Skip to content
Vulnetix DocsSAST

Secret rules: SaaS & Developer APIs

Atlassian, Notion, Linear, Airtable, Shopify, Figma, Vercel, Netlify and other SaaS tokens.

Updated 02 Nov 2026Checked against cli@de9b52a

433 rules, kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan, not under vulnetix sast. Each is generated from one entry in internal/sast/secretsgen/catalog.json.

Detection: keyword means the pattern is tried only on lines that contain one of the listed keywords (case-insensitive); entropy means the matched token must also reach the entry’s minimum Shannon entropy. Every catalog rule skips test files, lockfiles, minified and generated files, and paths under testdata/, fixtures/, vendor/, node_modules/, dist/, build/ and src/test/ (the skip_path list in internal/sast/rules/lib_secrets.rego), and documented example tokens.

Rule ID Name Severity Detection Keywords CWE
VNX-SEC-090 Figma personal access token (figd_) Critical keyword + regex figd_ CWE-798
VNX-SEC-091 Vercel API token (vc*_) Critical keyword + regex vcp_ vci_ vca_ vcr_ vck_ CWE-798
VNX-SEC-092 Netlify API token (nf*_) Critical keyword + regex nfp_ nfc_ nfo_ nfu_ nfb_ CWE-798
VNX-SEC-093 HubSpot private app token (pat-) Critical keyword + regex pat-na1- pat-eu1- CWE-798
VNX-SEC-094 Canva client secret (cnvca) Critical keyword + regex cnvca CWE-798
VNX-SEC-100 Linear API key (lin_api_) High keyword + regex lin_api_ CWE-798
VNX-SEC-481 Auth0 client secret Critical keyword + regex + entropy auth0 secret CWE-798
VNX-SEC-482 Auth0 Management API token (JWT) Critical keyword + regex + entropy auth0 eyj CWE-798
VNX-SEC-483 Okta SSWS API token Critical keyword + regex ssws CWE-798
VNX-SEC-484 Okta API token (00 prefix) Critical keyword + regex + entropy okta token CWE-798
VNX-SEC-485 Clerk secret key (live) Critical keyword + regex sk_live_ CWE-798
VNX-SEC-486 Clerk secret key (test) High keyword + regex sk_test_ CWE-798
VNX-SEC-487 Clerk publishable key (live) Medium keyword + regex pk_live_ CWE-798
VNX-SEC-488 WorkOS API key (live) Critical keyword + regex sk_live_ CWE-798
VNX-SEC-489 WorkOS API key (test) High keyword + regex sk_test_ CWE-798
VNX-SEC-490 Stytch secret (live) Critical keyword + regex secret-live- CWE-798
VNX-SEC-491 Stytch secret (test) High keyword + regex secret-test- CWE-798
VNX-SEC-492 Supabase service_role JWT Critical keyword + regex + entropy service_role eyj CWE-798
VNX-SEC-493 Supabase anon JWT Medium keyword + regex + entropy anon eyj CWE-798
VNX-SEC-494 Supabase access token (sbp_) Critical keyword + regex sbp_ CWE-798
VNX-SEC-495 Contentful Content Management token (CFPAT-) Critical keyword + regex cfpat- CWE-798
VNX-SEC-496 Contentful Content Delivery API token Medium keyword + regex + entropy contentful delivery CWE-798
VNX-SEC-497 Contentful Content Preview API token High keyword + regex + entropy contentful preview CWE-798
VNX-SEC-498 Sanity API token (sk) High keyword + regex + entropy sanity token CWE-798
VNX-SEC-499 Storyblok personal access token High keyword + regex + entropy storyblok token CWE-798
VNX-SEC-500 Algolia admin API key Critical keyword + regex + entropy algolia key CWE-798
VNX-SEC-501 Typesense API key High keyword + regex + entropy typesense key CWE-798
VNX-SEC-502 Meilisearch master/API key Critical keyword + regex + entropy meili key CWE-798
VNX-SEC-503 Typeform personal access token (tfp_) High keyword + regex tfp_ CWE-798
VNX-SEC-504 Calendly personal access token High keyword + regex + entropy calendly eyj CWE-798
VNX-SEC-505 Webflow API token High keyword + regex + entropy webflow token CWE-798
VNX-SEC-506 Framer API token High keyword + regex + entropy framer token CWE-798
VNX-SEC-507 Retool API token Critical keyword + regex + entropy retool token CWE-798
VNX-SEC-508 Asana personal access token (1/) High keyword + regex 1/ CWE-798
VNX-SEC-509 Asana personal access token (2/) High keyword + regex 2/ CWE-798
VNX-SEC-510 monday.com API token (JWT) High keyword + regex + entropy monday eyj CWE-798
VNX-SEC-511 ClickUp personal API token (pk_) High keyword + regex pk_ CWE-798
VNX-SEC-512 Trello API key Medium keyword + regex + entropy trello key CWE-798
VNX-SEC-513 Trello API token High keyword + regex + entropy trello token CWE-798
VNX-SEC-514 Miro access token High keyword + regex + entropy miro token CWE-798
VNX-SEC-515 Loom API key Medium keyword + regex + entropy loom key CWE-798
VNX-SEC-516 Dropbox short-lived access token (sl.) High keyword + regex sl. CWE-798
VNX-SEC-517 Dropbox long-lived access token Critical keyword + regex + entropy dropbox token CWE-798
VNX-SEC-518 Box developer token High keyword + regex + entropy box token CWE-798
VNX-SEC-519 Zoom Server-to-Server OAuth client secret Critical keyword + regex + entropy zoom secret CWE-798
VNX-SEC-520 Zoom JWT app token High keyword + regex + entropy zoom eyj CWE-798
VNX-SEC-521 DocuSign integration secret key Critical keyword + regex + entropy docusign secret CWE-798
VNX-SEC-522 Dropbox Sign (HelloSign) API key Critical keyword + regex + entropy hellosign key CWE-798
VNX-SEC-523 Adobe IMS client secret Critical keyword + regex + entropy adobe p8e- CWE-798
