Ghost/.secretlintrc.json at main · TryGhost/Ghost · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
{
  "rules": [
    {
      "id": "@secretlint/secretlint-rule-preset-recommend",
      "rules": [
        {
          "id": "@secretlint/secretlint-rule-privatekey",
          "options": {
            "allows": [
              "/MIICWwIBAAKBgQCea7oriNoFgxnY/",
              "/MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCYhlD7QVSExM/"
            ]
          }
        },
        {
          "id": "@secretlint/secretlint-rule-stripe",
          "options": {
            "allows": [
              "rk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ",
              "sk_live_abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"
            ]
          }
        }
      ]
    },
    {
      "id": "@secretlint/secretlint-rule-pattern",
      "options": {
        "patterns": [
          {
            "name": "Tinybird token",
            "patterns": ["/\\b(?<CREDENTIAL>p\\.eyJ[A-Za-z0-9_-]{15,}\\.[A-Za-z0-9_-]{20,})\\b/"]
          },
          {
            "name": "credential in URL query string",
            "patterns": [
              "/[?&](?:token|api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret|password)=(?<CREDENTIAL>(?!p\\.|\\$\\{)[^&\\s\"'<>]{16,})/i"
            ]
          },
          {
            "name": "credential assignment",
            "patterns": [
              "/(?:^|[\\s{\"',])\\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?key|password)\\b\\s*[:=]\\s*[\"']?(?<CREDENTIAL>[A-Za-z0-9_./+=:-]{20,})[\"']?/i"
            ],
            "allows": [
              "/attempt-to-change-via-edit/",
              "/mynewfancypasswordwhichisnotallowed/",
              "/scriptTag\\.dataset\\.key/",
              "/69010382388f9de5869ad6e558/",
              "/process\\.env\\./",
              "/this\\._settingsCache\\.get/",
              "/this\\.options\\.password/",
              "/signupDetails\\.password/"
            ]
          },
          {
            "name": "authorization header",
            "patterns": [
              "/\\bAuthorization\\s*:\\s*(?:Bearer|Basic)\\s+(?<CREDENTIAL>[A-Za-z0-9_./+=:-]{20,})/i"
            ]
          }
        ]
      }
    }
  ]
}