id: secrets-patterns-pii

info:
  name: Secrets Patterns (PII)
  author: dwisiswant0
  reference:
    - https://github.com/mazen160/secrets-patterns-db # db/pii-stable.yml (3f9f67a8f2b6e140a50a226041e9593fc2f5637e)
  severity: info
  tags: global-matchers,exposure,token,key,api,secret,password,generic

http:
  - global-matchers: true
    extractors:
      - type: regex
        name: times
        regex:
          - \d{1,2}:\d{2} ?(?:[ap]\.?m\.?)?|\d[ap]\.?m\.?
        part: body
      # - type: regex # PCRE
      #   name: phones
      #   regex:
      #     - >-
      #       ((?:(?<![\d-])(?:\+?\d{1,3}[-.\s*]?)?(?:\(?\d{3}\)?[-.\s*]?)?\d{3}[-.\s*]?\d{4}(?![\d-]))|(?:(?<![\d-])(?:(?:\(\+?\d{2}\))|(?:\+?\d{2}))\s*\d{2}\s*\d{3}\s*\d{4}(?![\d-])))
      #   part: body
      - type: regex
        name: phones_with_exts
        regex:
          - >-
            ((?:(?:\+?1\s*(?:[.-]\s*)?)?(?:\(\s*(?:[2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9])\s*\)|(?:[2-9]1[02-9]|[2-9][02-8]1|[2-9][02-8][02-9]))\s*(?:[.-]\s*)?)?(?:[2-9]1[02-9]|[2-9][02-9]1|[2-9][02-9]{2})\s*(?:[.-]\s*)?(?:[0-9]{4})(?:\s*(?:#|x\.?|ext\.?|extension)\s*(?:\d+)?))
        part: body
      - type: regex
        name: emails
        regex:
          - >-
            ([a-z0-9!#$%&'*+\/=?^_`{|.}~-]+@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)
        part: body
      # - type: regex # PCRE
      #   name: street_addresses
      #   regex:
      #     - >-
      #       \d{1,4}
      #       [\w\s]{1,20}(?:street|st|avenue|ave|road|rd|highway|hwy|square|sq|trail|trl|drive|dr|court|ct|park|parkway|pkwy|circle|cir|boulevard|blvd)\W?(?=\s|$)
      #   part: body
      - type: regex
        name: po_boxes
        regex:
          - P\.? ?O\.? Box \d+
        part: body
      - type: regex
        name: ukphones
        regex:
          - >-
            ^\s*\(?(020[7,8]{1}\)?[ ]?[1-9]{1}[0-9{2}[
            ]?[0-9]{4})|(0[1-8]{1}[0-9]{3}\)?[]?[1-9]{1}[0-9]{2}[
            ]?[0-9]{3})\s*$
        part: body
      - type: regex
        name: email_3
        regex:
          - \b[\w\-+.]+@+\w+.+[A-z]{3}
        part: body
      # - type: regex # PCRE
      #   name: ssn_3
      #   regex:
      #     - "\b(?!000|666)[0-8][0-9]{2}-(?!00)[0-9]{2}-(?!0000)[0-9]{4}\b"
      #   part: body
      # - type: regex # PCRE
      #   name: ssn_number
      #   regex:
      #     - >-
      #       (?!000|666|333)0*(?:[0-6][0-9][0-9]|[0-7][0-6][0-9]|[0-7][0-7][0-2])[-](?!00)[0-9]{2}[-
      #       ](?!0000)[0-9]{4}
      #   part: body
      - type: regex
        name: visa_credit_card
        regex:
          - 4[0-9]{15}
        part: body
      - type: regex
        name: american_express_creditcard
        regex:
          - 3[47][0-9]{13}
        part: body
      - type: regex
        name: otp
        regex:
          - ^[0-9]{6}$
        part: body
      - type: regex
        name: credit_card_2
        regex:
          - >-
            4[0-9]{12}(?:[0-9]{3})?|(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}
            |3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|6(?:011|5[0-9]{2})[0-9]{12}|(?:2131|1800|35\d{3})\d{11}
        part: body
      - type: regex
        name: uk_phone_numbers
        regex:
          - \b([0O]?[1lI][1lI])?[4A][4A][\dOIlZEASB]{10,11}\b
        part: body
      - type: regex
        name: us_phone_numbers
        regex:
          - >-
            \b((\+|\b)[1l][\-\. ])?\(?\b[\dOlZSB]{3,5}([\-\. ]|\)
            ?)[\dOlZSB]{3}[\-\. ][\dOlZSB]{4}\b
        part: body
      - type: regex
        name: email_addresses
