9A-Za-z_-]{20,})?(?![0-9A-Za-z_-])
# 0.7.9: a Storyblok personal access token (sb_pat_ and 43 characters), a format newer than every vendored catalog
# (trufflehog knows only the older Storyblok token, and only after the word storyblok). Field report, 2026-10-22
storyblok-personal-access-token sb_pat_(?:(?<![A-Za-z0-9_]sb_pat_)|(?<=\\[nrt]sb_pat_))[0-9A-Za-z_]{40,64}(?![0-9A-Za-z_-])
# 0.7.9: 97 token formats with a fixed prefix that the catalogs know and maisecrets missed without a label
# (kingfisher, noseyparker, gitleaks, betterleaks, GitLab; measured 2026-10-22 with scripts/measure_catalog_coverage.py).
# Each regex is the catalog's own secret pattern after its prefix, with the boundaries of this file, and finds
# every example of its catalog rule whole. Left out: short generic prefixes (sk_, key_, pk_), public ids and
# publishable keys, and connection strings. An id that a vendored rule already has ends in -bare
1password-recovery-key                      1PRK(?:(?<![A-Za-z0-9_-]1PRK)|(?<=\\[nrt]1PRK))(?:\-[A-Z0-9]{4}){13}(?![A-Za-z0-9_-])
age-identity-mlkem768-x25519-secret-key     AGE\-SECRET\-KEY\-PQ\-1(?:(?<![A-Za-z0-9_-]AGE\-SECRET\-KEY\-PQ\-1)|(?<=\\[nrt]AGE\-SECRET\-KEY\-PQ\-1))[0-9A-Z]{58}(?![A-Za-z0-9_-])
ai71-api-key                                ai71\-api\-(?:(?<![A-Za-z0-9_-]ai71\-api\-)|(?<=\\[nrt]ai71\-api\-))[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}(?![A-Za-z0-9_-])
akamai-api-client-token                     akab\-(?:(?<![A-Za-z0-9_-]akab\-)|(?<=\\[nrt]akab\-))[A-Za-z0-9_\-]{18,28}(?![A-Za-z0-9_-])
alibaba-sts-access-key-id                   STS\.(?:(?<![A-Za-z0-9_-]STS\.)|(?<=\\[nrt]STS\.))[A-Za-z0-9]{16,64}(?![A-Za-z0-9_-])
alibaba-sts-security-token                  CAIS(?:(?<![A-Za-z0-9_-]CAIS)|(?<=\\[nrt]CAIS))[A-Za-z0-9+/_=\-]{20,1024}(?![A-Za-z0-9_-])
arcjet-api-key                              ajkey_(?:(?<![A-Za-z0-9_-]ajkey_)|(?<=\\[nrt]ajkey_))[a-z0-9]{26}(?![A-Za-z0-9_-])
astral-pyx-user-key-v1                      sk\-pyx\-(?:(?<![A-Za-z0-9_-]sk\-pyx\-)|(?<=\\[nrt]sk\-pyx\-))[A-Za-z0-9]{64}(?![A-Za-z0-9_-])
astral-pyx-user-key-v2                      sk\-pyx\-2(?:(?<![A-Za-z0-9_-]sk\-pyx\-2)|(?<=\\[nrt]sk\-pyx\-2))[A-Za-z]{45}(?![A-Za-z0-9_-])
atlassian-connect-shared-secret             ATCO(?:(?<![A-Za-z0-9_-]ATCO)|(?<=\\[nrt]ATCO))[A-Za-z0-9_+/=\-]{20,396}(?![A-Za-z0-9_-])
axiom-api-token                             xaat\-(?:(?<![A-Za-z0-9_-]xaat\-)|(?<=\\[nrt]xaat\-))[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}(?![A-Za-z0-9_-])
axiom-personal-access-token                 xapt\-(?:(?<![A-Za-z0-9_-]xapt\-)|(?<=\\[nrt]xapt\-))[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}(?![A-Za-z0-9_-])
bitbucket-app-password                      ATBB(?:(?<![A-Za-z0-9_-]ATBB)|(?<=\\[nrt]ATBB))[a-zA-Z0-9]{32}(?![A-Za-z0-9_-])
block-protocol-api-key                      b10ck5\.(?:(?<![A-Za-z0-9_-]b10ck5\.)|(?<=\\[nrt]b10ck5\.))[a-zA-Z0-9]{32}\.[a-zA-Z0-9]{36}(?![A-Za-z0-9_-])
branch-io-live-key                          key_live_(?:(?<![A-Za-z0-9_-]key_live_)|(?<=\\[nrt]key_live_))[a-zA-Z0-9]{16,40}(?![A-Za-z0-9_-])
branch-io-test-key                          key_test_(?:(?<![A-Za-z0-9_-]key_test_)|(?<=\\[nrt]key_test_))[a-zA-Z0-9]{16,40}(?![A-Za-z0-9_-])
builder-io-private-api-key                  bpk\-(?:(?<![A-Za-z0-9_-]bpk\-)|(?<=\\[nrt]bpk\-))[a-f0-9]{32}(?![A-Za-z0-9_-])
buildkite-agent-registration-token          bkar_(?:(?<![A-Za-z0-9_-]bkar_)|(?<=\\[nrt]bkar_))[A-Za-z0-9_\-]{32,128}(?![A-Za-z0-9_-])
buildkite-cluster-agent-token               bkct_(?:(?<![A-Za-z0-9_-]bkct_)|(?<=\\[nrt]bkct_))[A-Za-z0-9_\-]{32,128}(?![A-Za-z0-9_-])
cfx-re-fivem-server-key                     cfxk_(?:(?<![A-Za-z0-9_-]cfxk_)|(?<=\\[nrt]cfxk_))[a-zA-Z0-9_\-]{20,100}(?![A-Za-z0-9_-])
checkout-com-sandbox-secret-key             sk_test_(?:(?<![A-Za-z0-9_-]sk_test_)|(?<=\\[nrt]sk_test_))[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}(?![A-Za-z0-9_-])
circleci-api-project-token-prefixed         CCIPRJ_(?:(?<![A-Za-z0-9_-]CCIPRJ_)|(?<=\\[nrt]CCIPRJ_))[A-Za-z0-9]{22}_[0-9a-f]{40}(?![A-Za-z0-9_-])
confluent-api-secret-updated-format         cflt(?:(?<![A-Za-z0-9_-]cflt)|(?<=\\[nrt]cflt))(?:[A-Za-z0-9+/]{54})(?:[A-Za-z0-9+/]{6})(?![A-Za-z0-9_-])
databricks-oauth-client-secret              dose(?:(?<![A-Za-z0-9_-]dose)|(?<=\\[nrt]dose))[A-Za-z0-9_.\-]{32}(?![A-Za-z0-9_-])
defined-networking-api-token-bare           dnkey\-(?:(?<![A-Za-z0-9_-]dnkey\-)|(?<=\\[nrt]dnkey\-))[A-Z0-9]{26}\-[A-Z0-9]{52}(?![A-Za-z0-9_-])
deno-organization-token                     ddo_(?:(?<![A-Za-z0-9_-]ddo_)|(?<=\\[nrt]ddo_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
discord-mfa-token                           mfa\.(?:(?<![A-Za-z0-9_-]mfa\.)|(?<=\\[nrt]mfa\.))[A-Za-z0-9_\-]{20,100}(?![A-Za-z0-9_-])
dryrun-security-api-key                     dryrunsec_(?:(?<![A-Za-z0-9_-]dryrunsec_)|(?<=\\[nrt]dryrunsec_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
dub-co-api-key                              dub_(?:(?<![A-Za-z0-9_-]dub_)|(?<=\\[nrt]dub_))[A-Za-z0-9]{24}(?![A-Za-z0-9_-])
e2b-api-key                                 e2b_(?:(?<![A-Za-z0-9_-]e2b_)|(?<=\\[nrt]e2b_))[a-f0-9]{40}(?![A-Za-z0-9_-])
endor-labs-api-key                          endr\+(?:(?<![A-Za-z0-9_-]endr\+)|(?<=\\[nrt]endr\+))[A-Za-z0-9\-]{16}(?![A-Za-z0-9_-])
fleetbase-api-key                           flb_(?:(?<![A-Za-z0-9_-]flb_)|(?<=\\[nrt]flb_))(?:live|test)_[0-9a-zA-Z]{20,64}(?![A-Za-z0-9_-])
flutterwave-encrypted-key                   FLWSECK_TEST(?:(?<![A-Za-z0-9_-]FLWSECK_TEST)|(?<=\\[nrt]FLWSECK_TEST))[a-h0-9]{12}(?![A-Za-z0-9_-])
friendli-ai-api-key                         flp_(?:(?<![A-Za-z0-9_-]flp_)|(?<=\\[nrt]flp_))[A-Za-z0-9]{46}(?![A-Za-z0-9_-])
gitlab-oauth-application-secret             gloas\-(?:(?<![A-Za-z0-9_-]gloas\-)|(?<=\\[nrt]gloas\-))[0-9a-zA-Z_\-]{64}(?![A-Za-z0-9_-])
guardsquare-appsweep-api-key                gs_appsweep_(?:(?<![A-Za-z0-9_-]gs_appsweep_)|(?<=\\[nrt]gs_appsweep_))[a-zA-Z0-9_\-]{24,48}(?![A-Za-z0-9_-])
hack-club-ai-api-key                        sk\-hc\-v1\-(?:(?<![A-Za-z0-9_-]sk\-hc\-v1\-)|(?<=\\[nrt]sk\-hc\-v1\-))[a-f0-9]{64}(?![A-Za-z0-9_-])
hashicorp-vault-recovery-token-v1-10        hvr\.(?:(?<![A-Za-z0-9_-]hvr\.)|(?<=\\[nrt]hvr\.))[A-Za-z0-9]{24,130}(?![A-Za-z0-9_-])
hashicorp-vault-service-token-v1-10         hvs\.(?:(?<![A-Za-z0-9_-]hvs\.)|(?<=\\[nrt]hvs\.))[A-Za-z0-9]{24,130}(?![A-Za-z0-9_-])
heartland-portico-api-key                   skapi_cert_(?:(?<![A-Za-z0-9_-]skapi_cert_)|(?<=\\[nrt]skapi_cert_))[A-Za-z0-9]{34,42}(?![A-Za-z0-9_-])