VNX-SEC-524 Salesforce consumer key (3MVG9) High keyword + regex 3mvg9 CWE-798
VNX-SEC-525 Salesforce refresh token (5Aep861) Critical keyword + regex 5aep861 CWE-798
VNX-SEC-526 ServiceNow credentials High keyword + regex + entropy servicenow secret CWE-798
VNX-SEC-527 Zoho OAuth token (1000.) High keyword + regex 1000. CWE-798
VNX-SEC-528 Freshservice/Freshworks API key High keyword + regex + entropy fresh key CWE-798
VNX-SEC-529 Pipedrive API token High keyword + regex + entropy pipedrive token CWE-798
VNX-SEC-530 Close API key High keyword + regex api_ CWE-798
VNX-SEC-531 Copper API key High keyword + regex + entropy copper key CWE-798
VNX-SEC-532 Segment write key Medium keyword + regex + entropy segment key CWE-798
VNX-SEC-533 LaunchDarkly SDK key (sdk-) High keyword + regex sdk- CWE-798
VNX-SEC-534 LaunchDarkly API access token (api-) Critical keyword + regex api- CWE-798
VNX-SEC-535 LaunchDarkly mobile key (mob-) Medium keyword + regex mob- CWE-798
VNX-SEC-536 Split.io API key High keyword + regex + entropy split key CWE-798
VNX-SEC-537 Statsig server secret key (secret-) High keyword + regex secret- CWE-798
VNX-SEC-538 Unleash API token High keyword + regex + entropy unleash token CWE-798
VNX-SEC-539 Optimizely SDK/API token High keyword + regex + entropy optimizely token CWE-798
VNX-SEC-540 PostHog personal API key (phx_) Critical keyword + regex phx_ CWE-798
VNX-SEC-541 PostHog project API key (phc_) Medium keyword + regex phc_ CWE-798
VNX-SEC-542 Mixpanel API secret High keyword + regex + entropy mixpanel secret CWE-798
VNX-SEC-543 Mixpanel service account secret Critical keyword + regex + entropy mixpanel service CWE-798
VNX-SEC-544 Amplitude API key Medium keyword + regex + entropy amplitude key CWE-798
VNX-SEC-545 Amplitude secret key High keyword + regex + entropy amplitude secret CWE-798
VNX-SEC-546 Pendo integration key High keyword + regex + entropy pendo key CWE-798
VNX-SEC-547 Heap app ID / API key Medium keyword + regex + entropy heap key CWE-798
VNX-SEC-548 FullStory API key High keyword + regex + entropy fullstory key CWE-798
VNX-SEC-549 Hotjar API key Medium keyword + regex + entropy hotjar key CWE-798
VNX-SEC-550 Smartsheet API access token High keyword + regex + entropy smartsheet token CWE-798
VNX-SEC-551 WorkOS publishable key Medium keyword + regex client_ CWE-798
VNX-SEC-552 Okta client secret Critical keyword + regex + entropy okta secret CWE-798
VNX-SEC-553 Auth0 API key/token (generic) High keyword + regex + entropy auth0 key CWE-798
VNX-SEC-554 Sanity project token (keyword) High keyword + regex + entropy sanity key CWE-798
VNX-SEC-555 Algolia search/usage key (keyword) Medium keyword + regex + entropy algolia key CWE-798
VNX-SEC-556 Statsig console API key (console-) Critical keyword + regex console- CWE-798
VNX-SEC-557 Meilisearch tenant token (JWT) Medium keyword + regex + entropy meili eyj CWE-798
VNX-SEC-558 Contentful management token (keyword) Critical keyword + regex + entropy contentful management CWE-798
VNX-SEC-559 Calendly OAuth client secret High keyword + regex + entropy calendly secret CWE-798
VNX-SEC-560 Webflow site API token (Bearer keyword) High keyword + regex + entropy webflow bearer CWE-798
VNX-SEC-675 Twitch client ID Medium keyword + regex + entropy twitch client id CWE-798
VNX-SEC-676 Twitch client secret High keyword + regex + entropy twitch client secret CWE-798
VNX-SEC-677 Twitch OAuth access token (oauth:) High keyword + regex oauth: twitch CWE-798
VNX-SEC-678 Spotify client secret High keyword + regex + entropy spotify client secret CWE-798
VNX-SEC-679 Reddit client secret High keyword + regex + entropy reddit secret CWE-798
VNX-SEC-680 LinkedIn client secret High keyword + regex + entropy linkedin secret CWE-798
VNX-SEC-681 Facebook/Meta app secret Critical keyword + regex + entropy facebook meta app secret CWE-798
VNX-SEC-682 Facebook/Meta access token (EAAB) Critical keyword + regex eaa facebook access token CWE-798
VNX-SEC-683 Instagram access token (IGQ) Critical keyword + regex igq instagram access token CWE-798
VNX-SEC-684 Twitter/X API key (consumer key) High keyword + regex + entropy twitter consumer key api key CWE-798
VNX-SEC-685 Twitter/X API secret (consumer secret) High keyword + regex + entropy twitter consumer secret api secret CWE-798
VNX-SEC-686 Twitter/X bearer token (AAAAAAAA) High keyword + regex bearer twitter aaaaaaaa CWE-798
VNX-SEC-687 Twitter/X access token High keyword + regex + entropy twitter access token CWE-798
VNX-SEC-688 TikTok client secret High keyword + regex + entropy tiktok client secret CWE-798
VNX-SEC-689 Pinterest access token High keyword + regex + entropy pinterest CWE-798
VNX-SEC-690 Snapchat client secret High keyword + regex + entropy snapchat snap secret CWE-798
VNX-SEC-691 Mastodon access token High keyword + regex + entropy mastodon access token CWE-798
VNX-SEC-692 Bluesky app password High keyword + regex + entropy bluesky bsky app password CWE-798
VNX-SEC-693 WooCommerce consumer key (ck_) High keyword + regex ck_ woocommerce CWE-798