        regex:
          - \b[a-z0-9._%\+\-—|]+@[a-z0-9.\-—|]+\.[a-z|]{2,6}\b
        part: body
      - type: regex
        name: credit_card_3
        regex:
          - >-
            \b((4\d{3}|5[1-5]\d{2}|2\d{3}|3[47]\d{1,2})[\s\-]?\d{4,6}[\s\-]?\d{4,6}?([\s\-]\d{3,4})?(\d{3})?)\b
        part: body
      - type: regex
        name: amex_card
        regex:
          - \b3[47][0-9]{13}\b
        part: body
      - type: regex
        name: bcglobal
        regex:
          - \b(6541|6556)[0-9]{12}\b
        part: body
      - type: regex
        name: carte_blanche_card
        regex:
          - \b389[0-9]{11}\b
        part: body
      - type: regex
        name: diners_club_card
        regex:
          - \b3(?:0[0-5]|[68][0-9])[0-9]{11}\b
        part: body
      - type: regex
        name: discover_card
        regex:
          - >-
            \b65[4-9][0-9]{13}|64[4-9][0-9]{13}|6011[0-9]{12}|(622(?:12[6-9]|1[3-9][0-9]|[2-8][0-9][0-9]|9[01][0-9]|92[0-5])[0-9]{10})\b
        part: body
      - type: regex
        name: insta_payment_card
        regex:
          - \b63[7-9][0-9]{13}\b
        part: body
      - type: regex
        name: jcb_card
        regex:
          - \b(?:2131|1800|35\d{3})\d{11}\b
        part: body
      - type: regex
        name: korean_local_card
        regex:
          - \b9[0-9]{15}\b
        part: body
      - type: regex
        name: laser_card
        regex:
          - \b(6304|6706|6709|6771)[0-9]{12,15}\b
        part: body
      - type: regex
        name: maestro_card
        regex:
          - \b(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}\b
        part: body
      - type: regex
        name: mastercard
        regex:
          - >-
            \b(?:4[0-9]{12}(?:[0-9]{3})?|[25][1-7][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})\b
        part: body
      - type: regex
        name: solo_card
        regex:
          - \b(6334|6767)[0-9]{12}|(6334|6767)[0-9]{14}|(6334|6767)[0-9]{15}\b
        part: body
      - type: regex
        name: switch_card
        regex:
          - >-
            \b(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]
        part: body
      - type: regex
        name: argentina_national_identity_dni_number
        regex:
          - \d{2}\.\d{3}\.\d{3}
        part: body
      - type: regex
        name: canada_passport_id
        regex:
          - \b[\w]{2}[\d]{6}\b
        part: body
      - type: regex
        name: croatia_vat_id_card_number
        regex:
          - \bHR\d{11}\b
        part: body
      - type: regex
        name: czech_republic_vat_id_card_number
        regex:
          - \bCZ\d{8,10}\b
        part: body
      - type: regex
        name: denmark_personal_id_number
        regex:
          - \b\d{10}|\d{6}[-\s]\d{4}\b
        part: body
      - type: regex
        name: france_national_id_card_cni
        regex:
          - \b\d{12}\b
        part: body
      - type: regex
        name: france_social_security_number_insee
        regex:
          - \b\d{13}|\d{13}\s\d{2}\b
        part: body
      - type: regex
        name: france_passport_id
        regex:
          - \b\d{2}11\d{5}\b
        part: body
      - type: regex
        name: germany_id_card_number
        regex:
          - \bl\d{8}\b
        part: body
      - type: regex
        name: germany_passport_id
        regex:
          - \b[cfghjk]\d{3}\w{5}\d\b
        part: body
      - type: regex
        name: germany_drivers_license_id
        regex:
          - \b[\d\w]\d{2}[\d\w]{6}\d[\d\w]\b
        part: body
      - type: regex