hop-personal-access-token                   hop_pat_(?:(?<![A-Za-z0-9_-]hop_pat_)|(?<=\\[nrt]hop_pat_))[a-zA-Z0-9_\-]{20,50}(?![A-Za-z0-9_-])
hop-project-token                           ptk_(?:(?<![A-Za-z0-9_-]ptk_)|(?<=\\[nrt]ptk_))[a-zA-Z0-9_\-]{40,80}(?![A-Za-z0-9_-])
inngest-signing-key                         signkey\-(?:(?<![A-Za-z0-9_-]signkey\-)|(?<=\\[nrt]signkey\-))[a-z0-9_\-]+\-[a-f0-9]{64}(?![A-Za-z0-9_-])
instagram-graph-api-access-token            IGQVJ(?:(?<![A-Za-z0-9_-]IGQVJ)|(?<=\\[nrt]IGQVJ))[A-Za-z0-9_\-]{50,256}(?![A-Za-z0-9_-])
iterative-dvc-studio-access-token           isat_(?:(?<![A-Za-z0-9_-]isat_)|(?<=\\[nrt]isat_))[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(?![A-Za-z0-9_-])
mappedin-api-key                            mik_(?:(?<![A-Za-z0-9_-]mik_)|(?<=\\[nrt]mik_))[a-zA-Z0-9]{25}(?![A-Za-z0-9_-])
mappedin-api-secret                         mis_(?:(?<![A-Za-z0-9_-]mis_)|(?<=\\[nrt]mis_))[a-zA-Z0-9]{51}(?![A-Za-z0-9_-])
mercado-pago-access-token                   APP_USR\-(?:(?<![A-Za-z0-9_-]APP_USR\-)|(?<=\\[nrt]APP_USR\-))[A-Za-z0-9]{6,20}(?:\-[A-Za-z0-9]{4,64}){2,4}(?![A-Za-z0-9_-])
mercury-non-production-api-token            mercury_sandbox_(?:(?<![A-Za-z0-9_-]mercury_sandbox_)|(?<=\\[nrt]mercury_sandbox_))[a-z]{3,6}_[a-zA-Z0-9]{40,50}_yrucrem(?![A-Za-z0-9_-])
midtrans-production-server-client-key-bare  Mid\-(?:(?<![A-Za-z0-9_-]Mid\-)|(?<=\\[nrt]Mid\-))(?:server|client)\-[A-Za-z0-9_]{10,20}(?![A-Za-z0-9_-])
midtrans-sandbox-server-client-key          SB\-Mid\-(?:(?<![A-Za-z0-9_-]SB\-Mid\-)|(?<=\\[nrt]SB\-Mid\-))(?:server|client)\-[A-Za-z0-9_]{10,20}(?![A-Za-z0-9_-])
minimax-api-key-bare                        MINIMAX\-(?:(?<![A-Za-z0-9_-]MINIMAX\-)|(?<=\\[nrt]MINIMAX\-))[A-Z0-9]{8}\-[A-Z0-9]{8}\-[A-Z0-9]{8}\-[A-Z0-9]{8}(?![A-Za-z0-9_-])
mintlify-api-key                            mint_(?:(?<![A-Za-z0-9_-]mint_)|(?<=\\[nrt]mint_))(?:dsc_)?[A-Za-z0-9]{24,44}(?![A-Za-z0-9_-])
new-relic-browser-api-token-bare            NRJS\-(?:(?<![A-Za-z0-9_-]NRJS\-)|(?<=\\[nrt]NRJS\-))[0-9A-Fa-f]{19}(?![A-Za-z0-9_-])
new-relic-pixie-deploy-key                  px\-dep\-(?:(?<![A-Za-z0-9_-]px\-dep\-)|(?<=\\[nrt]px\-dep\-))[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}(?![A-Za-z0-9_-])
openai-api-key-short-prefixed               sk\-None\-(?:(?<![A-Za-z0-9_-]sk\-None\-)|(?<=\\[nrt]sk\-None\-))[A-Za-z0-9]{48}(?![A-Za-z0-9_-])
openvsx-access-token                        ovsx(?:(?<![A-Za-z0-9_-]ovsx)|(?<=\\[nrt]ovsx))(?:at|p)_[a-f0-9]{8}(?:\-[a-f0-9]{4}){3}\-[a-f0-9]{12}(?![A-Za-z0-9_-])
ory-api-key                                 ory_(?:(?<![A-Za-z0-9_-]ory_)|(?<=\\[nrt]ory_))(?:pat|apikey|wak)_[A-Za-z0-9_\-]{24,48}(?![A-Za-z0-9_-])
ory-session-token                           ory_st_(?:(?<![A-Za-z0-9_-]ory_st_)|(?<=\\[nrt]ory_st_))[A-Za-z0-9_\-]{24,48}(?![A-Za-z0-9_-])
packagist-api-key                           packagist_ack_(?:(?<![A-Za-z0-9_-]packagist_ack_)|(?<=\\[nrt]packagist_ack_))[0-9A-Fa-f]{28,32}(?![A-Za-z0-9_-])
packagist-api-secret                        packagist_acs_(?:(?<![A-Za-z0-9_-]packagist_acs_)|(?<=\\[nrt]packagist_acs_))[0-9A-Fa-f]{64,96}(?![A-Za-z0-9_-])
packagist-conductor-update-token            packagist_cut_(?:(?<![A-Za-z0-9_-]packagist_cut_)|(?<=\\[nrt]packagist_cut_))[0-9A-Fa-f]{68}(?![A-Za-z0-9_-])
packagist-organization-read-token           packagist_ort_(?:(?<![A-Za-z0-9_-]packagist_ort_)|(?<=\\[nrt]packagist_ort_))[0-9A-Fa-f]{68}(?![A-Za-z0-9_-])
packagist-organization-update-token         packagist_out_(?:(?<![A-Za-z0-9_-]packagist_out_)|(?<=\\[nrt]packagist_out_))[0-9A-Fa-f]{68}(?![A-Za-z0-9_-])
packagist-user-update-token                 packagist_uut_(?:(?<![A-Za-z0-9_-]packagist_uut_)|(?<=\\[nrt]packagist_uut_))[0-9A-Fa-f]{68}(?![A-Za-z0-9_-])
pangea-service-token                        pts_(?:(?<![A-Za-z0-9_-]pts_)|(?<=\\[nrt]pts_))[a-z0-9]{30,36}(?![A-Za-z0-9_-])
permit-io-api-key                           permit_key_(?:(?<![A-Za-z0-9_-]permit_key_)|(?<=\\[nrt]permit_key_))[0-9A-Za-z]{85,86}(?![A-Za-z0-9_-])
pinterest-refresh-token                     pinr_(?:(?<![A-Za-z0-9_-]pinr_)|(?<=\\[nrt]pinr_))[a-zA-Z0-9._\-]{19,299}[a-zA-Z0-9_\-](?![A-Za-z0-9_-])
plaid-access-token-production               access\-production\-(?:(?<![A-Za-z0-9_-]access\-production\-)|(?<=\\[nrt]access\-production\-))[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}(?![A-Za-z0-9_-])
plaid-access-token-sandbox                  access\-sandbox\-(?:(?<![A-Za-z0-9_-]access\-sandbox\-)|(?<=\\[nrt]access\-sandbox\-))[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}(?![A-Za-z0-9_-])
portainer-api-token                         ptr_(?:(?<![A-Za-z0-9_-]ptr_)|(?<=\\[nrt]ptr_))[A-Za-z0-9/+_=\-]{32,52}(?![A-Za-z0-9_-])
posthog-feature-flags-secure-api-key        phs_(?:(?<![A-Za-z0-9_-]phs_)|(?<=\\[nrt]phs_))[A-Za-z0-9]{44,48}(?![A-Za-z0-9_-])
posthog-oauth-access-token                  pha_(?:(?<![A-Za-z0-9_-]pha_)|(?<=\\[nrt]pha_))[A-Za-z0-9]{40,43}(?![A-Za-z0-9_-])
posthog-oauth-refresh-token                 phr_(?:(?<![A-Za-z0-9_-]phr_)|(?<=\\[nrt]phr_))[A-Za-z0-9]{40,43}(?![A-Za-z0-9_-])
ramp-application-signup-token               ramp_business_tok_(?:(?<![A-Za-z0-9_-]ramp_business_tok_)|(?<=\\[nrt]ramp_business_tok_))[a-zA-Z0-9]{42}(?![A-Za-z0-9_-])
riot-games-api-key                          RGAPI\-(?:(?<![A-Za-z0-9_-]RGAPI\-)|(?<=\\[nrt]RGAPI\-))[a-zA-Z0-9_\-]{36}(?![A-Za-z0-9_-])
robinhood-crypto-api-key                    rh\-api\-(?:(?<![A-Za-z0-9_-]rh\-api\-)|(?<=\\[nrt]rh\-api\-))[0-9A-Fa-f]{8}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{4}\-[0-9A-Fa-f]{12}(?![A-Za-z0-9_-])
saladcloud-user-api-key                     salad_cloud_user_(?:(?<![A-Za-z0-9_-]salad_cloud_user_)|(?<=\\[nrt]salad_cloud_user_))[0-9A-Za-z]{49}(?![A-Za-z0-9_-])
scale-callback-auth-key                     live_auth_(?:(?<![A-Za-z0-9_-]live_auth_)|(?<=\\[nrt]live_auth_))[0-9a-f]{32}(?![A-Za-z0-9_-])
seam-api-key                                seam_(?:(?<![A-Za-z0-9_-]seam_)|(?<=\\[nrt]seam_))(?:test2|live)[a-zA-Z0-9]{1,8}_[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]{20,32}(?![A-Za-z0-9_-])
shortcut-api-token                          sct_(?:(?<![A-Za-z0-9_-]sct_)|(?<=\\[nrt]sct_))(?:r(?:s|wa)?|w)_[a-z0-9]+(?:\-[a-z0-9]+)*_[A-Za-z0-9_\-]{142}(?![A-Za-z0-9_-])
slack-app-token-bare                        xapp\-(?:(?<![A-Za-z0-9_-]xapp\-)|(?<=\\[nrt]xapp\-))[0-9]{12}\-[a-zA-Z0-9/+]{24}(?![A-Za-z0-9_-])