VNX-SEC-694 WooCommerce consumer secret (cs_) High keyword + regex cs_ woocommerce CWE-798
VNX-SEC-695 Magento integration access token High keyword + regex + entropy magento access token integration CWE-798
VNX-SEC-696 PuTTY private key MAC line High regex private-mac putty CWE-798
VNX-SEC-701 Spotify access token (BQ…) High keyword + regex + entropy spotify access token CWE-798
VNX-SEC-702 YouTube data API client secret (GOCSPX context) High keyword + regex gocspx- client secret CWE-798
VNX-SEC-703 TikTok access token (act.) High keyword + regex act. tiktok access token CWE-798
VNX-SEC-704 Reddit refresh token High keyword + regex + entropy reddit refresh token CWE-798
VNX-SEC-705 Discourse API key High keyword + regex + entropy discourse api key CWE-798
VNX-SEC-709 LinkedIn access token (AQ…) High keyword + regex + entropy linkedin access token CWE-798
VNX-SEC-710 Snapchat OAuth access token High keyword + regex + entropy snapchat snap access token CWE-798
VNX-SEC-711 Pinterest app secret High keyword + regex + entropy pinterest secret CWE-798
VNX-SEC-712 Mastodon application client secret High keyword + regex + entropy mastodon client secret CWE-798
VNX-SEC-720 Twitch app access token (context) High keyword + regex + entropy twitch access token CWE-798
VNX-SEC-721 Facebook page/app access token (context) High keyword + regex + entropy facebook meta access token CWE-798
VNX-SEC-722 YouTube/Google OAuth refresh token (1//) Critical keyword + regex 1// refresh token google CWE-798
VNX-SEC-723 Twitch refresh token (context) High keyword + regex + entropy twitch refresh token CWE-798
VNX-SEC-726 Discord webhook URL Medium regex discord webhooks CWE-798
VNX-SEC-727 Slack webhook URL Medium regex hooks.slack.com services CWE-798
VNX-SEC-728 Telegram bot token High regex :aa telegram bot CWE-798
VNX-SEC-729 Vimeo access token High keyword + regex + entropy vimeo access token CWE-798
VNX-SEC-730 Twitch extension secret High keyword + regex + entropy twitch extension secret CWE-798
VNX-SEC-736 PostHog project API key (phc_) Medium keyword + regex phc_ posthog CWE-798
VNX-SEC-737 PostHog personal API key (phx_) High keyword + regex phx_ posthog CWE-798
VNX-SEC-738 LaunchDarkly SDK/API key (sdk-/api-) High keyword + regex sdk- api- launchdarkly CWE-798
VNX-SEC-739 Flagsmith / Unleash feature-flag server key Medium keyword + regex + entropy flagsmith unleash server key CWE-798
VNX-SEC-740 Statsig server secret key (secret-) High keyword + regex secret- statsig CWE-798
VNX-SEC-741 Workday OAuth client secret Critical keyword + regex + entropy workday secret CWE-798
VNX-SEC-742 Workday ISU integration password High keyword + regex + entropy workday password CWE-798
VNX-SEC-743 SAP BTP XSUAA client secret Critical keyword + regex + entropy xsuaa secret CWE-798
VNX-SEC-744 SAP SuccessFactors OAuth API key High keyword + regex + entropy successfactors key CWE-798
VNX-SEC-745 SAP Concur OAuth access token High keyword + regex + entropy concur eyj CWE-798
VNX-SEC-746 SAP Concur OAuth refresh token Critical keyword + regex + entropy concur refresh CWE-798
VNX-SEC-747 NetSuite TBA consumer secret Critical keyword + regex + entropy netsuite consumer CWE-798
VNX-SEC-748 NetSuite TBA token secret Critical keyword + regex + entropy netsuite token CWE-798
VNX-SEC-749 ADP OAuth client secret High keyword + regex + entropy adp secret CWE-798
VNX-SEC-750 Paychex OAuth client secret High keyword + regex + entropy paychex secret CWE-798
VNX-SEC-751 Justworks API access token High keyword + regex + entropy justworks token CWE-798
VNX-SEC-752 Gusto OAuth access token High keyword + regex gusto_ CWE-798
VNX-SEC-753 Gusto API token High keyword + regex + entropy gusto token CWE-798
VNX-SEC-754 BambooHR API key High keyword + regex + entropy bamboohr key CWE-798
VNX-SEC-755 Rippling API token Critical keyword + regex + entropy rippling token CWE-798
VNX-SEC-756 Deel API token High keyword + regex + entropy deel token CWE-798
VNX-SEC-757 Expensify partner user secret High keyword + regex + entropy partneruser secret CWE-798
VNX-SEC-758 Greenhouse Harvest API key High keyword + regex + entropy greenhouse key CWE-798
VNX-SEC-759 Lever Data API key High keyword + regex + entropy lever key CWE-798
VNX-SEC-760 Workable API access token High keyword + regex + entropy workable token CWE-798
VNX-SEC-761 SmartRecruiters SmartToken High keyword + regex + entropy smarttoken smartrecruiters CWE-798
VNX-SEC-762 DocuSign JWT user access token Critical keyword + regex + entropy docusign eyj CWE-798
VNX-SEC-763 DocuSign OAuth secret key Critical keyword + regex + entropy docusign secret CWE-798
VNX-SEC-764 Box JWT app private-key passphrase Critical keyword + regex + entropy box passphrase CWE-798
VNX-SEC-765 Box client secret Critical keyword + regex + entropy box secret CWE-798
VNX-SEC-766 Egnyte access token High keyword + regex + entropy egnyte token CWE-798
VNX-SEC-767 Smartsheet API access token High keyword + regex + entropy smartsheet token CWE-798
VNX-SEC-768 ZoomInfo private key High keyword + regex + entropy zoominfo key CWE-798
VNX-SEC-769 Apollo.io API key High keyword + regex + entropy apollo key CWE-798
VNX-SEC-770 Outreach OAuth access token High keyword + regex + entropy outreach token CWE-798
VNX-SEC-771 Salesloft API key High keyword + regex + entropy salesloft token CWE-798
VNX-SEC-772 Gong API access key secret Critical keyword + regex + entropy gong secret CWE-798
VNX-SEC-773 Chorus.ai API token High keyword + regex + entropy chorus token CWE-798
VNX-SEC-774 Clari API token High keyword + regex + entropy clari token CWE-798
VNX-SEC-775 Pipedrive OAuth access token High keyword + regex + entropy pipedrive eyj CWE-798
VNX-SEC-776 Freshsales CRM API key High keyword + regex + entropy freshsales key CWE-798
VNX-SEC-777 Keap/Infusionsoft OAuth access token High keyword + regex + entropy keap token CWE-798
VNX-SEC-778 Keap/Infusionsoft legacy API key High keyword + regex + entropy infusionsoft key CWE-798
VNX-SEC-779 Insightly API key High keyword + regex + entropy insightly key CWE-798
VNX-SEC-780 ActiveCampaign API key High keyword + regex + entropy activecampaign key CWE-798
VNX-SEC-781 Copper CRM API token High keyword + regex + entropy copper token CWE-798
VNX-SEC-782 Salesforce OAuth bearer JWT Critical keyword + regex + entropy salesforce eyj CWE-798
VNX-SEC-783 Salesforce session ID (00D) Critical keyword + regex 00d CWE-798
VNX-SEC-784 ServiceNow OAuth refresh token Critical keyword + regex + entropy servicenow refresh CWE-798
VNX-SEC-785 ServiceNow OAuth client secret Critical keyword + regex + entropy servicenow secret CWE-798
VNX-SEC-786 ClickUp OAuth access token High keyword + regex + entropy clickup token CWE-798
VNX-SEC-787 Wrike permanent access token Critical keyword + regex + entropy wrike token CWE-798
VNX-SEC-788 Confluence/Jira OAuth 2.0 access token High keyword + regex + entropy atlassian eyj CWE-798
VNX-SEC-789 Confluence/Jira Connect app shared secret Critical keyword + regex + entropy sharedsecret atlassian CWE-798
VNX-SEC-790 Productboard API token High keyword + regex + entropy productboard token CWE-798
VNX-SEC-791 Pendo integration key High keyword + regex + entropy pendo key CWE-798
VNX-SEC-792 Amplitude secret key High keyword + regex + entropy amplitude secret CWE-798
VNX-SEC-793 Heap server API key High keyword + regex + entropy heap key CWE-798
VNX-SEC-794 FullStory server API key High keyword + regex + entropy fullstory key CWE-798
VNX-SEC-795 LogRocket API key High keyword + regex + entropy logrocket key CWE-798
VNX-SEC-796 Smartlook API token High keyword + regex + entropy smartlook token CWE-798
VNX-SEC-797 Mouseflow API key Medium keyword + regex + entropy mouseflow key CWE-798
VNX-SEC-798 Hotjar API token Medium keyword + regex + entropy hotjar token CWE-798
VNX-SEC-799 Qualtrics API token High keyword + regex + entropy qualtrics token CWE-798
VNX-SEC-800 SurveyMonkey access token High keyword + regex + entropy surveymonkey token CWE-798
VNX-SEC-801 Delighted API key High keyword + regex + entropy delighted key CWE-798
VNX-SEC-802 Sprig API key High keyword + regex + entropy sprig key CWE-798
VNX-SEC-803 Intercom OAuth access token Critical keyword + regex + entropy intercom token CWE-798
VNX-SEC-804 Zoho CRM client secret Critical keyword + regex + entropy zoho secret CWE-798
VNX-SEC-821 BigCommerce API access token Critical keyword + regex + entropy bigcommerce token CWE-798
VNX-SEC-822 BigCommerce client secret Critical keyword + regex + entropy bigcommerce secret CWE-798
VNX-SEC-823 WooCommerce REST consumer key (ck_) High keyword + regex ck_ CWE-798
VNX-SEC-824 WooCommerce REST consumer secret (cs_) Critical keyword + regex cs_ CWE-798
VNX-SEC-825 Magento integration access token Critical keyword + regex + entropy magento token CWE-798
VNX-SEC-826 Squarespace API key High keyword + regex + entropy squarespace key CWE-798
VNX-SEC-827 Wix API key Critical keyword + regex + entropy wix key CWE-798
VNX-SEC-828 Wix OAuth app secret Critical keyword + regex + entropy wix secret CWE-798
VNX-SEC-829 Ecwid secret token Critical keyword + regex secret_ CWE-798
VNX-SEC-830 Ecwid public token Medium keyword + regex public_ CWE-798
VNX-SEC-831 PrestaShop webservice API key High keyword + regex + entropy prestashop key CWE-798
VNX-SEC-832 Recharge API token (sk_) Critical keyword + regex recharge CWE-798
VNX-SEC-833 Gorgias API key High keyword + regex + entropy gorgias key CWE-798
VNX-SEC-834 Loop Returns API key High keyword + regex + entropy loop key CWE-798
VNX-SEC-835 ShipStation API key High keyword + regex + entropy shipstation key CWE-798
VNX-SEC-836 ShipStation API secret Critical keyword + regex + entropy shipstation secret CWE-798
VNX-SEC-837 Shippo live API token (shippo_live_) Critical keyword + regex shippo_live_ CWE-798
VNX-SEC-838 Shippo test API token (shippo_test_) Medium keyword + regex shippo_test_ CWE-798
VNX-SEC-839 EasyPost production API key (EZAK) Critical keyword + regex ezak CWE-798
VNX-SEC-840 EasyPost test API key (EZTK) Medium keyword + regex eztk CWE-798
VNX-SEC-841 Avalara AvaTax license key High keyword + regex + entropy avalara key CWE-798
