generic.secrets.security.detected-generic-api-key.detected-generic-api-key
semgrep
Author
5,361
Download Count*
License
Generic API Key detected
Run Locally
Run in CI
Defintion
rules:
- id: detected-generic-api-key
patterns:
- pattern-regex: "[aA][pP][iI]_?[kK][eE][yY][=_:\\s-]+['|\"]?(?<SECRET>[0-9a-zA-Z\
]{32,45})['|\"]?"
- metavariable-analysis:
analyzer: entropy
metavariable: $SECRET
languages:
- regex
message: Generic API Key detected
severity: ERROR
metadata:
source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
category: security
technology:
- secrets
confidence: LOW
references:
- https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
owasp:
- A07:2021 - Identification and Authentication Failures
cwe:
- "CWE-798: Use of Hard-coded Credentials"
cwe2022-top25: true
cwe2021-top25: true
subcategory:
- audit
likelihood: LOW
impact: MEDIUM
license: Commons Clause License Condition v1.0[LGPL-2.1-only]
vulnerability_class:
- Hard-coded Secrets
Examples
detected-generic-api-key.txt
# ruleid: detected-generic-api-key
api_key=1234567890123456789012345678901234567890
# ruleid: detected-generic-api-key
APIKEY : 123567890123456789012345678901234567890
# ruleid: detected-generic-api-key
APIKEY - 123567890123456789012345678901234567890
# ruleid: detected-generic-api-key
APIKEY 123567890123456789012345678901234567890
# ruleid: detected-generic-api-key
APIKEY="123567890123456789012345678901234567890"
# ok: detected-generic-api-key
ApiKeyGenerator.generateApiKeySomeLongMethodName();
# ok: detected-generic-api-key
ApiKey=
VirtualgenerateApiKeySomeLongMethodName=
Short Link: https://sg.run/qxj8