testkube-api-key                            tkcapi_(?:(?<![A-Za-z0-9_-]tkcapi_)|(?<=\\[nrt]tkcapi_))[A-Za-z0-9]{30,64}(?![A-Za-z0-9_-])
tigris-access-key-id                        tid_(?:(?<![A-Za-z0-9_-]tid_)|(?<=\\[nrt]tid_))[A-Za-z0-9_]{50}(?![A-Za-z0-9_-])
tigris-secret-access-key                    tsec_(?:(?<![A-Za-z0-9_-]tsec_)|(?<=\\[nrt]tsec_))[A-Za-z0-9_+\-]{70}(?![A-Za-z0-9_-])
tinybird-static-token                       p\.eyJ1I(?:(?<![A-Za-z0-9_-]p\.eyJ1I)|(?<=\\[nrt]p\.eyJ1I))[A-Za-z0-9_\-]{80,260}\.[A-Za-z0-9_\-]{43}(?![A-Za-z0-9_-])
tolgee-personal-access-token                tgpat_(?:(?<![A-Za-z0-9_-]tgpat_)|(?<=\\[nrt]tgpat_))[a-z0-9]{48,64}(?![A-Za-z0-9_-])
tolgee-project-api-key                      tgpak_(?:(?<![A-Za-z0-9_-]tgpak_)|(?<=\\[nrt]tgpak_))[a-z0-9]{45,64}(?![A-Za-z0-9_-])
trend-micro-cloud-one-api-key               tmc1(?:(?<![A-Za-z0-9_-]tmc1)|(?<=\\[nrt]tmc1))[A-Za-z0-9]{26,32}:[A-Za-z0-9]{60,70}(?![A-Za-z0-9_-])
trigger-dev-personal-access-token           tr_pat_(?:(?<![A-Za-z0-9_-]tr_pat_)|(?<=\\[nrt]tr_pat_))[A-Za-z0-9]{20}(?![A-Za-z0-9_-])
ubidots-api-key                             BBUS\-(?:(?<![A-Za-z0-9_-]BBUS\-)|(?<=\\[nrt]BBUS\-))[A-Za-z0-9]{28,40}(?![A-Za-z0-9_-])
vkontakte-access-token                      vk1\.a\.(?:(?<![A-Za-z0-9_-]vk1\.a\.)|(?<=\\[nrt]vk1\.a\.))[A-Za-z0-9_\-]{100,200}(?![A-Za-z0-9_-])
voiceflow-api-key                           VF\.DM\.(?:(?<![A-Za-z0-9_-]VF\.DM\.)|(?<=\\[nrt]VF\.DM\.))[0-9A-Fa-f]{24}\.[A-Za-z0-9]{16}(?![A-Za-z0-9_-])
warpstream-api-key-secret                   aks_(?:(?<![A-Za-z0-9_-]aks_)|(?<=\\[nrt]aks_))[a-f0-9]{64}(?![A-Za-z0-9_-])
workato-api-token                           wrka(?:(?<![A-Za-z0-9_-]wrka)|(?<=\\[nrt]wrka))(?:[a-z]{2})?\-eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{64,}(?![A-Za-z0-9_-])
workos-api-key                              sk_live_a2V5Xz(?:(?<![A-Za-z0-9_-]sk_live_a2V5Xz)|(?<=\\[nrt]sk_live_a2V5Xz))[A-Za-z0-9+/]{69}={0,2}(?![A-Za-z0-9_-])
xata-api-key                                xau_(?:(?<![A-Za-z0-9_-]xau_)|(?<=\\[nrt]xau_))[A-Za-z0-9]{30,40}(?![A-Za-z0-9_-])
# 0.7.9, researched: token formats of the providers that GitHub secret scanning names, from each provider's
# documentation (Sentry, Polar, Sourcegraph, Yandex Cloud, Vercel, Cloudflare, Buildkite, Datadog, ...) or, where
# the provider documents none, from a public scanner. Each rule finds a token generated from the researched
# pattern; public ids, connection strings and prefixes of fewer than four characters stay out
1password-service-account-token-bare                       ops_eyJ(?:(?<![A-Za-z0-9_-]ops_eyJ)|(?<=\\[nrt]ops_eyJ))[A-Za-z0-9+/_\-]{250,}={0,3}(?![A-Za-z0-9_-])
asaas-production-key                                       \$aact_prod_(?:(?<![A-Za-z0-9_-]\$aact_prod_)|(?<=\\[nrt]\$aact_prod_))[A-Za-z0-9_\-+/=:$]{19,199}[A-Za-z0-9_\-+/=$](?![A-Za-z0-9_-])
asaas-sandbox-key                                          \$aact_hmlg_(?:(?<![A-Za-z0-9_-]\$aact_hmlg_)|(?<=\\[nrt]\$aact_hmlg_))[A-Za-z0-9_\-+/=:$]{19,199}[A-Za-z0-9_\-+/=$](?![A-Za-z0-9_-])
atlassian-org-admin-scoped-api-key-sibling                 ATCTT3xFfG(?:(?<![A-Za-z0-9_-]ATCTT3xFfG)|(?<=\\[nrt]ATCTT3xFfG))[A-Za-z0-9+/=_\-]{1,1024}=[A-Za-z0-9]{8}(?![A-Za-z0-9_-])
aws-bedrock-short-term-api-key                             bedrock\-api\-key\-(?:(?<![A-Za-z0-9_-]bedrock\-api\-key\-)|(?<=\\[nrt]bedrock\-api\-key\-))[A-Za-z0-9+/]+={0,2}(?![A-Za-z0-9_-])
baidu-qianfan-api-key-bce-v3                               bce\-v3\/ALTAK\-(?:(?<![A-Za-z0-9_-]bce\-v3\/ALTAK\-)|(?<=\\[nrt]bce\-v3\/ALTAK\-))[A-Za-z0-9]{10,}\/[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])
bitbucket-data-center-http-access-token                    BBDC\-(?:(?<![A-Za-z0-9_-]BBDC\-)|(?<=\\[nrt]BBDC\-))[A-Za-z0-9+/@_\-]{40,50}(?![A-Za-z0-9_-])
brevo-smtp-key-standard                                    xsmtpsib\-(?:(?<![A-Za-z0-9_-]xsmtpsib\-)|(?<=\\[nrt]xsmtpsib\-))[a-f0-9]{64}\-[A-Za-z0-9]{16}(?![A-Za-z0-9_-])
buildkite-portal-token-long-lived-ephemeral-user-invoked   bkpat_(?:(?<![A-Za-z0-9_-]bkpat_)|(?<=\\[nrt]bkpat_))[A-Za-z0-9_\-]{54}(?![A-Za-z0-9_-])
canadian-digital-service-gc-notify-api-key                 gcntfy\-(?:(?<![A-Za-z0-9_-]gcntfy\-)|(?<=\\[nrt]gcntfy\-))[a-z0-9_]+\-[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}\-[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
cashfree-secret-key-production                             cfsk_ma_prod_(?:(?<![A-Za-z0-9_-]cfsk_ma_prod_)|(?<=\\[nrt]cfsk_ma_prod_))[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])
cashfree-secret-key-sandbox                                cfsk_ma_test_(?:(?<![A-Za-z0-9_-]cfsk_ma_test_)|(?<=\\[nrt]cfsk_ma_test_))[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])
checkout-com-sandbox-secret-key-current                    sk_sbox_(?:(?<![A-Za-z0-9_-]sk_sbox_)|(?<=\\[nrt]sk_sbox_))[a-z0-9]{27}(?![A-Za-z0-9_-])
cloudflare-access-service-token-client-secret-sibling      cfast_(?:(?<![A-Za-z0-9_-]cfast_)|(?<=\\[nrt]cfast_))[A-Za-z0-9]{40}[A-Za-z0-9]{8}(?![A-Za-z0-9_-])
coveo-api-key-rotation-secret-sibling                      coveo_apikey_rotation_v1_(?:(?<![A-Za-z0-9_-]coveo_apikey_rotation_v1_)|(?<=\\[nrt]coveo_apikey_rotation_v1_))[A-Za-z0-9]{10}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{4}\-[A-Za-z0-9]{12}_[A-Za-z0-9]{8}(?![A-Za-z0-9_-])
databricks-dkea-token                                      dkea(?:(?<![A-Za-z0-9_-]dkea)|(?<=\\[nrt]dkea))[a-f0-9]{32}(?![A-Za-z0-9_-])
databricks-dosa-token                                      dosa(?:(?<![A-Za-z0-9_-]dosa)|(?<=\\[nrt]dosa))[a-f0-9]{32}(?![A-Za-z0-9_-])
datadog-personal-access-token                              ddpat_(?:(?<![A-Za-z0-9_-]ddpat_)|(?<=\\[nrt]ddpat_))[A-Za-z0-9]{16,24}_[A-Za-z0-9]{40,56}(?![A-Za-z0-9_-])
datadog-service-access-token                               ddsat_(?:(?<![A-Za-z0-9_-]ddsat_)|(?<=\\[nrt]ddsat_))[A-Za-z0-9]{20,24}_[A-Za-z0-9]{40,52}(?![A-Za-z0-9_-])
datastax-astra-application-token-bare                      AstraCS:(?:(?<![A-Za-z0-9_-]AstraCS:)|(?<=\\[nrt]AstraCS:))[A-Za-z0-9]{24}:[a-f0-9]{64}(?![A-Za-z0-9_-])
ebay-production-cert-id                                    PRD\-(?:(?<![A-Za-z0-9_-]PRD\-)|(?<=\\[nrt]PRD\-))[a-f0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4,12}(?![A-Za-z0-9_-])
firebase-fcm-legacy-server-key                             AAAA(?:(?<![A-Za-z0-9_-]AAAA)|(?<=\\[nrt]AAAA))[A-Za-z0-9_\-]{7}:[A-Za-z0-9_\-]{140}(?![A-Za-z0-9_-])
