generic.secrets.security.detected-github-token.detected-github-token

rules:
  - id: detected-github-token
    patterns:
      - pattern-either:
          - pattern: |
              $VAR = $SECRET
          - pattern: |
              $VAR: $SECRET
          - pattern: |
              $VAR = '$SECRET'
          - pattern: |
              $VAR: '$SECRET'
          - pattern: |
              '$VAR' = '$SECRET'
          - pattern: |
              '$VAR': '$SECRET'
          - pattern: |
              "[hH][tT][tT][pP][sS]?://.*$SECRET.*"
      - metavariable-regex:
          metavariable: $SECRET
          regex: gh[pousr]_[A-Za-z0-9_]{36,251}
      - metavariable-analysis:
          analyzer: entropy
          metavariable: $SECRET
    languages:
      - generic
    message: GitHub Token detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      source-rule-url: https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
      category: security
      technology:
        - secrets
        - github
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: MEDIUM
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets