Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Advanced Security maintains multiple sets of default secret scanning patterns:
- Push protection patterns - used to detect potential secrets at push time in repositories with secret scanning push protection enabled.
- User alert patterns - used to detect potential secrets in repositories with secret scanning alerts enabled.
- Non-provider patterns - used to detect common occurrences of structured secrets in repositories with secret scanning alerts enabled.
Supported secrets
| Section | Explanation |
|---|---|
| Provider | The name of the token provider. |
| Token name | The type of token discovered by Advanced Security secret scanning. |
| User | A token for which leaks are reported to users post-push. Applies to all repositories where Advanced Security is enabled |
| Push protection | A token for which leaks are reported to users on push. Applies to all repositories where secret push protection enabled. |
| Validity | Tokens for which Advanced Security attempts to perform a validity check. |
Partner provider patterns
The following table lists the partner provider patterns supported by secret scanning.
| Rule ID | Token Name | Push Protection | User Alerts | Validity Checking |
|---|---|---|---|---|
| SEC101/156 | AadClientAppIdentifiableCredentials | |||
| SEC101/501 | AdafruitIOKey | |||
| SEC101/201 | AdoIdentifiablePat | |||
| SEC101/102 | AdoLegacyPat | |||
| SEC101/600 | AdobeDeviceToken | |||
| SEC101/601 | AdobeServiceToken | |||
| SEC101/602 | AdobeShortLivedAccessToken | |||
| SEC101/015 | AkamaiCredentials | |||
| SEC101/029 | AlibabaCloudCredentials | |||
| SEC101/023 | AmazonMwsAuthToken | |||
| SEC101/503 | AmazonOAuthCredentials | |||
| SEC101/701 | AnthropicApiKey | |||
| SEC101/735 | AnthropicManagementApiKey | |||
| SEC101/737 | AnthropicSessionToken | |||
| SEC101/504 | AsanaPat | |||
| SEC101/605 | AtlassianJwt | |||
| SEC101/604 | AtlassianLegacyApiToken | |||
| SEC101/008 | AwsCredentials | |||
| SEC101/505 | AwsTemporaryCredentials | |||
| SEC101/157 | AzureApimDirectManagementSas | |||
| SEC101/186 | AzureApimGatewaySas | |||
| SEC101/181 | AzureApimIdentifiableDirectManagementKey | |||
| SEC101/183 | AzureApimIdentifiableGatewayKey | |||
| SEC101/184 | AzureApimIdentifiableRepositoryKey | |||
| SEC101/182 | AzureApimIdentifiableSubscriptionKey | |||
| SEC101/132 | AzureApimLegacyDirectManagementKey | |||
| SEC101/187 | AzureApimLegacyGatewayKey | |||
| SEC101/188 | AzureApimLegacyRepositoryKey | |||
| SEC101/133 | AzureApimLegacySubscriptionKey | |||
| SEC101/185 | AzureApimRepositorySas | |||
| SEC101/197 | AzureAppConfigurationIdentifiableCredentials | |||
| SEC101/131 | AzureAppConfigurationLegacyCredentials | |||
| SEC101/138 | AzureApplicationInsightsCredentials | |||
| SEC101/194 | AzureAutomationAccountKey | |||
| SEC101/163 | AzureBatchIdentifiableKey | |||
| SEC101/113 | AzureBatchLegacyKey | |||
| SEC101/118 | AzureBlockchainCredentials | |||
| SEC101/154 | AzureCacheForRedisIdentifiableKey | |||
| SEC101/155 | AzureCacheForRedisIdentifiablePrivateServiceKey | |||
| SEC101/103 | AzureCacheForRedisLegacyKey | |||
| SEC101/151 | AzureCdnSas | |||