VNX-SEC-842 TaxJar API token High keyword + regex + entropy taxjar token CWE-798
VNX-SEC-843 Printful API token High keyword + regex + entropy printful token CWE-798
VNX-SEC-844 Printify API token (JWT) High keyword + regex + entropy printify eyj CWE-798
VNX-SEC-845 Gelato API key High keyword + regex + entropy gelato key CWE-798
VNX-SEC-846 eBay OAuth user access token (v^1.1) Critical keyword + regex + entropy ebay v^1.1 CWE-798
VNX-SEC-847 eBay developer cert id (client secret) Critical keyword + regex + entropy ebay prd- CWE-798
VNX-SEC-848 Etsy API keystring High keyword + regex + entropy etsy key CWE-798
VNX-SEC-849 Amazon SP-API LWA refresh token (Atzr|) Critical keyword + regex atzr CWE-798
VNX-SEC-850 Amazon LWA client secret (amzn1) Critical keyword + regex amzn1.oa2-cs CWE-798
VNX-SEC-851 Walmart Marketplace client secret Critical keyword + regex + entropy walmart secret CWE-798
VNX-SEC-852 Rakuten API secret High keyword + regex + entropy rakuten secret CWE-798
VNX-SEC-853 Mercado Libre access token (APP_USR) Critical keyword + regex app_usr- CWE-798
VNX-SEC-854 Mercado Libre client secret (APP_USR secret) Critical keyword + regex + entropy meli secret CWE-798
VNX-SEC-855 Faire API access token High keyword + regex + entropy faire token CWE-798
VNX-SEC-856 Cratejoy API secret High keyword + regex + entropy cratejoy secret CWE-798
VNX-SEC-857 ActiveCampaign API key High keyword + regex + entropy activecampaign key CWE-798
VNX-SEC-858 ConvertKit API key High keyword + regex + entropy convertkit key CWE-798
VNX-SEC-859 ConvertKit API secret Critical keyword + regex + entropy convertkit secret CWE-798
VNX-SEC-860 Drip API token High keyword + regex + entropy drip token CWE-798
VNX-SEC-861 Omnisend API key High keyword + regex + entropy omnisend key CWE-798
VNX-SEC-862 Yotpo API secret High keyword + regex + entropy yotpo secret CWE-798
VNX-SEC-863 Mailmodo API key High keyword + regex + entropy mailmodo key CWE-798
VNX-SEC-864 Customer.io app API token (Bearer) Critical keyword + regex + entropy customer.io token CWE-798
VNX-SEC-865 Customer.io tracking site/key pair High keyword + regex + entropy customer.io key CWE-798
VNX-SEC-866 Klaviyo private API key (pk_) Critical keyword + regex pk_ CWE-798
VNX-SEC-867 Mailchimp Transactional (Mandrill) API key Critical keyword + regex + entropy mandrill key CWE-798
VNX-SEC-868 Constant Contact access token (JWT) Critical keyword + regex + entropy constantcontact eyj CWE-798
VNX-SEC-869 Constant Contact client secret Critical keyword + regex + entropy constantcontact secret CWE-798
VNX-SEC-870 Campaign Monitor API key High keyword + regex + entropy campaignmonitor key CWE-798
VNX-SEC-871 GetResponse API key High keyword + regex + entropy getresponse key CWE-798
VNX-SEC-872 MailerLite API token (JWT) High keyword + regex + entropy mailerlite eyj CWE-798
VNX-SEC-873 Moosend API key High keyword + regex + entropy moosend key CWE-798
VNX-SEC-874 Brevo (Sendinblue) API key (xkeysib-) Critical keyword + regex xkeysib- CWE-798
VNX-SEC-875 Brevo SMTP key (xsmtpsib-) Critical keyword + regex xsmtpsib- CWE-798
VNX-SEC-876 Beehiiv API key High keyword + regex + entropy beehiiv key CWE-798
VNX-SEC-877 Substack session cookie token High keyword + regex + entropy substack session CWE-798
VNX-SEC-878 Ghost Admin API key (id:secret) Critical keyword + regex + entropy ghost key CWE-798
VNX-SEC-879 Ghost Content API key Medium keyword + regex + entropy ghost content CWE-798
VNX-SEC-880 WordPress.com OAuth access token Critical keyword + regex + entropy wordpress.com token CWE-798
VNX-SEC-881 Webflow API token (site/v2 Bearer) Critical keyword + regex + entropy webflow token CWE-798
VNX-SEC-882 Shopify Storefront API access token High keyword + regex + entropy shopify storefront CWE-798
VNX-SEC-883 Shopify private app API secret key (shpss alt) Critical keyword + regex + entropy shopify secret CWE-798
VNX-SEC-884 Snipcart API key (secret) Critical keyword + regex + entropy snipcart key CWE-798
VNX-SEC-885 Swell API secret key Critical keyword + regex + entropy swell secret CWE-798
VNX-SEC-886 Medusa API token (JWT) Critical keyword + regex + entropy medusa eyj CWE-798
VNX-SEC-887 Saleor app auth token Critical keyword + regex + entropy saleor token CWE-798
VNX-SEC-888 commercetools client secret Critical keyword + regex + entropy commercetools secret CWE-798
VNX-SEC-889 BigCommerce client id Medium keyword + regex + entropy bigcommerce client CWE-798
VNX-SEC-890 Recharge API token (legacy hex) High keyword + regex + entropy recharge token CWE-798
VNX-SEC-891 Klaviyo company id (public key) Medium keyword + regex + entropy klaviyo company CWE-798
VNX-SEC-892 Avalara account id Medium keyword + regex + entropy avalara account CWE-798
VNX-SEC-893 Gorgias account subdomain credential pair High keyword + regex + entropy gorgias auth CWE-798
VNX-SEC-894 ShipStation v2 API key (TEST/PROD) Critical keyword + regex + entropy shipstation key CWE-798
VNX-SEC-895 TaxJar sandbox API token Medium keyword + regex + entropy taxjar sandbox CWE-798
VNX-SEC-896 Printful store API key (legacy basic) High keyword + regex + entropy printful auth CWE-798