fullstory-api-key-eu1-data-center                          eu1\.(?:(?<![A-Za-z0-9_-]eu1\.)|(?<=\\[nrt]eu1\.))[A-Za-z0-9+/]{100}={0,2}(?![A-Za-z0-9_-])
fullstory-api-key-na1-data-center                          na1\.(?:(?<![A-Za-z0-9_-]na1\.)|(?<=\\[nrt]na1\.))[A-Za-z0-9+/]{100}={0,2}(?![A-Za-z0-9_-])
gocardless-live-access-token                               live_(?:(?<![A-Za-z0-9_-]live_)|(?<=\\[nrt]live_))[A-Za-z0-9_=\-]{40}(?![A-Za-z0-9_-])
google-oauth-access-token-bare                             ya29\.(?:(?<![A-Za-z0-9_-]ya29\.)|(?<=\\[nrt]ya29\.))[0-9A-Za-z_\-]{20,1024}(?![A-Za-z0-9_-])
grafana-cloud-access-policy-token                          glc_(?:(?<![A-Za-z0-9_-]glc_)|(?<=\\[nrt]glc_))[A-Za-z0-9+/]{32,400}={0,3}(?![A-Za-z0-9_-])
guardsquare-appsweep-api-key-bare                          gs_appsweep_(?:(?<![A-Za-z0-9_-]gs_appsweep_)|(?<=\\[nrt]gs_appsweep_))[A-Za-z0-9_\-]{16,}(?![A-Za-z0-9_-])
hashicorp-vault-batch-token-1-10                           hvb\.(?:(?<![A-Za-z0-9_-]hvb\.)|(?<=\\[nrt]hvb\.))[A-Za-z0-9_\-]{24,300}(?![A-Za-z0-9_-])
hashicorp-vault-root-token-service-token-with-root-policy  hvs\.(?:(?<![A-Za-z0-9_-]hvs\.)|(?<=\\[nrt]hvs\.))[A-Za-z0-9_\-]{24,}(?![A-Za-z0-9_-])
highnote-secret-key-test                                   sk_test_a2V5Xz(?:(?<![A-Za-z0-9_-]sk_test_a2V5Xz)|(?<=\\[nrt]sk_test_a2V5Xz))[A-Za-z0-9+/]{69}={0,2}(?![A-Za-z0-9_-])
hop-personal-access-token-bare                             pat_(?:(?<![A-Za-z0-9_-]pat_)|(?<=\\[nrt]pat_))[A-Za-z0-9]{16,64}(?![A-Za-z0-9_-])
hop-project-token-bare                                     ptk_(?:(?<![A-Za-z0-9_-]ptk_)|(?<=\\[nrt]ptk_))[A-Za-z0-9]{16,64}(?![A-Za-z0-9_-])
hop-user-bearer-token                                      bearer_(?:(?<![A-Za-z0-9_-]bearer_)|(?<=\\[nrt]bearer_))[A-Za-z0-9]{16,64}(?![A-Za-z0-9_-])
intercom-access-token-bare                                 dG9rOj(?:(?<![A-Za-z0-9_-]dG9rOj)|(?<=\\[nrt]dG9rOj))[A-Za-z0-9+/]{53}=(?![A-Za-z0-9_-])
iterative-dvc-studio-client-access-token                   isat_(?:(?<![A-Za-z0-9_-]isat_)|(?<=\\[nrt]isat_))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
jfrog-jwt-access-token                                     eyJ2ZXIiOiIyIiwidHlwIjoiSldUIi(?:(?<![A-Za-z0-9_-]eyJ2ZXIiOiIyIiwidHlwIjoiSldUIi)|(?<=\\[nrt]eyJ2ZXIiOiIyIiwidHlwIjoiSldUIi))[A-Za-z0-9_\-]*\.[A-Za-z0-9_\-]+\.[A-Za-z0-9_\-]+(?![A-Za-z0-9_-])
launchdarkly-api-access-token                              api\-(?:(?<![A-Za-z0-9_-]api\-)|(?<=\\[nrt]api\-))[a-z0-9]{8}\-[a-z0-9]{4}\-4[a-z0-9]{3}\-[a-z0-9]{4}\-[a-z0-9]{12}(?![A-Za-z0-9_-])
launchdarkly-server-sdk-key                                sdk\-(?:(?<![A-Za-z0-9_-]sdk\-)|(?<=\\[nrt]sdk\-))[a-z0-9]{8}\-[a-z0-9]{4}\-4[a-z0-9]{3}\-[a-z0-9]{4}\-[a-z0-9]{12}(?![A-Za-z0-9_-])
lichess-oauth-access-token                                 lio_(?:(?<![A-Za-z0-9_-]lio_)|(?<=\\[nrt]lio_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
linear-oauth-access-token                                  lin_oauth_(?:(?<![A-Za-z0-9_-]lin_oauth_)|(?<=\\[nrt]lin_oauth_))[A-Za-z0-9]{32,64}(?![A-Za-z0-9_-])
linkedin-client-secret-current                             WPL_AP1\.(?:(?<![A-Za-z0-9_-]WPL_AP1\.)|(?<=\\[nrt]WPL_AP1\.))[A-Za-z0-9]{16}\.[A-Za-z0-9+/]{6}==(?![A-Za-z0-9_-])
lob-live-secret-api-key                                    live_(?:(?<![A-Za-z0-9_-]live_)|(?<=\\[nrt]live_))[a-f0-9]{35}(?![A-Za-z0-9_-])
lob-test-secret-api-key                                    test_(?:(?<![A-Za-z0-9_-]test_)|(?<=\\[nrt]test_))[a-f0-9]{35}(?![A-Za-z0-9_-])
logicmonitor-bearer-token                                  lmb_(?:(?<![A-Za-z0-9_-]lmb_)|(?<=\\[nrt]lmb_))[A-Za-z0-9+/=_\-]{20,}(?![A-Za-z0-9_-])
lovable-labs-workspace-api-key                             lov_(?:(?<![A-Za-z0-9_-]lov_)|(?<=\\[nrt]lov_))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
mailgun-private-api-key-legacy-key-format                  key\-(?:(?<![A-Za-z0-9_-]key\-)|(?<=\\[nrt]key\-))[0-9a-f]{32}(?![A-Za-z0-9_-])
mapbox-temporary-token                                     tk\.eyJ1Ijoi(?:(?<![A-Za-z0-9_-]tk\.eyJ1Ijoi)|(?<=\\[nrt]tk\.eyJ1Ijoi))[A-Za-z0-9_\-]{20,400}\.[A-Za-z0-9_\-]{22}(?![A-Za-z0-9_-])
notion-legacy-internal-integration-token                   secret_(?:(?<![A-Za-z0-9_-]secret_)|(?<=\\[nrt]secret_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
octopus-deploy-api-key-bare                                API\-(?:(?<![A-Za-z0-9_-]API\-)|(?<=\\[nrt]API\-))[A-Z0-9]{26,34}(?![A-Za-z0-9_-])
onfido-sandbox-all-regions                                 api_sandbox(?:(?<![A-Za-z0-9_-]api_sandbox)|(?<=\\[nrt]api_sandbox))(?:_(?:us|ca))?\.[A-Za-z0-9_\-]{20,80}(?![A-Za-z0-9_-])
openvsx-personal-access-token-open-vsx-org                 ovsxat_(?:(?<![A-Za-z0-9_-]ovsxat_)|(?<=\\[nrt]ovsxat_))[A-Za-z0-9\-]{36,43}(?![A-Za-z0-9_-])
openvsx-publish-only-token-sibling                         ovsxap_(?:(?<![A-Za-z0-9_-]ovsxap_)|(?<=\\[nrt]ovsxap_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
paddle-sandbox                                             pdl_sdbx_apikey_(?:(?<![A-Za-z0-9_-]pdl_sdbx_apikey_)|(?<=\\[nrt]pdl_sdbx_apikey_))[a-z0-9]{26}_[A-Za-z0-9]{22}_[A-Za-z0-9]{3}(?![A-Za-z0-9_-])
pangea-service-access-token                                pts_(?:(?<![A-Za-z0-9_-]pts_)|(?<=\\[nrt]pts_))[a-z0-9]{20,64}(?![A-Za-z0-9_-])
persona-identities-sandbox                                 persona_sandbox_(?:(?<![A-Za-z0-9_-]persona_sandbox_)|(?<=\\[nrt]persona_sandbox_))[a-z0-9_\-]{20,80}(?![A-Za-z0-9_-])
pinterest-client-credentials-access-token                  pinc(?:(?<![A-Za-z0-9_-]pinc)|(?<=\\[nrt]pinc))[._][A-Za-z0-9_.\-]{19,199}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
polar-customer-session-token                               polar_cst_(?:(?<![A-Za-z0-9_-]polar_cst_)|(?<=\\[nrt]polar_cst_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-member-session-token-sibling                         polar_mst_(?:(?<![A-Za-z0-9_-]polar_mst_)|(?<=\\[nrt]polar_mst_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-oauth-authorization-code                             polar_ac_(?:(?<![A-Za-z0-9_-]polar_ac_)|(?<=\\[nrt]polar_ac_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-oauth-client-registration-token                      polar_crt_(?:(?<![A-Za-z0-9_-]polar_crt_)|(?<=\\[nrt]polar_crt_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-oauth-client-secret                                  polar_cs_(?:(?<![A-Za-z0-9_-]polar_cs_)|(?<=\\[nrt]polar_cs_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-oauth-refresh-token-user-org-subject                 polar_rt_(?:(?<![A-Za-z0-9_-]polar_rt_)|(?<=\\[nrt]polar_rt_))(?:[uo]_)?[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