        name: ireland_personal_public_service_pps_number
        regex:
          - \b\d{7}\w{1,2}\b
        part: body
      - type: regex
        name: netherlands_citizens_service_bsn_number
        regex:
          - \b\d{8}|\d{3}[-\.\s]\d{3}[-\.\s]\d{3}\b
        part: body
      - type: regex
        name: poland_national_id_pesel
        regex:
          - \b\d{11}\b
        part: body
      - type: regex
        name: portugal_citizen_card_number
        regex:
          - \d{9}[\w\d]{2}|\d{8}-\d[\d\w]{2}\d
        part: body
      - type: regex
        name: spain_social_security_number_ssn
        regex:
          - \b\d{2}\/?\d{8}\/?\d{2}\b
        part: body
      - type: regex
        name: spain_social_security_number_ssn_2
        regex:
          - \b\d{3}[ -.]\d{2}[ -.]\d{4}\b`
        part: body
      - type: regex
        name: sweden_passport_id
        regex:
          - \b\d{8}\b
        part: body
      - type: regex
        name: united_kingdom_passport_id
        regex:
          - \b\d{9}\b
        part: body
      - type: regex
        name: united_kingdom_drivers_license_id
        regex:
          - \b[\w9]{5}\d{6}[\w9]{2}\d{5}\b
        part: body
      - type: regex
        name: united_kingdom_national_health_service_nhs_number
        regex:
          - \b\d{3}\s\d{3}\s\d{4}\b
        part: body
      - type: regex
        name: ipv4
        regex:
          - >-
            (?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
        part: body
      - type: regex
        name: prices
        regex:
          - '[$]\s?[+-]?[0-9]{1,3}(?:(?:,?[0-9]{3}))*(?:\.[0-9]{1,2})?'
        part: body
      - type: regex
        name: hex_colors
        regex:
          - (#(?:[0-9a-fA-F]{8})|#(?:[0-9a-fA-F]{3}){1,2})\b
        part: body
      # - type: regex # PCRE
      #   name: credit_cards
      #   regex:
      #     - ((?:(?:\d{4}[- ]?){3}\d{4}|\d{15,16}))(?![\d])
      #   part: body
      - type: regex
        name: visa_cards
        regex:
          - 4\d{3}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}
        part: body
      - type: regex
        name: master_cards
        regex:
          - 5[1-5]\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}
        part: body
      # - type: regex # PCRE
      #   name: btc_addresses
      #   regex:
      #     - >-
      #       (?<![a-km-zA-HJ-NP-Z0-9])[13][a-km-zA-HJ-NP-Z0-9]{26,33}(?![a-km-zA-HJ-NP-Z0-9])
      #   part: body
      - type: regex
        name: ssn_number_3
        regex:
          - (?:\d{3}-\d{2}-\d{4})
        part: body
      - type: regex
        name: md5_hashes
        regex:
          - '[0-9a-fA-F]{32}'
        part: body
      - type: regex
        name: sha1_hashes
        regex:
          - '[0-9a-fA-F]{40}'
        part: body
      - type: regex
        name: sha256_hashes
        regex:
          - '[0-9a-fA-F]{64}'
        part: body
      - type: regex
        name: isbn13
        regex:
          - (?:[\d]-?){12}[\dxX]
        part: body
      - type: regex
        name: isbn10
        regex:
          - (?:[\d]-?){9}[\dxX]
        part: body
      - type: regex
        name: mac_addresses
        regex:
          - (([0-9a-fA-F]{2}[:-]){5}([0-9a-fA-F]{2}))
        part: body
      - type: regex
        name: iban_numbers
        regex:
          - '[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z\d]?){0,16}'
        part: body
      - type: regex
        name: git_repos
        regex:
          - >-
            ((git|ssh|http(s)?)|(git@[\w\.]+))(:(\/\/)?)([\w\.@\:/\-~]+)(\.git)(\/)?
        part: body
      - type: regex
        name: drivers_license_number_simplified
        regex:
          - ^[A-Z]{2}-\d{6}$
        part: body
      - type: regex
        name: passport_number_simplified_3
        regex:
          - ^[A-Z]\d{7}$
        part: body
      - type: regex
        name: social_security_number_ssn_3
        regex:
          - ^\d{3}-\d{2}-\d{4}$
        part: body
      - type: regex
        name: social_security_number_ssn_4
        regex:
          - (?:\\b\\d{3}-?\\d{2}-?(\\d{4})\\b)
        part: body
      - type: regex
        name: date_of_birth
        regex:
          - ^\d{2}/\d{2}/\d{4}$|^\d{4}-\d{2}-\d{2}$
        part: body
      - type: regex
        name: arista_network_configuration
        regex:
          - via\ \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3},\ \d{2}:\d{2}:\d{2}
        part: body
      - type: regex
        name: bbva_compass_routing_number_california
        regex:
          - ^321170538$
        part: body
      - type: regex
        name: bank_of_america_routing_numbers_california
        regex:
          - ^(?:121|026)00(?:0|9)(?:358|593)$
        part: body
      - type: regex
        name: box_links
        regex:
          - https://app.box.com/[s|l]/\S+
        part: body
      - type: regex
        name: cve_number
        regex:
          - CVE-\d{4}-\d{4,7}
        part: body
      - type: regex
        name: california_drivers_license
        regex:
          - ^[A-Z]{1}\d{7}$
        part: body
      - type: regex
        name: chase_routing_numbers_california
        regex:
          - ^322271627$
        part: body
      - type: regex
        name: cisco_router_config
        regex:
          - >-
            service\ timestamps\ [a-z]{3,5}\ datetime\
            msec|boot-[a-z]{3,5}-marker|interface\ [A-Za-z0-9]{0,10}[E,e]thernet
        part: body
      - type: regex
        name: citibank_routing_numbers_california
        regex:
          - ^32(?:11|22)71(?:18|72)4$
        part: body
      - type: regex
        name: dsa_private_key
        regex:
          - >-
            -----BEGIN DSA PRIVATE KEY-----(?:[a-zA-Z0-9\+\=\/"']|\s)+?-----END
            DSA PRIVATE KEY-----
        part: body
      - type: regex
        name: dropbox_links
        regex:
          - https://www.dropbox.com/(?:s|l)/\S+
        part: body
      - type: regex
        name: ec_private_key
        regex:
          - >-
            -----BEGIN (?:EC|ECDSA) PRIVATE
            KEY-----(?:[a-zA-Z0-9\+\=\/"']|\s)+?-----END (?:EC|ECDSA) PRIVATE
            KEY-----
        part: body
      - type: regex
        name: encrypted_dsa_private_key
        regex:
          - >-
            -----BEGIN DSA PRIVATE KEY-----\s.*,ENCRYPTED(?:.|\s)+?-----END DSA
            PRIVATE KEY-----
        part: body
      - type: regex
        name: encrypted_ec_private_key
        regex:
          - >-
            -----BEGIN (?:EC|ECDSA) PRIVATE
            KEY-----\s.*,ENCRYPTED(?:.|\s)+?-----END (?:EC|ECDSA) PRIVATE
            KEY-----
        part: body
      - type: regex
        name: encrypted_private_key
        regex:
          - >-
            -----BEGIN ENCRYPTED PRIVATE KEY-----(?:.|\s)+?-----END ENCRYPTED
            PRIVATE KEY-----
        part: body
      - type: regex
        name: encrypted_putty_ssh_dsa_key
        regex:
          - >-