VNX-SEC-897 ActiveCampaign account API URL Medium keyword + regex + entropy activecampaign url CWE-798
VNX-SEC-898 Webflow site api token (legacy prefix) High keyword + regex + entropy webflow token CWE-798
VNX-SEC-899 Etsy OAuth2 access token (prefix.token) Critical keyword + regex + entropy etsy token CWE-798
VNX-SEC-900 Gelato API key (single uuid form) High keyword + regex + entropy gelato key CWE-798
VNX-SEC-901 HERE Maps API key High keyword + regex + entropy here CWE-798
VNX-SEC-902 TomTom API key High keyword + regex + entropy tomtom CWE-798
VNX-SEC-903 MapQuest API key Medium keyword + regex + entropy mapquest CWE-798
VNX-SEC-904 Mapbox secret access token (sk.) Critical keyword + regex sk. CWE-798
VNX-SEC-905 Google Maps server API key (context) High keyword + regex + entropy google maps CWE-798
VNX-SEC-906 OpenWeatherMap API key Medium keyword + regex + entropy openweather owm CWE-798
VNX-SEC-907 Weatherbit API key Medium keyword + regex + entropy weatherbit CWE-798
VNX-SEC-908 AccuWeather API key Medium keyword + regex + entropy accuweather CWE-798
VNX-SEC-909 Visual Crossing weather API key Medium keyword + regex + entropy visualcrossing visual crossing CWE-798
VNX-SEC-910 Tomorrow.io API key Medium keyword + regex + entropy tomorrow.io climacell CWE-798
VNX-SEC-911 IPstack API access key Medium keyword + regex + entropy ipstack CWE-798
VNX-SEC-912 IPinfo access token Medium keyword + regex + entropy ipinfo CWE-798
VNX-SEC-913 IPgeolocation API key Medium keyword + regex + entropy ipgeolocation CWE-798
VNX-SEC-914 ipdata API key Medium keyword + regex + entropy ipdata CWE-798
VNX-SEC-915 MaxMind license key High keyword + regex + entropy maxmind CWE-798
VNX-SEC-916 Abstract API key Medium keyword + regex + entropy abstractapi abstract CWE-798
VNX-SEC-917 Clearbit API key (sk_) High keyword + regex sk_ CWE-798
VNX-SEC-918 Hunter.io API key Medium keyword + regex + entropy hunter CWE-798
VNX-SEC-919 People Data Labs API key High keyword + regex + entropy peopledatalabs pdl CWE-798
VNX-SEC-920 FullContact API key Medium keyword + regex + entropy fullcontact CWE-798
VNX-SEC-921 Numverify API access key Medium keyword + regex + entropy numverify CWE-798
VNX-SEC-922 NumLookup API key Medium keyword + regex + entropy numlookup CWE-798
VNX-SEC-923 Veriphone API key Medium keyword + regex + entropy veriphone CWE-798
VNX-SEC-924 Apollo.io API key High keyword + regex + entropy apollo CWE-798
VNX-SEC-925 AWS IoT certificate private key (context) Critical keyword + regex + entropy aws iot iot CWE-798
VNX-SEC-926 Azure IoT Hub SharedAccessKey Critical keyword + regex + entropy sharedaccesskey CWE-798
VNX-SEC-927 GCP IoT Core device key (context) Critical keyword + regex + entropy iot CWE-798
VNX-SEC-928 Particle access token Critical keyword + regex + entropy particle CWE-798
VNX-SEC-929 Blynk auth token High keyword + regex + entropy blynk CWE-798
VNX-SEC-930 Losant access token High keyword + regex + entropy losant CWE-798
VNX-SEC-931 ThingSpeak write/read API key Medium keyword + regex + entropy thingspeak CWE-798
VNX-SEC-932 Adafruit IO key (aio_) High keyword + regex aio_ CWE-798
VNX-SEC-933 Ubidots API token High keyword + regex + entropy ubidots CWE-798
VNX-SEC-934 Helium API key High keyword + regex + entropy helium CWE-798
VNX-SEC-935 Sigfox API credential High keyword + regex + entropy sigfox CWE-798
VNX-SEC-936 Soracom auth/API key High keyword + regex + entropy soracom CWE-798
VNX-SEC-937 Twilio Super SIM / IoT API key (SK) High keyword + regex + entropy supersim twilio iot CWE-798
VNX-SEC-938 46elks API credential High keyword + regex + entropy 46elks elks CWE-798
VNX-SEC-939 BulkSMS token / credential High keyword + regex + entropy bulksms CWE-798
VNX-SEC-940 Telesign customer ID + API key High keyword + regex + entropy telesign CWE-798
VNX-SEC-941 Agora App Certificate Critical keyword + regex + entropy agora CWE-798
VNX-SEC-942 Agora App ID Medium keyword + regex + entropy agora CWE-798
VNX-SEC-943 Daily.co API key High keyword + regex + entropy daily CWE-798
VNX-SEC-944 LiveKit API secret Critical keyword + regex + entropy livekit CWE-798
VNX-SEC-945 LiveKit API key (APIxxxx) High keyword + regex api CWE-798
VNX-SEC-946 100ms management token / secret Critical keyword + regex + entropy 100ms hms CWE-798
VNX-SEC-947 Vonage Video / OpenTok API secret High keyword + regex + entropy opentok vonage video tokbox CWE-798
VNX-SEC-1018 GitGuardian personal access token (ggp_) High keyword + regex ggp_ CWE-798
VNX-SEC-1019 GitGuardian service account token (gg_) High keyword + regex gg_ CWE-798
VNX-SEC-1020 Snyk API token (UUID, assignment) High keyword + regex + entropy snyk token CWE-798
VNX-SEC-1021 Snyk org/service account token (snyk_ prefix) High keyword + regex snyk_ CWE-798
VNX-SEC-1022 Doppler service token (dp.st.) Critical keyword + regex dp.st. CWE-798
VNX-SEC-1023 Doppler CLI token (dp.ct.) Critical keyword + regex dp.ct. CWE-798
VNX-SEC-1024 Doppler service-account token (dp.sa.) Critical keyword + regex dp.sa. CWE-798