polar-user-session-token                                   polar_us_(?:(?<![A-Za-z0-9_-]polar_us_)|(?<=\\[nrt]polar_us_))[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
posthog-oauth-refresh-token-bare                           phr_(?:(?<![A-Za-z0-9_-]phr_)|(?<=\\[nrt]phr_))[A-Za-z0-9_\-]{43,48}(?![A-Za-z0-9_-])
posthog-project-secret-api-key                             phs_(?:(?<![A-Za-z0-9_-]phs_)|(?<=\\[nrt]phs_))[A-Za-z0-9_\-]{43,50}(?![A-Za-z0-9_-])
pydantic-services-inc-write-api-token                      pylf_v(?:(?<![A-Za-z0-9_-]pylf_v)|(?<=\\[nrt]pylf_v))[0-9]+_[a-z]+_(?:[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}_)?[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])
pypi-test-pypi-org-upload-token-sibling                    pypi\-AgENdGVzdC5weXBpLm9yZ(?:(?<![A-Za-z0-9_-]pypi\-AgENdGVzdC5weXBpLm9yZ)|(?<=\\[nrt]pypi\-AgENdGVzdC5weXBpLm9yZ))[A-Za-z0-9_\-]{50,1000}(?![A-Za-z0-9_-])
rainforest-pay-production                                  apikey_(?:(?<![A-Za-z0-9_-]apikey_)|(?<=\\[nrt]apikey_))[a-f0-9]{64}(?![A-Za-z0-9_-])
rainforest-pay-sandbox                                     sbx_apikey_(?:(?<![A-Za-z0-9_-]sbx_apikey_)|(?<=\\[nrt]sbx_apikey_))[a-f0-9]{64}(?![A-Za-z0-9_-])
sentry-integration-token                                   sntryi_(?:(?<![A-Za-z0-9_-]sntryi_)|(?<=\\[nrt]sntryi_))[a-f0-9]{64}(?![A-Za-z0-9_-])
sentry-organization-auth-token                             sntrys_eyJpYXQiO(?:(?<![A-Za-z0-9_-]sntrys_eyJpYXQiO)|(?<=\\[nrt]sntrys_eyJpYXQiO))[A-Za-z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[A-Za-z0-9+/]{10,200}={0,2}_[A-Za-z0-9+/]{43}(?![A-Za-z0-9_-])
sentry-user-app-auth-token                                 sntrya_(?:(?<![A-Za-z0-9_-]sntrya_)|(?<=\\[nrt]sntrya_))[a-f0-9]{64}(?![A-Za-z0-9_-])
shopify-partner-api-client-access-token                    prtapi_(?:(?<![A-Za-z0-9_-]prtapi_)|(?<=\\[nrt]prtapi_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
slack-workflow-token                                       xwfp\-(?:(?<![A-Za-z0-9_-]xwfp\-)|(?<=\\[nrt]xwfp\-))[A-Za-z0-9\-]{20,}(?![A-Za-z0-9_-])
slack-workflow-trigger-url                                 https:\/\/hooks\.slack\.com\/triggers\/T(?:(?<![A-Za-z0-9_-]https:\/\/hooks\.slack\.com\/triggers\/T)|(?<=\\[nrt]https:\/\/hooks\.slack\.com\/triggers\/T))[A-Z0-9]+\/[0-9]+\/[a-f0-9]{32}(?![A-Za-z0-9_-])
slack-workflow-webhook-url-legacy-workflow-builder         https:\/\/hooks\.slack\.com\/workflows\/T(?:(?<![A-Za-z0-9_-]https:\/\/hooks\.slack\.com\/workflows\/T)|(?<=\\[nrt]https:\/\/hooks\.slack\.com\/workflows\/T))[A-Z0-9]+\/A[A-Z0-9]+\/[0-9]{17,19}\/[A-Za-z0-9]{23,25}(?![A-Za-z0-9_-])
sourcegraph-dotcom-user-gateway-access-token               sgd_(?:(?<![A-Za-z0-9_-]sgd_)|(?<=\\[nrt]sgd_))[a-fA-F0-9]{64}(?![A-Za-z0-9_-])
sourcegraph-license-key-token                              slk_(?:(?<![A-Za-z0-9_-]slk_)|(?<=\\[nrt]slk_))[a-fA-F0-9]{64}(?![A-Za-z0-9_-])
sourcegraph-product-enterprise-subscription-token          sgs_(?:(?<![A-Za-z0-9_-]sgs_)|(?<=\\[nrt]sgs_))[a-fA-F0-9]{64}(?![A-Za-z0-9_-])
square-access-token-current                                EAAA(?:(?<![A-Za-z0-9_-]EAAA)|(?<=\\[nrt]EAAA))[A-Za-z0-9_\-+=]{60}(?![A-Za-z0-9_-])
square-sandbox-application-secret                          sandbox\-sq0cs(?:(?<![A-Za-z0-9_-]sandbox\-sq0cs)|(?<=\\[nrt]sandbox\-sq0cs))[bp]\-[A-Za-z0-9_\-]{43}(?![A-Za-z0-9_-])
stripe-organization-api-key                                sk_org_(?:(?<![A-Za-z0-9_-]sk_org_)|(?<=\\[nrt]sk_org_))[A-Za-z0-9_]{24,247}(?![A-Za-z0-9_-])
tencent-cloud-secretid                                     AKID(?:(?<![A-Za-z0-9_-]AKID)|(?<=\\[nrt]AKID))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
typeform-personal-access-token                             tfp_(?:(?<![A-Za-z0-9_-]tfp_)|(?<=\\[nrt]tfp_))[A-Za-z0-9_\-=.]{59}(?![A-Za-z0-9_-])
wakatime-oauth-access-token                                waka_tok_(?:(?<![A-Za-z0-9_-]waka_tok_)|(?<=\\[nrt]waka_tok_))[A-Za-z0-9]{20,}(?![A-Za-z0-9_-])
wave-mobile-money-inc-production-api-key                   wave_(?:(?<![A-Za-z0-9_-]wave_)|(?<=\\[nrt]wave_))[a-z]{2}_prod_[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
yandex-cloud-api-key                                       AQVN(?:(?<![A-Za-z0-9_-]AQVN)|(?<=\\[nrt]AQVN))[A-Za-z0-9_\-]{35,38}(?![A-Za-z0-9_-])
yandex-refresh-token-sibling                               rt1\.(?:(?<![A-Za-z0-9_-]rt1\.)|(?<=\\[nrt]rt1\.))[A-Z0-9a-z_\-]+={0,2}\.[A-Z0-9a-z_\-]{86}={0,2}(?![A-Za-z0-9_-])
yandex-smartcaptcha-server-key                             ysc2_(?:(?<![A-Za-z0-9_-]ysc2_)|(?<=\\[nrt]ysc2_))[a-zA-Z0-9]{40}[0-9a-f]{8}(?![A-Za-z0-9_-])
yandex-translate-api-key-legacy-v1-5                       trnsl\.1\.1\.(?:(?<![A-Za-z0-9_-]trnsl\.1\.1\.)|(?<=\\[nrt]trnsl\.1\.1\.))[0-9]{8}T[0-9]{6}Z\.[a-f0-9]{16}\.[a-f0-9]{40}(?![A-Za-z0-9_-])
# 0.7.10, more sources: prefixed formats that Trivy (Apache-2.0), Google OSV-SCALIBR Veles (Apache-2.0),
# nuclei-templates (MIT) and titus (Apache-2.0) know and no rule above takes
amazon-mws-auth-token                      amzn\.mws\.(?:(?<![A-Za-z0-9_-]amzn\.mws\.)|(?<=\\[nrt]amzn\.mws\.))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
atlassian-api-token-bare                   ATATT3xFfGF0(?:(?<![A-Za-z0-9_-]ATATT3xFfGF0)|(?<=\\[nrt]ATATT3xFfGF0))[a-zA-Z0-9_\-]{20,200}=[0-9A-F]{8}(?![A-Za-z0-9_-])
facebook-graph-explorer-access-token       EAACEdEose0cBA(?:(?<![A-Za-z0-9_-]EAACEdEose0cBA)|(?<=\\[nrt]EAACEdEose0cBA))[a-zA-Z0-9]+(?![A-Za-z0-9_-])
new-relic-synthetics-private-location-key  NRSP\-(?:(?<![A-Za-z0-9_-]NRSP\-)|(?<=\\[nrt]NRSP\-))[a-z]{2}[0-9]{2}[a-f0-9]{31}(?![A-Za-z0-9_-])
notion-refresh-token                       nrt_(?:(?<![A-Za-z0-9_-]nrt_)|(?<=\\[nrt]nrt_))[A-Z0-9_]{40,55}(?![A-Za-z0-9_-])
openai-service-api-key-legacy              sk\-service\-(?:(?<![A-Za-z0-9_-]sk\-service\-)|(?<=\\[nrt]sk\-service\-))[A-Za-z0-9\-]+\-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}(?![A-Za-z0-9_-])
retool-workflow-api-key                    retool_wk_(?:(?<![A-Za-z0-9_-]retool_wk_)|(?<=\\[nrt]retool_wk_))[0-9a-f]{32}(?![A-Za-z0-9_-])
slack-app-configuration-access-token       xoxe\.xoxp\-(?:(?<![A-Za-z0-9_-]xoxe\.xoxp\-)|(?<=\\[nrt]xoxe\.xoxp\-))[\d]{1,10}\-[a-zA-Z0-9]{166}(?![A-Za-z0-9_-])
