gitleaks default rule set, ported into nullcipher =================================================== Upstream: https://github.com/gitleaks/gitleaks — config/gitleaks.toml Tag: v8.30.1 Commit: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e Fetched: 2026-09-25 (read-only GET of https://raw.githubusercontent.com/gitleaks/gitleaks/v8.30.1/config/gitleaks.toml) Upstream sha256: e163e53b9e7e8a8511e77271e2b323ed057759542a6d988258afe3a1fa329caf File: data/gitleaks/gitleaks-v8.30.1.toml in the nullcipher repository, sha256 c6488f1c7c258f7d2971a91f8507ec92fe1e88bbf3241f85a33178d851eb9e6b: the upstream file with the gcp-api-key rule's allowlist removed (16 literal Google API keys that gitleaks treats as known-public; the rule itself is not ported), so the repository holds no key-shaped literals. tools/port-gitleaks.cjs --fetch re-downloads, checks the upstream sha256 and applies the same removal. Licence: MIT, Copyright (c) 2019 Zachary Rice — see LICENSE in this folder Output: /js/provider-rules.js, generated by tools/port-gitleaks.cjs Rules upstream: 222 Ported: 196 Skipped: 26 How each rule was ported - The RE2 pattern is translated to a JavaScript RegExp source (tools/re2js.cjs): inline (?i) / (?-i:) / (?s:) flags, [[:alnum:]], (?P) and \z are rewritten; case-insensitive parts are expanded by hand, so no rule relies on the JavaScript "i" flag. - The keyword prefilter is kept: a rule runs only when one of its keywords appears in the text (case-insensitive). - The secret group is kept (secretGroup, else the first non-empty capture group, as gitleaks does), so only the secret is masked. - The entropy threshold is kept: the secret's Shannon entropy must exceed it. - The global allowlist regexes and stopwords, and each rule's own allowlist regexes and stopwords, are kept. Path- and commit-based allowlists do not apply to pasted text. Modified rules (1) - sourcegraph-access-token: dropped the bare 40-hex-digit alternative: in any text that mentions Sourcegraph it masks every git commit hash, which nullcipher promises to leave alone; sgp_ tokens are still matched Ported rules (196), in the order they run — gitleaks id -> nullcipher placeholder type - 1password-secret-key -> ONEPASSWORD_SECRET_KEY - 1password-service-account-token -> ONEPASSWORD_SERVICE_ACCOUNT_TOKEN - adafruit-api-key -> ADAFRUIT_API_KEY - adobe-client-id -> ADOBE_CLIENT_ID - adobe-client-secret -> ADOBE_CLIENT_SECRET - age-secret-key -> AGE_SECRET_KEY - airtable-api-key -> AIRTABLE_API_KEY - airtable-personnal-access-token -> AIRTABLE_PERSONNAL_ACCESS_TOKEN - algolia-api-key -> ALGOLIA_API_KEY - alibaba-access-key-id -> ALIBABA_ACCESS_KEY_ID - alibaba-secret-key -> ALIBABA_SECRET_KEY - artifactory-api-key -> ARTIFACTORY_API_KEY - artifactory-reference-token -> ARTIFACTORY_REFERENCE_TOKEN - asana-client-id -> ASANA_CLIENT_ID - asana-client-secret -> ASANA_CLIENT_SECRET - atlassian-api-token -> ATLASSIAN_API_TOKEN - authress-service-client-access-key -> AUTHRESS_SERVICE_CLIENT_ACCESS_KEY - aws-amazon-bedrock-api-key-long-lived -> AWS_AMAZON_BEDROCK_API_KEY_LONG_LIVED - aws-amazon-bedrock-api-key-short-lived -> AWS_AMAZON_BEDROCK_API_KEY_SHORT_LIVED - azure-ad-client-secret -> AZURE_AD_CLIENT_SECRET - beamer-api-token -> BEAMER_API_TOKEN - bitbucket-client-id -> BITBUCKET_CLIENT_ID - bitbucket-client-secret -> BITBUCKET_CLIENT_SECRET - bittrex-access-key -> BITTREX_ACCESS_KEY - cisco-meraki-api-key -> CISCO_MERAKI_API_KEY - clickhouse-cloud-api-secret-key -> CLICKHOUSE_CLOUD_API_SECRET_KEY - clojars-api-token -> CLOJARS_API_TOKEN - cloudflare-api-key -> CLOUDFLARE_API_KEY - cloudflare-global-api-key -> CLOUDFLARE_GLOBAL_API_KEY - cloudflare-origin-ca-key -> CLOUDFLARE_ORIGIN_CA_KEY - codecov-access-token -> CODECOV_ACCESS_TOKEN - cohere-api-token -> COHERE_API_TOKEN - coinbase-access-token -> COINBASE_ACCESS_TOKEN - confluent-access-token -> CONFLUENT_ACCESS_TOKEN - confluent-secret-key -> CONFLUENT_SECRET_KEY - contentful-delivery-api-token -> CONTENTFUL_DELIVERY_API_TOKEN - databricks-api-token -> DATABRICKS_API_TOKEN - datadog-access-token -> DATADOG_ACCESS_TOKEN - defined-networking-api-token -> DEFINED_NETWORKING_API_TOKEN - digitalocean-access-token -> DIGITALOCEAN_ACCESS_TOKEN - digitalocean-pat -> DIGITALOCEAN_PAT - digitalocean-refresh-token -> DIGITALOCEAN_REFRESH_TOKEN - discord-api-token -> DISCORD_API_TOKEN - discord-client-id -> DISCORD_CLIENT_ID - discord-client-secret -> DISCORD_CLIENT_SECRET - doppler-api-token -> DOPPLER_API_TOKEN - droneci-access-token -> DRONECI_ACCESS_TOKEN - dropbox-api-token -> DROPBOX_API_TOKEN - dropbox-long-lived-api-token -> DROPBOX_LONG_LIVED_API_TOKEN - dropbox-short-lived-api-token -> DROPBOX_SHORT_LIVED_API_TOKEN - duffel-api-token -> DUFFEL_API_TOKEN - dynatrace-api-token -> DYNATRACE_API_TOKEN - easypost-api-token -> EASYPOST_API_TOKEN - easypost-test-api-token -> EASYPOST_TEST_API_TOKEN - etsy-access-token -> ETSY_ACCESS_TOKEN - facebook-access-token -> FACEBOOK_ACCESS_TOKEN - facebook-page-access-token -> FACEBOOK_PAGE_ACCESS_TOKEN - facebook-secret -> FACEBOOK_SECRET - fastly-api-token -> FASTLY_API_TOKEN - finicity-api-token -> FINICITY_API_TOKEN - finicity-client-secret -> FINICITY_CLIENT_SECRET - finnhub-access-token -> FINNHUB_ACCESS_TOKEN - flickr-access-token -> FLICKR_ACCESS_TOKEN - flutterwave-secret-key -> FLUTTERWAVE_SECRET_KEY - flutterwave-encryption-key -> FLUTTERWAVE_ENCRYPTION_KEY - flutterwave-public-key -> FLUTTERWAVE_PUBLIC_KEY - flyio-access-token -> FLYIO_ACCESS_TOKEN - frameio-api-token -> FRAMEIO_API_TOKEN - freshbooks-access-token -> FRESHBOOKS_ACCESS_TOKEN - gitlab-cicd-job-token -> GITLAB_CICD_JOB_TOKEN - gitlab-deploy-token -> GITLAB_DEPLOY_TOKEN - gitlab-feature-flag-client-token -> GITLAB_FEATURE_FLAG_CLIENT_TOKEN - gitlab-feed-token -> GITLAB_FEED_TOKEN - gitlab-incoming-mail-token -> GITLAB_INCOMING_MAIL_TOKEN - gitlab-kubernetes-agent-token -> GITLAB_KUBERNETES_AGENT_TOKEN - gitlab-oauth-app-secret -> GITLAB_OAUTH_APP_SECRET - gitlab-pat-routable -> GITLAB_PAT_ROUTABLE - gitlab-pat -> GITLAB_PAT - gitlab-ptt -> GITLAB_PTT - gitlab-rrt -> GITLAB_RRT - gitlab-runner-authentication-token-routable -> GITLAB_RUNNER_AUTHENTICATION_TOKEN_ROUTABLE - gitlab-runner-authentication-token -> GITLAB_RUNNER_AUTHENTICATION_TOKEN - gitlab-scim-token -> GITLAB_SCIM_TOKEN - gitlab-session-cookie -> GITLAB_SESSION_COOKIE - gitter-access-token -> GITTER_ACCESS_TOKEN - gocardless-api-token -> GOCARDLESS_API_TOKEN - grafana-api-key -> GRAFANA_API_KEY - grafana-cloud-api-token -> GRAFANA_CLOUD_API_TOKEN - grafana-service-account-token -> GRAFANA_SERVICE_ACCOUNT_TOKEN - harness-api-key -> HARNESS_API_KEY - hashicorp-tf-api-token -> HASHICORP_TF_API_TOKEN - heroku-api-key -> HEROKU_API_KEY - heroku-api-key-v2 -> HEROKU_API_KEY_V2 - hubspot-api-key -> HUBSPOT_API_KEY - huggingface-access-token -> HUGGINGFACE_ACCESS_TOKEN - huggingface-organization-api-token -> HUGGINGFACE_ORGANIZATION_API_TOKEN - infracost-api-token -> INFRACOST_API_TOKEN - intercom-api-key -> INTERCOM_API_KEY - intra42-client-secret -> INTRA42_CLIENT_SECRET - jfrog-api-key -> JFROG_API_KEY - jfrog-identity-token -> JFROG_IDENTITY_TOKEN - kraken-access-token -> KRAKEN_ACCESS_TOKEN - kucoin-access-token -> KUCOIN_ACCESS_TOKEN - kucoin-secret-key -> KUCOIN_SECRET_KEY - launchdarkly-access-token -> LAUNCHDARKLY_ACCESS_TOKEN - linear-api-key -> LINEAR_API_KEY - linear-client-secret -> LINEAR_CLIENT_SECRET - linkedin-client-id -> LINKEDIN_CLIENT_ID - linkedin-client-secret -> LINKEDIN_CLIENT_SECRET - lob-api-key -> LOB_API_KEY - lob-pub-api-key -> LOB_PUB_API_KEY - looker-client-id -> LOOKER_CLIENT_ID - looker-client-secret -> LOOKER_CLIENT_SECRET - mailchimp-api-key -> MAILCHIMP_API_KEY - mailgun-private-api-token -> MAILGUN_PRIVATE_API_TOKEN - mailgun-pub-key -> MAILGUN_PUB_KEY - mailgun-signing-key -> MAILGUN_SIGNING_KEY - mapbox-api-token -> MAPBOX_API_TOKEN - mattermost-access-token -> MATTERMOST_ACCESS_TOKEN - maxmind-license-key -> MAXMIND_LICENSE_KEY - messagebird-api-token -> MESSAGEBIRD_API_TOKEN - messagebird-client-id -> MESSAGEBIRD_CLIENT_ID - microsoft-teams-webhook -> MICROSOFT_TEAMS_WEBHOOK - netlify-access-token -> NETLIFY_ACCESS_TOKEN - new-relic-browser-api-token -> NEW_RELIC_BROWSER_API_TOKEN - new-relic-insert-key -> NEW_RELIC_INSERT_KEY - new-relic-user-api-id -> NEW_RELIC_USER_API_ID - new-relic-user-api-key -> NEW_RELIC_USER_API_KEY - notion-api-token -> NOTION_API_TOKEN - npm-access-token -> NPM_ACCESS_TOKEN - nytimes-access-token -> NYTIMES_ACCESS_TOKEN - octopus-deploy-api-key -> OCTOPUS_DEPLOY_API_KEY - okta-access-token -> OKTA_ACCESS_TOKEN - openshift-user-token -> OPENSHIFT_USER_TOKEN - perplexity-api-key -> PERPLEXITY_API_KEY - plaid-api-token -> PLAID_API_TOKEN - plaid-client-id -> PLAID_CLIENT_ID - plaid-secret-key -> PLAID_SECRET_KEY - planetscale-api-token -> PLANETSCALE_API_TOKEN - planetscale-oauth-token -> PLANETSCALE_OAUTH_TOKEN - planetscale-password -> PLANETSCALE_PASSWORD - postman-api-token -> POSTMAN_API_TOKEN - prefect-api-token -> PREFECT_API_TOKEN - privateai-api-token -> PRIVATEAI_API_TOKEN - pulumi-api-token -> PULUMI_API_TOKEN - pypi-upload-token -> PYPI_UPLOAD_TOKEN - rapidapi-access-token -> RAPIDAPI_ACCESS_TOKEN - readme-api-token -> README_API_TOKEN - rubygems-api-token -> RUBYGEMS_API_TOKEN - scalingo-api-token -> SCALINGO_API_TOKEN - sendbird-access-id -> SENDBIRD_ACCESS_ID - sendbird-access-token -> SENDBIRD_ACCESS_TOKEN - sendgrid-api-token -> SENDGRID_API_TOKEN - sendinblue-api-token -> SENDINBLUE_API_TOKEN - sentry-access-token -> SENTRY_ACCESS_TOKEN - sentry-org-token -> SENTRY_ORG_TOKEN - sentry-user-token -> SENTRY_USER_TOKEN - settlemint-application-access-token -> SETTLEMINT_APPLICATION_ACCESS_TOKEN - settlemint-personal-access-token -> SETTLEMINT_PERSONAL_ACCESS_TOKEN - settlemint-service-access-token -> SETTLEMINT_SERVICE_ACCESS_TOKEN - shippo-api-token -> SHIPPO_API_TOKEN - shopify-access-token -> SHOPIFY_ACCESS_TOKEN - shopify-custom-access-token -> SHOPIFY_CUSTOM_ACCESS_TOKEN - shopify-private-app-access-token -> SHOPIFY_PRIVATE_APP_ACCESS_TOKEN - shopify-shared-secret -> SHOPIFY_SHARED_SECRET - sidekiq-secret -> SIDEKIQ_SECRET - sidekiq-sensitive-url -> SIDEKIQ_SENSITIVE_URL - slack-app-token -> SLACK_APP_TOKEN - slack-config-refresh-token -> SLACK_CONFIG_REFRESH_TOKEN - slack-legacy-token -> SLACK_LEGACY_TOKEN - slack-legacy-workspace-token -> SLACK_LEGACY_WORKSPACE_TOKEN - slack-user-token -> SLACK_USER_TOKEN - slack-webhook-url -> SLACK_WEBHOOK_URL - snyk-api-token -> SNYK_API_TOKEN - sonar-api-token -> SONAR_API_TOKEN - sourcegraph-access-token -> SOURCEGRAPH_ACCESS_TOKEN - square-access-token -> SQUARE_ACCESS_TOKEN - squarespace-access-token -> SQUARESPACE_ACCESS_TOKEN - sumologic-access-id -> SUMOLOGIC_ACCESS_ID - sumologic-access-token -> SUMOLOGIC_ACCESS_TOKEN - telegram-bot-api-token -> TELEGRAM_BOT_API_TOKEN - travisci-access-token -> TRAVISCI_ACCESS_TOKEN - twilio-api-key -> TWILIO_API_KEY - twitch-api-token -> TWITCH_API_TOKEN - twitter-access-secret -> TWITTER_ACCESS_SECRET - twitter-access-token -> TWITTER_ACCESS_TOKEN - twitter-api-key -> TWITTER_API_KEY - twitter-api-secret -> TWITTER_API_SECRET - twitter-bearer-token -> TWITTER_BEARER_TOKEN - typeform-api-token -> TYPEFORM_API_TOKEN - vault-batch-token -> VAULT_BATCH_TOKEN - vault-service-token -> VAULT_SERVICE_TOKEN - yandex-access-token -> YANDEX_ACCESS_TOKEN - yandex-api-key -> YANDEX_API_KEY - yandex-aws-access-token -> YANDEX_AWS_ACCESS_TOKEN - zendesk-secret-key -> ZENDESK_SECRET_KEY Skipped rules (26) - anthropic-admin-api-key: already covered by nullcipher's ANTHROPIC_KEY detector - anthropic-api-key: already covered by nullcipher's ANTHROPIC_KEY detector - aws-access-token: already covered by nullcipher's AWS_KEY detector - bittrex-secret-key: same pattern and keywords as bittrex-access-key, so it could never fire; a match is masked as BITTREX_ACCESS_KEY (labelled "Bittrex access or secret key") - curl-auth-header: already covered by nullcipher's BEARER detector - curl-auth-user: already covered by nullcipher's CONN_SECRET detector - freemius-secret-key: only applies to files whose path matches (?i)\.php$; pasted text has no path - gcp-api-key: already covered by nullcipher's GOOGLE_API_KEY detector - generic-api-key: keyword and entropy only — catch-all: any secret-named key followed by a high-entropy value (nullcipher's own SECRET detector handles key=value lines) - github-app-token: already covered by nullcipher's GITHUB_TOKEN detector - github-fine-grained-pat: already covered by nullcipher's GITHUB_TOKEN detector - github-oauth: already covered by nullcipher's GITHUB_TOKEN detector - github-pat: already covered by nullcipher's GITHUB_TOKEN detector - github-refresh-token: already covered by nullcipher's GITHUB_TOKEN detector - hashicorp-tf-password: keyword and entropy only — keyword plus an 8-20 character value of any shape and an entropy threshold, and only in .tf/.hcl files - jwt: already covered by nullcipher's JWT detector - jwt-base64: already covered by nullcipher's JWT detector - kubernetes-secret-yaml: only applies to files whose path matches (?i)\.ya?ml$; pasted text has no path - nuget-config-password: only applies to files whose path matches (?i)nuget\.config$; pasted text has no path - openai-api-key: already covered by nullcipher's OPENAI_KEY detector - pkcs12-file: matches a file name only (no content pattern) - private-key: already covered by nullcipher's PRIVATE_KEY detector - slack-bot-token: already covered by nullcipher's SLACK_TOKEN detector (every sampled match is masked in full by it) - slack-config-access-token: already covered by nullcipher's SLACK_TOKEN detector - slack-legacy-bot-token: already covered by nullcipher's SLACK_TOKEN detector (every sampled match is masked in full by it) - stripe-access-token: already covered by nullcipher's STRIPE_KEY detector