VNX-SEC-1025 Doppler audit token (dp.audit.) High keyword + regex dp.audit. CWE-798
VNX-SEC-1026 HashiCorp Vault service token (hvs.) Critical keyword + regex hvs. CWE-798
VNX-SEC-1027 HashiCorp Vault batch token (hvb.) High keyword + regex hvb. CWE-798
VNX-SEC-1028 HashiCorp Vault recovery token (hvr.) Critical keyword + regex hvr. CWE-798
VNX-SEC-1029 Vault AppRole role_id (assignment) High keyword + regex + entropy role_id CWE-798
VNX-SEC-1030 Vault AppRole secret_id (assignment) Critical keyword + regex + entropy secret_id CWE-798
VNX-SEC-1031 HCP Vault Secrets / HCP API client secret (assignment) Critical keyword + regex + entropy hcp secret CWE-798
VNX-SEC-1032 Bitwarden / Secrets Manager access token (0.uuid) Critical keyword + regex 0. CWE-798
VNX-SEC-1033 Akeyless access ID (p-) High keyword + regex p- CWE-798
VNX-SEC-1034 Akeyless access key (assignment) Critical keyword + regex + entropy akeyless key CWE-798
VNX-SEC-1035 CyberArk Conjur API key (assignment) Critical keyword + regex + entropy conjur key CWE-798
VNX-SEC-1036 Keeper Secrets Manager config token (assignment) High keyword + regex + entropy keeper token CWE-798
VNX-SEC-1037 Infisical service token (st.) Critical keyword + regex st. CWE-798
VNX-SEC-1038 Infisical machine identity client secret (ssk-/st- assignment) Critical keyword + regex + entropy infisical secret CWE-798
VNX-SEC-1039 AWS Secrets Manager secret ARN Medium regex arn:aws:secretsmanager CWE-798
VNX-SEC-1040 Veracode API ID (assignment) High keyword + regex + entropy veracode id CWE-798
VNX-SEC-1041 Veracode API key (assignment) Critical keyword + regex + entropy veracode key CWE-798
VNX-SEC-1042 Checkmarx API key / refresh token (assignment) Critical keyword + regex + entropy checkmarx token CWE-798
VNX-SEC-1043 SonarQube/SonarCloud user token (squ_) High keyword + regex squ_ CWE-798
VNX-SEC-1044 SonarCloud project analysis token (sqp_) High keyword + regex sqp_ CWE-798
VNX-SEC-1045 SonarQube global analysis token (sqa_) High keyword + regex sqa_ CWE-798
VNX-SEC-1046 Mend/WhiteSource API key (assignment) High keyword + regex + entropy mend whitesource key CWE-798
VNX-SEC-1047 FOSSA API token (fossa_) High keyword + regex fossa_ CWE-798
VNX-SEC-1048 Semgrep AppSec API token (assignment) High keyword + regex + entropy semgrep token CWE-798
VNX-SEC-1049 Aqua Security API key (assignment) High keyword + regex + entropy aqua key CWE-798
VNX-SEC-1050 Sysdig Secure API token (assignment) High keyword + regex + entropy sysdig token CWE-798
VNX-SEC-1051 Wiz service account client secret (assignment) Critical keyword + regex + entropy wiz secret CWE-798
VNX-SEC-1052 Orca Security API token (assignment) High keyword + regex + entropy orca token CWE-798
VNX-SEC-1053 Lacework API secret (assignment) Critical keyword + regex + entropy lacework secret CWE-798
VNX-SEC-1054 Prisma Cloud access key secret (assignment) Critical keyword + regex + entropy prisma secret CWE-798
VNX-SEC-1055 Tenable.io access/secret key (assignment) High keyword + regex + entropy tenable key CWE-798
VNX-SEC-1056 Qualys API credentials (basic auth, assignment) High keyword + regex + entropy qualys password CWE-798
VNX-SEC-1057 Rapid7 InsightVM/InsightAppSec API key (assignment) High keyword + regex + entropy rapid7 insight key CWE-798
VNX-SEC-1058 Detectify API key (assignment) High keyword + regex + entropy detectify key CWE-798
VNX-SEC-1059 Probely API token (assignment) High keyword + regex + entropy probely token CWE-798
VNX-SEC-1060 StackHawk API key (hawk.) High keyword + regex hawk. CWE-798
VNX-SEC-1061 Steam Web API key High keyword + regex + entropy steam apikey CWE-798
VNX-SEC-1062 Riot Games API key (RGAPI-) High keyword + regex rgapi- CWE-798
VNX-SEC-1063 Twitch app access token (OAuth) High keyword + regex + entropy twitch accesstoken CWE-798
VNX-SEC-1064 Twitch EventSub webhook secret High keyword + regex + entropy eventsub secret CWE-798
VNX-SEC-1065 Unity Cloud Build API key High keyword + regex + entropy unity apikey CWE-798
VNX-SEC-1066 PlayFab secret key Critical keyword + regex + entropy playfab secretkey CWE-798
VNX-SEC-1068 Vimeo access token (bearer) High keyword + regex + entropy vimeo token CWE-798
VNX-SEC-1069 Brightcove OAuth client secret High keyword + regex + entropy brightcove secret CWE-798
VNX-SEC-1070 JW Player API v2 secret High keyword + regex + entropy jwplayer secret CWE-798
VNX-SEC-1071 Wistia API token High keyword + regex + entropy wistia token CWE-798
VNX-SEC-1072 api.video API key High keyword + regex + entropy apivideo apikey CWE-798
VNX-SEC-1073 Dolby.io API secret High keyword + regex + entropy dolby secret CWE-798
VNX-SEC-1074 Spotify refresh token High keyword + regex + entropy spotify refreshtoken CWE-798
VNX-SEC-1075 SoundCloud OAuth client secret High keyword + regex + entropy soundcloud secret CWE-798
VNX-SEC-1076 Last.fm API secret Medium keyword + regex + entropy lastfm secret CWE-798
VNX-SEC-1077 Discogs personal access token Medium keyword + regex + entropy discogs token CWE-798
VNX-SEC-1078 TMDB API key (v3) Medium keyword + regex + entropy tmdb apikey CWE-798