# 0.7.10, provider code: prefixed formats read from the providers' own published code (SDKs, servers,
# token libraries) and documentation that no rule above takes
akamai-edgegrid-client-token-access-token              akab\-(?:(?<![A-Za-z0-9_-]akab\-)|(?<=\\[nrt]akab\-))[a-z0-9]{16}\-[a-z0-9]{16}(?![A-Za-z0-9_-])(?!\.[A-Za-z0-9])
baseten-api-key-2026-format                            b10_(?:(?<![A-Za-z0-9_-]b10_)|(?<=\\[nrt]b10_))[A-Za-z0-9]{8}\.[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
browserbase-api-key                                    bb_live_(?:(?<![A-Za-z0-9_-]bb_live_)|(?<=\\[nrt]bb_live_))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
buildkite-agent-access-token                           bkaa_(?:(?<![A-Za-z0-9_-]bkaa_)|(?<=\\[nrt]bkaa_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-agent-job-acquisition-token-jwt              bkjat_(?:(?<![A-Za-z0-9_-]bkjat_)|(?<=\\[nrt]bkjat_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-agent-job-token                              bkaj_(?:(?<![A-Za-z0-9_-]bkaj_)|(?<=\\[nrt]bkaj_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-api-access-token                             bkua_(?:(?<![A-Za-z0-9_-]bkua_)|(?<=\\[nrt]bkua_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-cluster-queue-token                          bkcqt_(?:(?<![A-Za-z0-9_-]bkcqt_)|(?<=\\[nrt]bkcqt_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-oauth-refresh-token                          bkur_(?:(?<![A-Za-z0-9_-]bkur_)|(?<=\\[nrt]bkur_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-packages-registry-token                      bkrt_(?:(?<![A-Za-z0-9_-]bkrt_)|(?<=\\[nrt]bkrt_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-packages-temporary-token                     bkpt_(?:(?<![A-Za-z0-9_-]bkpt_)|(?<=\\[nrt]bkpt_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-pipeline-access-token                        bkat_(?:(?<![A-Za-z0-9_-]bkat_)|(?<=\\[nrt]bkat_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-pipeline-trigger-token                       bktr_(?:(?<![A-Za-z0-9_-]bktr_)|(?<=\\[nrt]bktr_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-portal-secret                                bkps_(?:(?<![A-Za-z0-9_-]bkps_)|(?<=\\[nrt]bkps_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-portal-token                                 bkpat_(?:(?<![A-Za-z0-9_-]bkpat_)|(?<=\\[nrt]bkpat_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
buildkite-token-exchange                               bktx_(?:(?<![A-Za-z0-9_-]bktx_)|(?<=\\[nrt]bktx_))[A-Za-z0-9_.\-]{37,2047}[A-Za-z0-9_\-](?![A-Za-z0-9_-])
cartesia-admin-api-key                                 sk_car_admin_(?:(?<![A-Za-z0-9_-]sk_car_admin_)|(?<=\\[nrt]sk_car_admin_))[A-Za-z0-9]{20,64}(?![A-Za-z0-9_-])
cartesia-api-key                                       sk_car_(?:(?<![A-Za-z0-9_-]sk_car_)|(?<=\\[nrt]sk_car_))(?!admin_)[A-Za-z0-9]{20,64}(?![A-Za-z0-9_-])
circleci-personal-api-token                            CCIPAT_(?:(?<![A-Za-z0-9_-]CCIPAT_)|(?<=\\[nrt]CCIPAT_))[A-Za-z0-9]{22}_[A-Za-z0-9]{40}(?![A-Za-z0-9_-])
circleci-project-api-token                             CCIPRJ_(?:(?<![A-Za-z0-9_-]CCIPRJ_)|(?<=\\[nrt]CCIPRJ_))[A-Za-z0-9]{22}_[A-Za-z0-9]{40}(?![A-Za-z0-9_-])
cloudflare-account-api-token-2026-scannable            cfat_(?:(?<![A-Za-z0-9_-]cfat_)|(?<=\\[nrt]cfat_))[A-Za-z0-9_\-]{40}[A-Za-z0-9_\-]{6,8}(?![A-Za-z0-9_-])
cloudflare-oauth-access-token-user                     cfoat_(?:(?<![A-Za-z0-9_-]cfoat_)|(?<=\\[nrt]cfoat_))[A-Za-z0-9_\-]{40,60}(?![A-Za-z0-9_-])
context7-upstash-api-key                               ctx7sk\-(?:(?<![A-Za-z0-9_-]ctx7sk\-)|(?<=\\[nrt]ctx7sk\-))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
datadog-application-key-new-format                     ddapp_(?:(?<![A-Za-z0-9_-]ddapp_)|(?<=\\[nrt]ddapp_))[A-Za-z0-9]{16,24}_[A-Za-z0-9]{40,56}(?![A-Za-z0-9_-])
datadog-service-access-token-bare                      ddsat_(?:(?<![A-Za-z0-9_-]ddsat_)|(?<=\\[nrt]ddsat_))[A-Za-z0-9]{16,24}_[A-Za-z0-9]{40,56}(?![A-Za-z0-9_-])
depot-ci-job-token                                     depot_cijob_(?:(?<![A-Za-z0-9_-]depot_cijob_)|(?<=\\[nrt]depot_cijob_))[A-Za-z0-9]{32,64}(?![A-Za-z0-9_-])
depot-organization-token                               depot_org_(?:(?<![A-Za-z0-9_-]depot_org_)|(?<=\\[nrt]depot_org_))[A-Za-z0-9]{32,64}(?![A-Za-z0-9_-])
e2b-access-token-legacy-dropped-2026-08                sk_e2b_(?:(?<![A-Za-z0-9_-]sk_e2b_)|(?<=\\[nrt]sk_e2b_))[0-9a-f]{40}(?![A-Za-z0-9_-])
elastic-cloud-serverless-uiam-credential-api-key       essu_(?:(?<![A-Za-z0-9_-]essu_)|(?<=\\[nrt]essu_))[A-Za-z0-9_=\-]{30,}(?![A-Za-z0-9_-])
fly-io-macaroon-token-v2                               fm2_(?:(?<![A-Za-z0-9_-]fm2_)|(?<=\\[nrt]fm2_))(?<!FlyV1 fm2_)(?<!,fm2_)[A-Za-z0-9+/_\-]{100,}={0,3}(?![A-Za-z0-9_-])
hashicorp-vault-recovery-token                         hvr\.(?:(?<![A-Za-z0-9_-]hvr\.)|(?<=\\[nrt]hvr\.))[A-Za-z0-9_\-]{24,}(?![A-Za-z0-9_-])
kaggle-api-token-2025-access-token                     KGAT_(?:(?<![A-Za-z0-9_-]KGAT_)|(?<=\\[nrt]KGAT_))[0-9a-f]{32}(?![A-Za-z0-9_-])
launchdarkly-server-side-sdk-key                       sdk\-(?:(?<![A-Za-z0-9_-]sdk\-)|(?<=\\[nrt]sdk\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
letta-api-key                                          sk\-let\-(?:(?<![A-Za-z0-9_-]sk\-let\-)|(?<=\\[nrt]sk\-let\-))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
mongodb-atlas-service-account-client-secret            mdb_sa_sk_(?:(?<![A-Za-z0-9_-]mdb_sa_sk_)|(?<=\\[nrt]mdb_sa_sk_))[A-Za-z0-9_\-]{24,80}(?![A-Za-z0-9_-])
neon-api-key-bare                                      napi_(?:(?<![A-Za-z0-9_-]napi_)|(?<=\\[nrt]napi_))[A-Za-z0-9]{40,80}(?![A-Za-z0-9_-])
netbird-personal-access-token                          nbp_(?:(?<![A-Za-z0-9_-]nbp_)|(?<=\\[nrt]nbp_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
netbird-proxy-access-token                             nbx_(?:(?<![A-Za-z0-9_-]nbx_)|(?<=\\[nrt]nbx_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
netbird-user-invite-token                              nbi_(?:(?<![A-Za-z0-9_-]nbi_)|(?<=\\[nrt]nbi_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
netlify-personal-access-token                          nfp_(?:(?<![A-Za-z0-9_-]nfp_)|(?<=\\[nrt]nfp_))(?=[0-9a-f]{0,39}[g-zA-Z])[A-Za-z0-9]{36,40}(?![A-Za-z0-9_-])
notion-dev-environment-pat                             development_ntn_(?:(?<![A-Za-z0-9_-]development_ntn_)|(?<=\\[nrt]development_ntn_))[0-9]{11}[A-Za-z0-9]{35}(?![A-Za-z0-9_-])
onesignal-app-api-key-v2                               os_v2_app_(?:(?<![A-Za-z0-9_-]os_v2_app_)|(?<=\\[nrt]os_v2_app_))[a-z0-9]{100,120}(?![A-Za-z0-9_-])
