detectors:
- name: generic-config-secret
  keywords:
  - secret
  - password
  - passwd
  - pwd
  - apikey
  - api_key
  - api-key
  - token
  - credential
  - cred
  - auth
  regex:
    secret: |-
      (?i)[\w.-]{0,50}?(?:secret|passw(?:or)?d|pwd|api[_-]?key|token|credentials?|creds?|auth)[\w.-]{0,20}\s*[=:]\s*["'`]?([^\s"'`,;]{6,150})["'`]?\s*(?:$|[\r\n#;])
  entropy: 2.5
  # Applied to the captured value only (not the key), so a key path like
  # `env.password` or `app.env.secret` doesn't cause a real hardcoded
  # secret to be excluded just because "env" appears in the key.
  exclude_regexes_capture:
  - '(?i)^\$\{[^}]*\}$'
  - '(?i)^\{\{[^}]*\}\}$'
  - '(?i)^%[A-Z_]+%$'
  - '(?i)^\$[A-Z_][A-Z0-9_]*$'
  - '(?i)^(?:process\.env\.|os\.environ|getenv\(|System\.getenv\()'
  - '(?i)^(?:vault|kms|secretsmanager|parameterstore)://'
  exclude_words:
  - "changeme"
  - "change_me"
  - "change-me"
  - "changethis"
  - "xxxxxx"
  - "example"
  - "placeholder"
  - "dummy"
  - "redacted"
  - "your_api_key"
  - "your-api-key"
  - "yourapikey"
  - "insert_secret_here"
  - "todo"
  - "fixme"
  - "null"
  - "none"
  - "false"