generic.secrets.security.detected-generic-api-key.detected-generic-api-key

profile photo of semgrepsemgrep
Author
5,361
Download Count*

Generic API Key detected

Run Locally

Run in CI

Defintion

rules:
  - id: detected-generic-api-key
    patterns:
      - pattern-regex: "[aA][pP][iI]_?[kK][eE][yY][=_:\\s-]+['|\"]?(?<SECRET>[0-9a-zA-Z\
          ]{32,45})['|\"]?"
      - metavariable-analysis:
          analyzer: entropy
          metavariable: $SECRET
    languages:
      - regex
    message: Generic API Key detected
    severity: ERROR
    metadata:
      source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
      category: security
      technology:
        - secrets
      confidence: LOW
      references:
        - https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
      owasp:
        - A07:2021 - Identification and Authentication Failures
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets

Examples

detected-generic-api-key.txt

# ruleid: detected-generic-api-key
api_key=1234567890123456789012345678901234567890

# ruleid: detected-generic-api-key
APIKEY : 123567890123456789012345678901234567890

# ruleid: detected-generic-api-key
APIKEY - 123567890123456789012345678901234567890

# ruleid: detected-generic-api-key
APIKEY  123567890123456789012345678901234567890

# ruleid: detected-generic-api-key
APIKEY="123567890123456789012345678901234567890"

# ok: detected-generic-api-key
ApiKeyGenerator.generateApiKeySomeLongMethodName();

# ok: detected-generic-api-key
ApiKey=
VirtualgenerateApiKeySomeLongMethodName=