VNX-SEC-1079 TMDB API read access token (v4 JWT) High keyword + regex + entropy tmdb eyj CWE-798
VNX-SEC-1080 OMDb API key Medium keyword + regex + entropy omdb apikey CWE-798
VNX-SEC-1081 Giphy API key Medium keyword + regex + entropy giphy apikey CWE-798
VNX-SEC-1082 Tenor API key Medium keyword + regex + entropy tenor aiza CWE-798
VNX-SEC-1083 Unsplash access key (Client-ID) Medium keyword + regex + entropy unsplash accesskey CWE-798
VNX-SEC-1084 Unsplash secret key High keyword + regex + entropy unsplash secretkey CWE-798
VNX-SEC-1085 Pexels API key Medium keyword + regex + entropy pexels apikey CWE-798
VNX-SEC-1086 Pixabay API key Medium keyword + regex + entropy pixabay apikey CWE-798
VNX-SEC-1087 Flickr API secret Medium keyword + regex + entropy flickr secret CWE-798
VNX-SEC-1088 Imgur Client-ID Medium keyword + regex + entropy imgur clientid CWE-798
VNX-SEC-1089 Imgur client secret High keyword + regex + entropy imgur clientsecret CWE-798
VNX-SEC-1090 KeyCDN API key High keyword + regex + entropy keycdn apikey CWE-798
VNX-SEC-1091 StackPath client secret High keyword + regex + entropy stackpath secret CWE-798
VNX-SEC-1092 G-Core Labs API token (APIKey) High keyword + regex + entropy gcore apikey CWE-798
VNX-SEC-1093 CDN77 API token High keyword + regex + entropy cdn77 token CWE-798
VNX-SEC-1094 ConfigCat SDK key (configcat-) Medium keyword + regex configcat- CWE-798
VNX-SEC-1095 Flagsmith server-side environment key (ser.) High keyword + regex ser. CWE-798
VNX-SEC-1096 GrowthBook SDK secret key High keyword + regex secret_ CWE-798
VNX-SEC-1103 Steam publisher Web API key (partner) Critical keyword + regex + entropy steam publisher CWE-798
VNX-SEC-1104 Riot Games production API key (production RGAPI) Critical keyword + regex + entropy riot rgapi- CWE-798
VNX-SEC-1105 Twitch client ID Medium keyword + regex + entropy twitch clientid CWE-798
VNX-SEC-1106 Unity Cloud Build organization secret High keyword + regex + entropy unity secret CWE-798
VNX-SEC-1107 PlayFab title ID + secret context Critical keyword + regex + entropy playfab developer CWE-798
VNX-SEC-1108 Vimeo OAuth client secret High keyword + regex + entropy vimeo secret CWE-798
VNX-SEC-1109 JW Player API v1 secret High keyword + regex + entropy jwplatform secret CWE-798
VNX-SEC-1110 Brightcove policy key (BCpkc) Medium keyword + regex bcpkc CWE-798
VNX-SEC-1111 Wistia OAuth access token High keyword + regex wsa_ CWE-798
VNX-SEC-1112 Deepgram-style media key skip placeholder High keyword + regex + entropy bunnystream key CWE-798
VNX-SEC-1113 Dolby.io media app key Medium keyword + regex + entropy dolby appkey CWE-798
VNX-SEC-1114 SoundCloud OAuth access token High keyword + regex + entropy soundcloud accesstoken CWE-798
VNX-SEC-1115 Discogs consumer secret High keyword + regex + entropy discogs secret CWE-798
VNX-SEC-1116 Giphy production app key context Medium keyword + regex + entropy giphy production CWE-798
VNX-SEC-1117 Pixabay numeric key context Medium keyword + regex + entropy pixabay key CWE-798
VNX-SEC-1118 Flickr API key Medium keyword + regex + entropy flickr apikey CWE-798
VNX-SEC-1119 Imgur access token (bearer) High keyword + regex + entropy imgur accesstoken CWE-798
VNX-SEC-1120 KeyCDN account-context API key High keyword + regex + entropy keycdn secret CWE-798
VNX-SEC-1121 StackPath client ID Medium keyword + regex + entropy stackpath clientid CWE-798
VNX-SEC-1122 CDN77 login token context High keyword + regex + entropy cdn77 logintoken CWE-798
VNX-SEC-1123 G-Core Labs permanent API token (gcore_) High keyword + regex gcore_ CWE-798
VNX-SEC-1127 TMDB v4 access token context High keyword + regex + entropy tmdb accesstoken CWE-798
VNX-SEC-1128 Unsplash application id context Medium keyword + regex + entropy unsplash applicationid CWE-798
VNX-SEC-1129 Vimeo personal access token context High keyword + regex + entropy vimeo personaltoken CWE-798
VNX-SEC-1130 JW Player API key (v2 key) Medium keyword + regex + entropy jwplayer apikey CWE-798
VNX-SEC-1131 TMDB session id High keyword + regex + entropy tmdb sessionid CWE-798
VNX-SEC-1132 Last.fm API key Medium keyword + regex + entropy lastfm apikey CWE-798
VNX-SEC-1133 Spotify OAuth access token (bearer) High keyword + regex + entropy spotify accesstoken CWE-798
VNX-SEC-1135 Tenor v2 client key context Medium keyword + regex + entropy tenor clientkey CWE-798
VNX-SEC-1136 Steam server API key context High keyword + regex + entropy steam serverkey CWE-798
VNX-SEC-1137 Wistia data API token context High keyword + regex + entropy wistia datatoken CWE-798
VNX-SEC-1138 PlayFab title shared secret context Critical keyword + regex + entropy playfab titlesecret CWE-798
VNX-SEC-1139 api.video sandbox key context Medium keyword + regex + entropy apivideo sandbox CWE-798

Suppress one with // nosec <rule-id> on the line, or vulnetix ignore add --rule <rule-id>. See Suppressing findings.

Edit this pageSources: cli/internal/sast/secretsgen/catalog.json, cli/internal/sast/secretsgen/main.go
esc
↑ ↓ move↵ openSearches in your browser. A key like autonomy.max or a code like threshold_required jumps straight to it.