Repository navigation
Expand file tree
/
Copy path.betterleaks.toml
More file actions
101 lines (91 loc) · 4.26 KB
/
Copy path.betterleaks.toml
File metadata and controls
101 lines (91 loc) · 4.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
<
8000
div data-line-number="41" class="react-line-number react-code-text" style="padding-right:16px">4142
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
# Canonical org-wide betterleaks config for the Security Suite. SINGLE SOURCE
# OF TRUTH: this is the one betterleaks ruleset the org maintains.
#
# How it is used:
# * Per-PR secret-leak gate (reusable-secret-leak-check.yml): fetched as the
# centralized fallback when a caller repo ships no .betterleaks.toml. Every
# detector stays on (useDefault = true); the allowlist below only removes
# universal, non-secret false-positive patterns (doc placeholders and
# generated build artifacts).
# * Weekly org-wide audit (geolonia-operations/secret-leak-audit.yml): extends
# THIS file and additionally disables generic-api-key, which is dominated by
# history noise across full-history scans. That is a one-line delta, not a
# separate ruleset, so the rules and allowlist live here only.
# * A repo overrides everything by committing its own .betterleaks.toml.
#
# Editing rules:
# * Keep useDefault = true. This file holds ONLY universal, non-secret
# false-positive patterns: unmistakable documentation placeholders and
# generated build artifacts. Never allowlist a real secret; rotate and
# remove it instead.
# * Do NOT add project-specific token exceptions here, not even public,
# client-side tokens (for example a Mapbox pk. token). Those are a
# repo-level decision: the owning repo commits its own .betterleaks.toml so
# its maintainers own the exception and it is not granted org-wide. This
# file is public, so an org-wide token exception would also expose that
# decision (and often the value) to everyone.
# * Allowlists match against the captured Secret value unless regexTarget is
# set, so a regex should describe just the literal placeholder.
title = "Geolonia organization betterleaks baseline"
[extend]
useDefault = true
[[allowlists]]
description = "YOUR_API_KEY / YOUR-API-KEY / YOUR_TOKEN family (API docs templates)"
regexes = [
'''(?i)\bYOUR[-_](API[-_]?KEY|TOKEN|SECRET|CLIENT[-_]?(ID|SECRET))\b''',
]
[[allowlists]]
description = "Angle-bracket placeholders: <your-token>, <api-key>, <endpoint-url> (incl. Japanese)"
regexes = [
# Inner-char ranges: ASCII letter | Hiragana | Katakana | CJK Unified Ideographs
'''<[A-Za-z\x{3040}-\x{309F}\x{30A0}-\x{30FF}\x{4E00}-\x{9FFF}][^>]{1,60}>''',
]
[[allowlists]]
description = "Famous example UUIDs used in API docs"
regexes = [
'''(?i)550e8400-e29b-41d4-a716-446655440000''',
'''00000000-0000-0000-0000-000000000000''',
'''(?i)deadbeef-dead-beef-dead-beefdeadbeef''',
]
[[allowlists]]
description = "Standard placeholder words: REPLACE_ME / EXAMPLE / PLACEHOLDER / CHANGEME"
regexes = [
'''(?i)\b(REPLACE[-_]?ME|CHANGE[-_]?ME|PLACEHOLDER|EXAMPLE[-_]?(KEY|TOKEN|SECRET)?|FAKE[-_]?(KEY|TOKEN|SECRET)?|SAMPLE[-_]?(KEY|TOKEN|SECRET)?)\b''',
]
[[allowlists]]
description = "Obvious dev / test scaffold tokens (must include credential context)"
regexes = [
'''(?i)\bdev[-_]?local[-_]?token[-_]?please[-_]?change\b''',
'''(?i)\b(test|sample|dummy|dev|stub)[-_]?(token|key|secret|password)[-_]?(here|value)?\b''',
]
[[allowlists]]
description = "Truncated JWT placeholder in docs (eyJ... ending in literal '...' ellipsis)"
regexes = [
# Matches the docs convention of showing a JWT prefix followed by a
# literal three-dot ellipsis. Real JWTs are never written that way.
'''eyJ[A-Za-z0-9_\-]{8,}\.\.\.''',
]
[[allowlists]]
description = "Basic-auth label pair literal: client_id:client_secret"
regexes = [
# Appears in OAuth docs and test fixtures across the org as the
# `-u "client_id:client_secret"` curl flag or
# `Buffer.from('client-id:client-secret').toString('base64')` in
# tests. Real Basic-auth credentials are never the words themselves.
'''(?i)\bclient[-_]id:client[-_]secret\b''',
]
[[allowlists]]
description = "Minified bundles, source maps, and webpack bundle-stats output"
paths = [
# Content hashes inside generated build output get flagged as
# high-entropy tokens (sourcegraph-access-token in particular fires
# on 40-char hex SHA1s, which is exactly what webpack emits as
# content-addressing identifiers). We never hand-edit these files,
# so anything they contain is by definition not a hand-typed
# credential.
'''\.min\.js$''',
'''\.min\.js\.map$''',
'''\.min\.css$''',
'''\.min\.css\.map$''',
'''(?:^|/)bundle-stats\.json$''',
]