onesignal-organization-api-key-v2                      os_v2_org_(?:(?<![A-Za-z0-9_-]os_v2_org_)|(?<=\\[nrt]os_v2_org_))[a-z0-9]{100,120}(?![A-Za-z0-9_-])
openpipe-api-key                                       opk_(?:(?<![A-Za-z0-9_-]opk_)|(?<=\\[nrt]opk_))[0-9a-f]{42}(?![A-Za-z0-9_-])
openstack-keystone-rust-scim-api-key                   kscim_(?:(?<![A-Za-z0-9_-]kscim_)|(?<=\\[nrt]kscim_))[A-Za-z0-9]{43}_[0-9a-f]{8}(?![A-Za-z0-9_-])
polar-checkout-checkout-link-client-secret             polar_c(?:(?<![A-Za-z0-9_-]polar_c)|(?<=\\[nrt]polar_c))l?_[A-Za-z0-9]{43}(?![A-Za-z0-9_-])
posthog-heatmap-screenshot-secret                      phh_(?:(?<![A-Za-z0-9_-]phh_)|(?<=\\[nrt]phh_))[A-Za-z0-9_\-]{20,26}(?![A-Za-z0-9_-])
prefect-cloud-service-account-bot-api-key              pnb_(?:(?<![A-Za-z0-9_-]pnb_)|(?<=\\[nrt]pnb_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
pydantic-ai-gateway-gateway-api-key                    pylf_v(?:(?<![A-Za-z0-9_-]pylf_v)|(?<=\\[nrt]pylf_v))[0-9]+_[a-z]+_[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
render-api-key-bare                                    rnd_(?:(?<![A-Za-z0-9_-]rnd_)|(?<=\\[nrt]rnd_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
runpod-api-key                                         rpa_(?:(?<![A-Za-z0-9_-]rpa_)|(?<=\\[nrt]rpa_))[A-Za-z0-9]{16,}(?![A-Za-z0-9_-])
sentry-org-auth-token                                  sntrys_eyJ(?:(?<![A-Za-z0-9_-]sntrys_eyJ)|(?<=\\[nrt]sntrys_eyJ))[A-Za-z0-9+/=]{20,}_[A-Za-z0-9+/]{43}(?![A-Za-z0-9_-])
socket-dev-api-token                                   sktsec_(?:(?<![A-Za-z0-9_-]sktsec_)|(?<=\\[nrt]sktsec_))[A-Za-z0-9_]{30,}(?![A-Za-z0-9_-])
statsig-server-secret-key                              secret\-(?:(?<![A-Za-z0-9_-]secret\-)|(?<=\\[nrt]secret\-))[A-Za-z0-9]{40,46}(?![A-Za-z0-9_-])
stytch-project-workspace-secret                        secret\-(?:(?<![A-Za-z0-9_-]secret\-)|(?<=\\[nrt]secret\-))(?:test|live)\-[A-Za-z0-9_=\-]{36,44}(?![A-Za-z0-9_-])
supabase-oauth-access-token                            sbp_oauth_(?:(?<![A-Za-z0-9_-]sbp_oauth_)|(?<=\\[nrt]sbp_oauth_))[0-9a-f]{40}(?![A-Za-z0-9_-])
supabase-pat-supabase-pat-variant                      supabase_pat_(?:(?<![A-Za-z0-9_-]supabase_pat_)|(?<=\\[nrt]supabase_pat_))[A-Za-z0-9]{31,}(?![A-Za-z0-9_-])
tavily-api-key-bare                                    tvly\-(?:(?<![A-Za-z0-9_-]tvly\-)|(?<=\\[nrt]tvly\-))(?:dev\-|prod\-)?[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
together-ai-api-key-v1-format                          tgp_v1_(?:(?<![A-Za-z0-9_-]tgp_v1_)|(?<=\\[nrt]tgp_v1_))[A-Za-z0-9_\-]{40,50}(?![A-Za-z0-9_-])
trigger-dev-organization-access-token                  tr_oat_(?:(?<![A-Za-z0-9_-]tr_oat_)|(?<=\\[nrt]tr_oat_))[A-Za-z0-9]{20,64}(?![A-Za-z0-9_-])
trigger-dev-personal-access-token-bare                 tr_pat_(?:(?<![A-Za-z0-9_-]tr_pat_)|(?<=\\[nrt]tr_pat_))[1-9a-km-z]{40}(?![A-Za-z0-9_-])
umami-api-key                                          umami_(?:(?<![A-Za-z0-9_-]umami_)|(?<=\\[nrt]umami_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
upstash-box-api-key                                    box_(?:(?<![A-Za-z0-9_-]box_)|(?<=\\[nrt]box_))[A-Za-z0-9_\-]{24,}(?![A-Za-z0-9_-])
vercel-api-key                                         vck_(?:(?<![A-Za-z0-9_-]vck_)|(?<=\\[nrt]vck_))[A-Za-z0-9]{24,60}(?![A-Za-z0-9_-])
vercel-app-access-token-bare                           vca_(?:(?<![A-Za-z0-9_-]vca_)|(?<=\\[nrt]vca_))[A-Za-z0-9]{24,60}(?![A-Za-z0-9_-])
vercel-app-refresh-token-bare                          vcr_(?:(?<![A-Za-z0-9_-]vcr_)|(?<=\\[nrt]vcr_))[A-Za-z0-9]{24,60}(?![A-Za-z0-9_-])
vercel-integration-token-bare                          vci_(?:(?<![A-Za-z0-9_-]vci_)|(?<=\\[nrt]vci_))[A-Za-z0-9]{24,60}(?![A-Za-z0-9_-])
vercel-personal-product-token-vcp                      vcp_(?:(?<![A-Za-z0-9_-]vcp_)|(?<=\\[nrt]vcp_))[A-Za-z0-9]{24,60}(?![A-Za-z0-9_-])
wagtail-api-token                                      wagtail_(?:(?<![A-Za-z0-9_-]wagtail_)|(?<=\\[nrt]wagtail_))[A-Za-z0-9]{33}(?![A-Za-z0-9_-])
weights-biases-api-key-v1-format                       wandb_v1_(?:(?<![A-Za-z0-9_-]wandb_v1_)|(?<=\\[nrt]wandb_v1_))[A-Za-z0-9_]{70,90}(?![A-Za-z0-9_-])
zuplo-api-key-consumer                                 zpka_(?:(?<![A-Za-z0-9_-]zpka_)|(?<=\\[nrt]zpka_))[A-Za-z0-9]{32,}_[A-Za-z0-9]{6,8}(?![A-Za-z0-9_-])
# 0.7.11, provider code, round 2: more prefixed formats read from the providers' own code and documentation
# (the providers that GitHub secret scanning and trufflehog name) that no rule above takes
apify-proxy-password                        apify_proxy_(?:(?<![A-Za-z0-9_-]apify_proxy_)|(?<=\\[nrt]apify_proxy_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
braintree-oauth-access-token-production     access_token\$production\$(?:(?<![A-Za-z0-9_-]access_token\$production\$)|(?<=\\[nrt]access_token\$production\$))[A-Za-z0-9_]{1,64}\$[0-9a-f]{8,64}(?![A-Za-z0-9_-])
braintree-oauth-access-token-sandbox        access_token\$sandbox\$(?:(?<![A-Za-z0-9_-]access_token\$sandbox\$)|(?<=\\[nrt]access_token\$sandbox\$))[A-Za-z0-9_]{1,64}\$[0-9a-f]{8,64}(?![A-Za-z0-9_-])
braintree-oauth-client-secret-production    client_secret\$production\$(?:(?<![A-Za-z0-9_-]client_secret\$production\$)|(?<=\\[nrt]client_secret\$production\$))[A-Za-z0-9_]{8,64}(?![A-Za-z0-9_-])
braintree-oauth-client-secret-sandbox       client_secret\$sandbox\$(?:(?<![A-Za-z0-9_-]client_secret\$sandbox\$)|(?<=\\[nrt]client_secret\$sandbox\$))[A-Za-z0-9_]{8,64}(?![A-Za-z0-9_-])
byteplus-access-key-id                      AKLT(?:(?<![A-Za-z0-9_-]AKLT)|(?<=\\[nrt]AKLT))[a-zA-Z0-9_\-]{16,28}(?![A-Za-z0-9_-])
canva-connect-apps-oauth-client-secret      cnvca(?:(?<![A-Za-z0-9_-]cnvca)|(?<=\\[nrt]cnvca))[A-Za-z0-9_\-]{20,}(?![A-Za-z0-9_-])
checkout-com-sandbox-secret-key-abc         sk_test_(?:(?<![A-Za-z0-9_-]sk_test_)|(?<=\\[nrt]sk_test_))[A-Za-z0-9_]{8}\-[A-Za-z0-9_]{4}\-[A-Za-z0-9_]{4}\-[A-Za-z0-9_]{4}\-[A-Za-z0-9_]{12}(?![A-Za-z0-9_-])
chief-tools-oauth-access-token              cto_(?:(?<![A-Za-z0-9_-]cto_)|(?<=\\[nrt]cto_))[A-Za-z0-9]{36,248}(?![A-Za-z0-9_-])
chief-tools-oauth-refresh-token             ctr_(?:(?<![A-Za-z0-9_-]ctr_)|(?<=\\[nrt]ctr_))[A-Za-z0-9]{36,248}(?![A-Za-z0-9_-])
chief-tools-personal-access-token           ctp_(?:(?<![A-Za-z0-9_-]ctp_)|(?<=\\[nrt]ctp_))[A-Za-z0-9]{36,248}(?![A-Za-z0-9_-])
chief-tools-team-access-token               ctt_(?:(?<![A-Za-z0-9_-]ctt_)|(?<=\\[nrt]ctt_))[A-Za-z0-9]{36,248}(?![A-Za-z0-9_-])