            PuTTY-User-Key-File-2: ssh-dss\s*Encryption:
            aes(?:.|\s?)*?Private-MAC:
        part: body
      - type: regex
        name: encrypted_rsa_private_key
        regex:
          - >-
            -----BEGIN RSA PRIVATE KEY-----\s.*,ENCRYPTED(?:.|\s)+?-----END RSA
            PRIVATE KEY-----
        part: body
      - type: regex
        name: google_application_identifier
        regex:
          - '[0-9]+-\w+.apps.googleusercontent.com'
        part: body
      - type: regex
        name: hipaa_phi_national_drug_code
        regex:
          - ^\d{4,5}-\d{3,4}-\d{1,2}$
        part: body
      - type: regex
        name: huawei_config_file
        regex:
          - sysname\ HUAWEI|set\ authentication\ password\ simple\ huawei
        part: body
      - type: regex
        name: individual_taxpayer_identification_numbers_itin
        regex:
          - ^9\d{2}(?:[ \-]?)[7,8]\d(?:[ \-]?)\d{4}$
        part: body
      - type: regex
        name: john_the_ripper
        regex:
          - >-
            [J,j]ohn\ [T,t]he\ [R,r]ipper|john-[1-9].[1-9].[1-9]|Many\
            salts:|Only\ one\
            salt:|openwall.com/john/|List.External:[0-9a-zA-Z]*|Loaded\ [0-9]*\
            password hash|guesses:\ \d*\ \ time:\
            \d*:\d{2}:\d{2}:\d{2}|john\.pot
        part: body
      - type: regex
        name: keepass_1x_csv_passwords
        regex:
          - '"Account","Login Name","Password","Web Site","Comments"'
        part: body
      - type: regex
        name: keepass_1x_xml_passwords
        regex:
          - >-
            <pwlist>\s*?<pwentry>[\S\s]*?<password>[\S\s]*?<\/pwentry>\s*?<\/pwlist>
        part: body
      - type: regex
        name: large_number_of_us_phone_numbers
        regex:
          - \d{3}-\d{3}-\d{4}|\(\d{3}\)\ ?\d{3}-?\d{4}
        part: body
      - type: regex
        name: large_number_of_us_zip_codes
        regex:
          - ^(\d{5}-\d{4}|\d{5})$
        part: body
      - type: regex
        name: lightweight_directory_access_protocol
        regex:
          - (?:dn|cn|dc|sn):\s*[a-zA-Z0-9=, ]*
        part: body
      - type: regex
        name: metasploit_module
        regex:
          - >-
            require\ 'msf/core'|class\ Metasploit|include\
            Msf::Exploit::\w+::\w+
        part: body
      - type: regex
        name: mysql_database_dump
        regex:
          - >-
            DROP DATABASE IF EXISTS(?:.|\n){5,300}CREATE
            DATABASE(?:.|\n){5,300}DROP TABLE IF EXISTS(?:.|\n){5,300}CREATE
            TABLE
        part: body
      - type: regex
        name: mysqlite_database_dump
        regex:
          - >-
            DROP\ TABLE\ IF\ EXISTS\ \[[a-zA-Z]*\];|CREATE\ TABLE\
            \[[a-zA-Z]*\];
        part: body
      - type: regex
        name: network_proxy_autoconfig
        regex:
          - proxy\.pac|function\ FindProxyForURL\(\w+,\ \w+\)
        part: body
      - type: regex
        name: nmap_scan_report
        regex:
          - Nmap\ scan\ report\ for\ [a-zA-Z0-9.]+
        part: body
      - type: regex
        name: pgp_header
        regex:
          - '-{5}(?:BEGIN|END)\ PGP\ MESSAGE-{5}'
        part: body
      - type: regex
        name: pgp_private_key_block
        regex:
          - >-
            -----BEGIN PGP PRIVATE KEY BLOCK-----(?:.|\s)+?-----END PGP PRIVATE
            KEY BLOCK-----
        part: body