| SEC101/125 | AzureCognitiveServicesLegacyKey | |||
| SEC101/134 | AzureCognitiveServicesTranslatorLegacyKey | |||
| SEC101/204 | AzureCommunicationServicesIdentifiableKey | |||
| SEC101/137 | AzureCommunicationServicesLegacyKey | |||
| SEC101/176 | AzureContainerRegistryIdentifiableKey | |||
| SEC101/109 | AzureContainerRegistryLegacyKey | |||
| SEC101/160 | AzureCosmosDBIdentifiableKey | |||
| SEC101/161 | AzureCosmosDBIdentifiablePrivateServiceKey | |||
| SEC101/104 | AzureCosmosDBLegacyKey | |||
| SEC101/250 | AzureCosmosDBSas | |||
| SEC101/110 | AzureDatabricksPat | |||
| SEC101/256 | AzureDatabricksPrivateServiceKey | |||
| SEC101/148 | AzureDevOpsOAuthToken | |||
| SEC101/199 | AzureEventGridIdentifiableKey | |||
| SEC101/119 | AzureEventGridLegacyKey | |||
| SEC101/172 | AzureEventHubIdentifiableKey | |||
| SEC101/175 | AzureEventHubIdentifiablePrivateServiceSystemKey | |||
| SEC101/198 | AzureFluidRelayIdentifiableKey | |||
| SEC101/190 | AzureFluidRelayLegacyKey | |||
| SEC101/158 | AzureFunctionIdentifiableKey | |||
| SEC101/112 | AzureFunctionLegacyKey | |||
| SEC101/141 | AzureHDInsightCredentials | |||
| SEC101/180 | AzureIotDeviceIdentifiableKey | |||
| SEC101/146 | AzureIotDeviceLegacyCredentials | |||
| SEC101/179 | AzureIotDeviceProvisioningIdentifiableKey | |||
| SEC101/115 | AzureIotDeviceProvisioningLegacyCredentials | |||
| SEC101/178 | AzureIotHubIdentifiableKey | |||
| SEC101/114 | AzureIotHubLegacyCredentials | |||
| SEC101/150 | AzureLogicAppSas | |||
| SEC101/259 | AzureMLIdentifiableInferenceKey | |||
| SEC101/169 | AzureMLIdentifiablePrivateServicePrincipalCredentials | |||
| SEC101/170 | AzureMLWebServiceClassicIdentifiableKey | |||
| SEC101/123 | AzureMLWebServiceKey | |||
| SEC101/129 | AzureManagementCertificate | |||
| SEC101/203 | AzureMapsIdentifiableKey | |||
| SEC101/116 | AzureMapsLegacyKey | |||
| SEC101/105 | AzureMessagingLegacyCredentials | |||
| SEC101/202 | AzureMixedRealityIdentifiableCredentials | |||
| SEC101/136 | AzureMixedRealityLegacyCredentials | |||
| SEC101/189 | AzureOpenAILegacyKey | |||
| SEC101/246 | AzureRateCardSas | |||
| SEC101/173 | AzureRelayIdentifiableKey | |||
| SEC101/167 | AzureSearchIdentifiableAdminKey | |||
| SEC101/168 | AzureSearchIdentifiablePrivateServiceAdminKey | |||
| SEC101/166 | AzureSearchIdentifiableQueryKey | |||
| SEC101/111 | AzureSearchLegacyKey | |||
| SEC101/171 | AzureServiceBusIdentifiableKey | |||
| SEC101/174 | AzureServiceBusIdentifiablePrivateServiceSystemKey | |||
| SEC101/121 | AzureServiceDeploymentCredentials | |||
| SEC101/253 | AzureSignalRIdentifiableKey | |||
| SEC101/254 | AzureSignalRIdentifiableTemporaryKey | |||
| SEC101/117 | AzureSignalRLegacyKey | |||
| SEC101/258 | AzureSpringAppTestEndpointKey | |||
| SEC101/152 | AzureStorageAccountIdentifiableCredentials | |||
| SEC101/261 | AzureStorageAccountIdentifiableSystemCredentials | |||
| SEC101/106 | AzureStorageAccountLegacyCredentials | |||
| SEC101/251 | AzureStorageIdentifiablePrivateServiceKerberosKey | |||
| SEC101/153 | AzureStorageIdentifiablePrivateServiceKey | |||
| SEC101/120 | AzureWebAppBotCredentials | |||
| SEC101/257 | AzureWebAppBotIdentifiableKey | |||
