# Push protection's rules (hub spec §15.4, oxygenhub#268), compiled into

# the hub. Each rule:

#

#   id          stable name, part of every fingerprint: never reuse one

#   description what a refusal calls it

#   regex       Rust `regex` syntax, matched on bytes; the capture group

#               named `secret`, when there is one, is the secret, else the

#               whole match

#   keywords    optional prefilter: the regex runs on a text only when one

#               of these occurs in it (case-insensitive)

#   requires    optional: a regex the same file or inserted text must also

#               match somewhere, for secrets that are only one when paired

#

# Rules are tried in order and a match overlapping an earlier rule's is

# dropped, so the specific rules come before the general ones. Bump

# `version` whenever a rule is added, changed or removed.

version = 1

[[rule]]

id = "gcp-service-account"

description = "Google Cloud service account key"

keywords = ["service_account"]

regex = '''"private_key"\s*:\s*"(?P<secret>-----BEGIN[^"]{40,})"'''

requires = '''"type"\s*:\s*"service_account"'''

[[rule]]

id = "aws-access-key-id"

description = "AWS access key ID"

keywords = ["akia", "asia", "abia", "acca"]

regex = '''\b(?P<secret>(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\b'''

[[rule]]

id = "aws-secret-access-key"

description = "AWS secret access key"

keywords = ["aws", "secret"]

regex = '''(?im)(?:aws|secret)[a-z0-9_ .\-]{0,30}['"]?\s*[:=]\s*['"]?(?P<secret>[A-Za-z0-9/+]{40})(?:[^A-Za-z0-9/+=]|$)'''

requires = '''\b(?:AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16}\b'''

[[rule]]

id = "azure-storage-connection-string"

description = "Azure storage account connection string"

keywords = ["accountkey="]

regex = '''(?i)DefaultEndpointsProtocol=https?;AccountName=[A-Za-z0-9]+;AccountKey=(?P<secret>[A-Za-z0-9+/]{40,}={0,2})'''

[[rule]]

id = "github-token"

description = "GitHub token"

keywords = ["ghp_", "gho_", "ghu_", "ghs_", "ghr_"]

regex = '''\b(?P<secret>gh[pousr]_[A-Za-z0-9]{36,255})\b'''

[[rule]]

id = "github-fine-grained-token"

description = "GitHub fine-grained personal access token"

keywords = ["github_pat_"]

regex = '''\b(?P<secret>github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59})\b'''

[[rule]]

id = "gitlab-token"

description = "GitLab personal access token"

keywords = ["glpat-"]

regex = '''\b(?P<secret>glpat-[A-Za-z0-9_\-.]{20,})'''

[[rule]]

id = "oxygenhub-token"

description = "OxygenHub personal access token"

keywords = ["oxyhub_"]

regex = '''\b(?P<secret>oxyhub_[0-9a-f]{64})\b'''

[[rule]]

id = "oxygenhub-agent-grant"

description = "OxygenHub agent grant token"

keywords = ["oxyagent_"]

regex = '''\b(?P<secret>oxyagent_[0-9a-f]{64})\b'''

[[rule]]

id = "oxygenflow-job-token"

description = "OxygenFlow job token"

keywords = ["flowjob_"]

regex = '''\b(?P<secret>flowjob_[0-9a-f]{64})\b'''

[[rule]]

id = "oxygenflow-runner-credential"

description = "OxygenFlow runner credential"

keywords = ["flowrunner_"]

regex = '''\b(?P<secret>flowrunner_[0-9a-f]{64})\b'''

[[rule]]

id = "oxygenflow-registration-token"

description = "OxygenFlow runner registration token"

keywords = ["flowreg_"]

regex = '''\b(?P<secret>flowreg_[0-9a-f]{48})\b'''

[[rule]]

id = "slack-token"

description = "Slack token"

keywords = ["xoxb-", "xoxa-", "xoxp-", "xoxr-", "xoxs-"]

regex = '''\b(?P<secret>xox[baprs]-[A-Za-z0-9-]{10,})'''

[[rule]]

id = "stripe-live-key"

description = "Stripe live secret key"

keywords = ["sk_live_", "rk_live_"]

regex = '''\b(?P<secret>[rs]k_live_[A-Za-z0-9]{24,})\b'''

[[rule]]

id = "openssh-private-key"

description = "OpenSSH private key"

keywords = ["openssh private key"]

regex = '''(?P<secret>-----BEGIN[ ]OPENSSH[ ]PRIVATE[ ]KEY-----[\s\S]{40,}?-----END[ ]OPENSSH[ ]PRIVATE[ ]KEY-----)'''

[[rule]]

id = "private-key"

description = "PEM private key"

keywords = ["private key"]

regex = '''(?P<secret>-----BEGIN[ ](?:[A-Z0-9]+[ ])*PRIVATE[ ]KEY-----[\s\S]{40,}?-----END[ ](?:[A-Z0-9]+[ ])*PRIVATE[ ]KEY-----)'''