      - type: regex
        name: pkcs7_encrypted_data
        regex:
          - >-
            (?:Signer|Recipient)Info(?:s)?\ ::=\
            \w+|[D|d]igest(?:Encryption)?Algorithm|EncryptedKey\ ::= \w+
        part: body
      - type: regex
        name: password_etc_passwd
        regex:
          - >-
            [a-zA-Z0-9\-]+:[x|\*]:\d+:\d+:[a-zA-Z0-9/\-
            "]*:/[a-zA-Z0-9/\-]*:/[a-zA-Z0-9/\-]+
        part: body
      - type: regex
        name: password_etc_shadow
        regex:
          - >-
            [a-zA-Z0-9\-]+:(?:(?:!!?)|(?:\*LOCK\*?)|\*|(?:\*LCK\*?)|(?:\$.*\$.*\$.*?)?):\d*:\d*:\d*:\d*:\d*:\d*:
        part: body
      - type: regex
        name: plaintext_private_key
        regex:
          - '-----BEGIN PRIVATE KEY-----(?:.|\s)+?-----END PRIVATE KEY-----'
        part: body
      - type: regex
        name: putty_ssh_dsa_key
        regex:
          - >-
            PuTTY-User-Key-File-2: ssh-dss\s*Encryption:
            none(?:.|\s?)*?Private-MAC:
        part: body
      - type: regex
        name: putty_ssh_rsa_key
        regex:
          - >-
            PuTTY-User-Key-File-2: ssh-rsa\s*Encryption:
            none(?:.|\s?)*?Private-MAC:
        part: body
      - type: regex
        name: public_key_cryptography_system_pkcs
        regex:
          - protocol="application/x-pkcs[0-9]{0,2}-signature"
        part: body
      - type: regex
        name: public_encrypted_key
        regex:
          - '-----BEGIN PUBLIC KEY-----(?:.|\s)+?-----END PUBLIC KEY-----'
        part: body
      - type: regex
        name: rsa_private_key
        regex:
          - >-
            -----BEGIN RSA PRIVATE KEY-----(?:[a-zA-Z0-9\+\=\/"']|\s)+?-----END
            RSA PRIVATE KEY-----
        part: body
      - type: regex
        name: ssl_certificate
        regex:
          - '-----BEGIN CERTIFICATE-----(?:.|\n)+?\s-----END CERTIFICATE-----'
        part: body
      - type: regex
        name: swift_codes
        regex:
          - '[A-Za-z]{4}(?:GB|US|DE|RU|CA|JP|CN)[0-9a-zA-Z]{2,5}$'
        part: body
      - type: regex
        name: samba_password_config_file
        regex:
          - '[a-z]*:\d{3}:[0-9a-zA-Z]*:[0-9a-zA-Z]*:\[U\ \]:.*'
        part: body
      - type: regex
        name: slack_2fa_backup_codes
        regex:
          - >-
            Two-Factor\s*\S*Authentication\s*\S*Backup\s*\S*Codes(?:.|\n)*[Ss]lack(?:.|\n)*\d{9}
        part: body
      - type: regex
        name: uk_drivers_license_numbers
        regex:
          - '[A-Z]{5}\d{6}[A-Z]{2}\d{1}[A-Z]{2}'
        part: body
      - type: regex
        name: uk_passport_number
        regex:
          - \d{10}GB[RP]\d{7}[UMF]{1}\d{9}
        part: body
      - type: regex
        name: usbank_routing_numbers_california
        regex:
          - ^12(?:1122676|2235821)$
        part: body
      - type: regex
        name: united_bank_routing_number_california
        regex:
          - ^122243350$
        part: body
      - type: regex
        name: wells_fargo_routing_numbers_california
        regex:
          - ^121042882$
        part: body
      - type: regex
        name: aws_access_key
        regex:
          - >-
            ((access[-_]?key[-_]?id)|(ACCESS[-_]?KEY[-_]?ID)|([Aa]ccessKeyId)|(access[_-]?id)).{0,20}AKIA[a-zA-Z0-9+/]{16}[^a-zA-Z0-9+/]
        part: body
      - type: regex
        name: aws_credentials_context