| SEC101/142 | AzureWebAppBotLegacyKey | |||
| SEC101/248 | AzureWebPubSubIdentifiableCredentials | |||
| SEC101/249 | AzureWebPubSubIdentifiableTemporaryCredentials | |||
| SEC101/144 | AzureWebPubSubLegacyCredentials | |||
| SEC101/606 | BeamerApiKey | |||
| SEC101/143 | BingApiKey | |||
| SEC101/128 | BingMapsKey | |||
| SEC101/135 | BingSearchKey | |||
| SEC101/754 | BitrisePat | |||
| SEC101/755 | BitriseWorkspaceApiToken | |||
| SEC101/566 | BrevoApiKey | |||
| SEC101/567 | BrevoSmtpKey | |||
| SEC101/692 | BrowserStackCredentials | |||
| SEC101/594 | CdsCanadaNotifyApiKey | |||
| SEC101/507 | CheckoutApiKey | |||
| SEC101/579 | ChiefToolsToken | |||
| SEC101/145 | CiscoLocalAccountCredentials | |||
| SEC101/508 | ClojarsDeployToken | |||
| SEC101/035 | CloudantCredentials | |||
| SEC101/697 | CohereApiKey | |||
| SEC101/609 | ContentfulPersonalAccessToken | |||
| SEC101/034 | CredentialObject | |||
| SEC101/509 | DevCycleClientApiKey | |||
| SEC101/557 | DevCycleManagementApiToken | |||
| SEC101/510 | DevCycleMobileApiKey | |||
| SEC101/511 | DevCycleServerApiKey | |||
| SEC101/512 | DigitalOceanOAuthToken | |||
| SEC101/513 | DigitalOceanPat | |||
| SEC101/514 | DigitalOceanRefreshToken | |||
| SEC101/515 | DigitalOceanSystemToken | |||
| SEC101/046 | DiscordApiCredentials | |||
| SEC101/516 | DiscordApiToken | |||
| SEC101/736 | DockerOrganizationAccessToken | |||
| SEC101/517 | DopplerAuditToken | |||
| SEC101/518 | DopplerCliToken | |||
| SEC101/519 | DopplerPersonalToken | |||
| SEC101/520 | DopplerScimToken | |||
| SEC101/521 | DopplerServiceToken | |||
| SEC101/020 | DropboxAccessToken | |||
| SEC101/021 | DropboxAppCredentials | |||
| SEC101/522 | DropboxOAuth2ShortLivedAccessToken | |||
| SEC101/523 | DuffelAccessToken | |||
| SEC101/611 | DynatraceInternalToken | |||
| SEC101/613 | EBayProductionClientCredentials | |||
| SEC101/614 | EBaySandboxClientCredentials | |||
| SEC101/524 | EasyPostApiKey | |||
| SEC101/682 | ElasticCloudApiKey | |||
| SEC101/681 | ElasticStackApiKey | |||
| SEC101/196 | EntraToken | |||
| SEC101/014 | FacebookAccessToken | |||
| SEC101/525 | FigmaPat | |||
| SEC101/618 | FinicityAppKey | |||
| SEC101/625 | FirebaseCloudMessagingServerKey | |||
| SEC101/687 | FlickrApiKey | |||
| SEC101/526 | FlutterwaveLiveApiSecretKey | |||
| SEC101/619 | FlutterwaveTestApiSecretKey | |||
| SEC101/621 | FrameIODeveloperToken | |||
| SEC101/620 | FrameIOJwt | |||
| SEC101/527 | FullStoryApiKey | |||
| SEC101/007 | GitHubAppCredentials | |||
| SEC101/529 | GitHubAppToken | |||
| SEC101/530 | GitHubOAuthAccessToken | |||
| SEC101/690 | GitHubOauth2Credentials | |||
| SEC101/534 | GitHubPat | |||
| SEC101/531 | GitHubRefreshToken | |||
| SEC101/532 | GitHubServerToServerToken | |||
| SEC101/535 | GitHubUserToServerToken | |||
| SEC101/622 | GitLabAccessToken | |||
| SEC101/623 | GoCardlessLiveAccessToken | |||
| SEC101/624 | GoCardlessSandboxAccessToken | |||
| SEC101/003 | GoogleApiKey | |||
| SEC101/626 | GoogleCloudPrivateKeyId | |||
| SEC101/536 | GoogleCloudStorageServiceAccountAccessKey | |||
| SEC101/537 | GoogleCloudStorageUserAccessKey | |||
| SEC101/627 | GoogleOAuthAccessToken | |||