crates-io-trusted-publishing-token          cio_tp_(?:(?<![A-Za-z0-9_-]cio_tp_)|(?<=\\[nrt]cio_tp_))[A-Za-z0-9]{32}(?![A-Za-z0-9_-])
databricks-oauth-u2m-refresh-token          doau(?:(?<![A-Za-z0-9_-]doau)|(?<=\\[nrt]doau))[a-zA-Z0-9]{32,40}(?![A-Za-z0-9_-])
duffel-test-access-token                    duffel_test_(?:(?<![A-Za-z0-9_-]duffel_test_)|(?<=\\[nrt]duffel_test_))[A-Za-z0-9_\-]{20,128}(?![A-Za-z0-9_-])
fieldguide-user-api-token                   fg_us_(?:(?<![A-Za-z0-9_-]fg_us_)|(?<=\\[nrt]fg_us_))[0-9a-f]{32}(?![A-Za-z0-9_-])
gitlab-runner-registration-auth-token       glrtr\-(?:(?<![A-Za-z0-9_-]glrtr\-)|(?<=\\[nrt]glrtr\-))(?:(?:t[0-9a-f]+_)?[A-Za-z0-9_\-]{20}|[A-Za-z0-9_\-]{27,600}\.01\.[0-9a-z]{9})(?![A-Za-z0-9_-])
gitlab-session-cookie-bare                  _gitlab_session=(?:(?<![A-Za-z0-9_-]_gitlab_session=)|(?<=\\[nrt]_gitlab_session=))[A-Za-z0-9%_\-]{32,}(?![A-Za-z0-9_-])
gitlab-workspace-token-gitlab-18-2          glwt\-(?:(?<![A-Za-z0-9_-]glwt\-)|(?<=\\[nrt]glwt\-))[A-Za-z0-9_\-]{27,600}\.01\.[0-9a-z]{9}(?![A-Za-z0-9_-])
google-api-key-bound-to-service-account     AQ\.Ab8R(?:(?<![A-Za-z0-9_-]AQ\.Ab8R)|(?<=\\[nrt]AQ\.Ab8R))[a-zA-Z0-9_\-]{46}(?![A-Za-z0-9_-])
google-cloud-storage-hmac-key-access-id     GOOG(?:(?<![A-Za-z0-9_-]GOOG)|(?<=\\[nrt]GOOG))(?:[A-Z0-9]{57}|[A-Z0-9]{20})(?![A-Za-z0-9_-])
hex-api-key-hex-pm                          hex_(?:(?<![A-Za-z0-9_-]hex_)|(?<=\\[nrt]hex_))[0-9a-f]{40}(?![A-Za-z0-9_-])
huggingface-organization-api-token-legacy   api_org_(?:(?<![A-Za-z0-9_-]api_org_)|(?<=\\[nrt]api_org_))[A-Za-z0-9]{34}(?![A-Za-z0-9_-])
jumpcloud-admin-api-key                     jca_(?:(?<![A-Za-z0-9_-]jca_)|(?<=\\[nrt]jca_))[A-Za-z0-9]{36}(?![A-Za-z0-9_-])
klarna-live-api-key                         klarna_live_api_(?:(?<![A-Za-z0-9_-]klarna_live_api_)|(?<=\\[nrt]klarna_live_api_))[A-Za-z0-9]{20,256}(?![A-Za-z0-9_-])
klarna-test-playground-api-key              klarna_test_api_(?:(?<![A-Za-z0-9_-]klarna_test_api_)|(?<=\\[nrt]klarna_test_api_))[A-Za-z0-9]{20,256}(?![A-Za-z0-9_-])
limbar-limrun-organization-api-key          lim_(?:(?<![A-Za-z0-9_-]lim_)|(?<=\\[nrt]lim_))[A-Za-z0-9]{20,64}(?![A-Za-z0-9_-])
limbar-limrun-scoped-signed-registry-token  lim_st_(?:(?<![A-Za-z0-9_-]lim_st_)|(?<=\\[nrt]lim_st_))[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}(?![A-Za-z0-9_-])
nylas-v3-api-key                            nyk_v0(?:(?<![A-Za-z0-9_-]nyk_v0)|(?<=\\[nrt]nyk_v0))[A-Za-z0-9_]{20,}(?![A-Za-z0-9_-])
persona-production-api-key-bare             persona_production_(?:(?<![A-Za-z0-9_-]persona_production_)|(?<=\\[nrt]persona_production_))[A-Za-z0-9_\-]{20,128}(?![A-Za-z0-9_-])
persona-sandbox-api-key                     persona_sandbox_(?:(?<![A-Za-z0-9_-]persona_sandbox_)|(?<=\\[nrt]persona_sandbox_))[A-Za-z0-9_\-]{20,128}(?![A-Za-z0-9_-])
plaid-assets-token-production               assets\-production\-(?:(?<![A-Za-z0-9_-]assets\-production\-)|(?<=\\[nrt]assets\-production\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
plaid-assets-token-sandbox                  assets\-sandbox\-(?:(?<![A-Za-z0-9_-]assets\-sandbox\-)|(?<=\\[nrt]assets\-sandbox\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
plaid-processor-token-production            processor\-production\-(?:(?<![A-Za-z0-9_-]processor\-production\-)|(?<=\\[nrt]processor\-production\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
plaid-processor-token-sandbox               processor\-sandbox\-(?:(?<![A-Za-z0-9_-]processor\-sandbox\-)|(?<=\\[nrt]processor\-sandbox\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
plaid-user-token-production                 user\-production\-(?:(?<![A-Za-z0-9_-]user\-production\-)|(?<=\\[nrt]user\-production\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
plaid-user-token-sandbox                    user\-sandbox\-(?:(?<![A-Za-z0-9_-]user\-sandbox\-)|(?<=\\[nrt]user\-sandbox\-))[0-9a-f]{8}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{4}\-[0-9a-f]{12}(?![A-Za-z0-9_-])
pubnub-secret-key                           sec\-c\-(?:(?<![A-Za-z0-9_-]sec\-c\-)|(?<=\\[nrt]sec\-c\-))[A-Za-z0-9+/]{48}(?![A-Za-z0-9_-])
shippo-live-api-token                       shippo_live_(?:(?<![A-Za-z0-9_-]shippo_live_)|(?<=\\[nrt]shippo_live_))[0-9a-f]{32,40}(?![A-Za-z0-9_-])
shippo-test-api-token                       shippo_test_(?:(?<![A-Za-z0-9_-]shippo_test_)|(?<=\\[nrt]shippo_test_))[0-9a-f]{32,40}(?![A-Za-z0-9_-])
slack-rotating-access-token                 xoxe\.x(?:(?<![A-Za-z0-9_-]xoxe\.x)|(?<=\\[nrt]xoxe\.x))(?:oxb|oxp|app)\-1\-[A-Za-z0-9\-]{20,}(?![A-Za-z0-9_-])
square-oauth-refresh-token                  EQAA(?:(?<![A-Za-z0-9_-]EQAA)|(?<=\\[nrt]EQAA))[A-Za-z0-9_\-]{60}(?![A-Za-z0-9_-])
stripe-claimable-sandbox-restricted-key     rkcs_(?:(?<![A-Za-z0-9_-]rkcs_)|(?<=\\[nrt]rkcs_))[A-Za-z0-9_]{16,255}(?![A-Za-z0-9_-])
stripe-organization-api-key-bare            sk_org_(?:(?<![A-Za-z0-9_-]sk_org_)|(?<=\\[nrt]sk_org_))[A-Za-z0-9_]{16,255}(?![A-Za-z0-9_-])
wave-senegal-request-signing-secret         wave_sn_AKS_(?:(?<![A-Za-z0-9_-]wave_sn_AKS_)|(?<=\\[nrt]wave_sn_AKS_))[A-Za-z0-9]{20,256}(?![A-Za-z0-9_-])
zapier-catch-hook-webhook-url               (?<![\w./-])(?:https?://)?hooks\.zapier\.com\/hooks\/catch\/(?:(?<![A-Za-z0-9_-]hooks\.zapier\.com\/hooks\/catch\/)|(?<=\\[nrt]hooks\.zapier\.com\/hooks\/catch\/))[0-9]+\/[A-Za-z0-9]+\/?(?![A-Za-z0-9_-])
# 0.8.3: Labelbox API keys (lbx_ and rma_, 43 characters, the last one of a fixed set), from the betterleaks rules on
# main of 2026-10-28, ahead of its next release
labelbox-api-key                            lbx_(?:(?<![A-Za-z0-9_-]lbx_)|(?<=\\[nrt]lbx_))[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048](?![A-Za-z0-9_-])
labelbox-recursion-api-key                  rma_(?:(?<![A-Za-z0-9_-]rma_)|(?<=\\[nrt]rma_))[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048](?![A-Za-z0-9_-])
# 0.8.5: Composio API keys (org oak_ with 20 characters, user uak_ with 43; Stripe OAK tokens start with oak_ too, so
# that line names no vendor), from the trufflehog detector of
# 2026-10-28. oak_ also needs a capital and a digit, so a short identifier is no hit. The project key ak_ has no line:
# its prefix is shorter than four characters.
oak-api-key                                 oak_(?:(?<![A-Za-z0-9_-]oak_)|(?<=\\[nrt]oak_))(?=[A-Za-z_-]{0,19}[0-9])(?=[a-z0-9_-]{0,19}[A-Z])[A-Za-z0-9_-]{20}(?![A-Za-z0-9_-])
composio-user-api-key                       uak_(?:(?<![A-Za-z0-9_-]uak_)|(?<=\\[nrt]uak_))[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-])