        regex:
          - access_key_id|secret_access_key|AssetSync.configure
        part: body
      - type: regex
        name: aws_secret_key
        regex:
          - >-
            ((secret[-_]?access[-_]?key)|(SECRET[-_]?ACCESS[-_]?KEY|(private[-_]?key))|([Ss]ecretAccessKey)).{0,20}[^a-zA-Z0-9+/][a-zA-Z0-9+/]{40}\b
        part: body
      - type: regex
        name: facebook_secret
        regex:
          - >-
            (facebook_secret|FACEBOOK_SECRET|facebook_app_secret|FACEBOOK_APP_SECRET)[a-z_
            =\s"'\:]{0,5}[^a-zA-Z0-9][a-f0-9]{32}[^a-zA-Z0-9]
        part: body
      - type: regex
        name: github_key
        regex:
          - >-
            (GITHUB_SECRET|GITHUB_KEY|github_secret|github_key|github_token|GITHUB_TOKEN|github_api_key|GITHUB_API_KEY)[a-z_
            =\s"'\:]{0,10}[^a-zA-Z0-9][a-zA-Z0-9]{40}[^a-zA-Z0-9]
        part: body
      - type: regex
        name: google_two_factor_backup
        regex:
          - (?:BACKUP VERIFICATION CODES|SAVE YOUR BACKUP CODES)[\s\S]{0,300}@
        part: body
      - type: regex
        name: heroku_key
        regex:
          - >-
            (heroku_api_key|HEROKU_API_KEY|heroku_secret|HEROKU_SECRET)[a-z_
            =\s"'\:]{0,10}[^a-zA-Z0-9-]\w{8}(?:-\w{4}){3}-\w{12}[^a-zA-Z0-9\-]
        part: body
      - type: regex
        name: microsoft_office_365_oauth_context
        regex:
          - >-
            https://login.microsoftonline.com/common/oauth2/v2.0/token|https://login.windows.net/common/oauth2/token
        part: body
      - type: regex
        name: pgsql_connection_information
        regex:
          - (?:postgres|pgsql)\:\/\/
        part: body
      - type: regex
        name: slack_api_key
        regex:
          - >-
            (slack_api_key|SLACK_API_KEY|slack_key|SLACK_KEY)[a-z_
            =\s"'\:]{0,10}[^a-f0-9][a-f0-9]{32}[^a-f0-9]
        part: body
      - type: regex
        name: slack_api_token
        regex:
          - (xox[pb](?:-[a-zA-Z0-9]+){4,})
        part: body
      - type: regex
        name: ssh_dss_public
        regex:
          - ssh-dss [0-9A-Za-z+/]+[=]{2}
        part: body
      - type: regex
        name: ssh_rsa_public
        regex:
          - ssh-rsa AAAA[0-9A-Za-z+/]+[=]{0,3} [^@]+@[^@]+
        part: body
      - type: regex
        name: iban
        regex:
          - '[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}'
        part: body
      - type: regex
        name: gps_data
        regex:
          - >-
            ^([-+]?)([\d]{1,2})(((\.)(\d+)(,)))(\s*)(([-+]?)([\d]{1,3})((\.)(\d+))?)
        part: body
      - type: regex
        name: blood_type
        regex:
          - ^(A|B|AB|O)[-+]$
        part: body
      - type: regex
        name: date_of_birth_2
        regex:
          - >-
            ^([1-9]|[12][0-9]|3[01])(\/?\.\-?\-?\s?)(0[1-9]|1[12])(\/?\.?\-?\s?)(19[0-9][0-9]|20[0][0-9]|20[1][0-8])$
        part: body
      - type: regex
        name: tax_number
        regex:
          - ^[0-9]{10}$
        part: body
      - type: regex
        name: bitcoin_address
        regex:
          - ^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$
        part: body
# digest: 4b0a00483046022100d63de2699bec3baaa0fdd73007ada827841684a4c85e848aa3c271b5ff520b5d02210087f9006b805eead3e13c8ecb610d9eeb6f1535e3001e5f7545f87bdf54208ca4:922c64590222798bb761d5b6d8e72950