| SEC101/002 | GoogleOAuthCredentials | |||
| SEC101/628 | GoogleOAuthRefreshToken | |||
| SEC101/742 | GoogleServiceAccountBoundApiKey | |||
| SEC101/030 | GoogleServiceAccountKey | |||
| SEC101/538 | GrafanaCloudApiKey | |||
| SEC101/629 | GrafanaCloudApiToken | |||
| SEC101/630 | GrafanaProjectApiKey | |||
| SEC101/631 | GrafanaProjectServiceAccountToken | |||
| SEC101/746 | GroqApiKey | |||
| SEC101/581 | HashiCorpVaultBatchLegacyToken | |||
| SEC101/582 | HashiCorpVaultBatchToken | |||
| SEC101/580 | HashiCorpVaultRootServiceToken | |||
| SEC101/583 | HashiCorpVaultServiceLegacyToken | |||
| SEC101/584 | HashiCorpVaultServiceToken | |||
| SEC101/732 | HereApiKey | |||
| SEC101/585 | HighnoteRkKey | |||
| SEC101/586 | HighnoteSkKey | |||
| SEC101/589 | HubSpotApiPersonalAccessKey | |||
| SEC101/539 | HubspotApiKey | |||
| SEC101/686 | HuggingFaceAccessToken | |||
| SEC101/693 | InfuraApiKey | |||
| SEC101/540 | IntercomAccessToken | |||
| SEC101/541 | IonicPat | |||
| SEC101/542 | IonicRefreshToken | |||
| SEC101/590 | JFrogPlatformAccessToken | |||
| SEC101/543 | JFrogPlatformApiKey | |||
| SEC101/632 | JdCloudAccessKey | |||
| SEC101/696 | KaggleApiToken | |||
| SEC101/700 | LangChainApiKey | |||
| SEC101/691 | LaunchDarklyApiKey | |||
| SEC101/544 | LinearApiKey | |||
| SEC101/545 | LinearOAuthAccessToken | |||
| SEC101/633 | LobLiveApiKey | |||
| SEC101/634 | LobTestApiKey | |||
| SEC101/635 | LocalStackApiKey | |||
| SEC101/546 | LogicMonitorBearerToken | |||
| SEC101/547 | LogicMonitorLmv1AccessKey | |||
| SEC101/027 | MailChimpApiKey | |||
| SEC101/026 | MailgunApiCredentials | |||
| SEC101/636 | MapboxSecretAccessToken | |||
| SEC101/548 | MidtransServerKey | |||
| SEC101/699 | MistralApiKey | |||
| SEC101/549 | NewRelicInsightsQueryKey | |||
| SEC101/639 | NewRelicLicenseKey | |||
| SEC101/550 | NewRelicPersonalApiKey | |||
| SEC101/694 | NitroApiKey | |||
| SEC101/640 | NotionIntegrationToken | |||
| SEC101/641 | NotionOAuthClientCredentials | |||
| SEC101/050 | NpmAuthorToken | |||
| SEC101/044 | NpmCredentials | |||
| SEC101/031 | NuGetApiKey | |||
| SEC101/043 | NuGetCredentials | |||
| SEC101/260 | NuGetIdentifiableShortLivedApiKey | |||
| SEC101/642 | OctopusDeployApiKey | |||
| SEC101/643 | OculusAccessToken | |||
| SEC101/552 | OnfidoApiToken | |||
| SEC101/743 | OpenAIApiKey | |||
| SEC101/553 | OpenAIApiKeyV2 | |||
| SEC101/745 | OpenRouterProvisioningOrApiKey | |||
| SEC101/695 | OpenWeatherApiKey | |||
| SEC101/645 | PalantirJwt | |||
| SEC101/022 | PayPalBraintreeAccessToken | |||
| SEC101/698 | PerplexityApiKey | |||
| SEC101/646 | PersonaProductionApiKey | |||
| SEC101/647 | PersonaSandboxApiKey | |||
| SEC101/019 | PicaticApiKey | |||
| SEC101/680 | PineconeApiKey | |||
| SEC101/554 | PlanetScaleDatabasePassword | |||
| SEC101/555 | PlanetScaleOAuthToken | |||
| SEC101/556 | PlanetScaleServiceToken | |||
| SEC101/757 | PlanningCenterOAuthAccessToken | |||
| SEC101/756 | PlanningCenterOAuthApplicationCredentials | |||
| SEC101/648 | PlivoCredentials | |||
| SEC101/045 | PostmanApiKey | |||
| SEC101/558 | PrefectServerApiToken | |||
| SEC101/559 | PrefectUserApiToken | |||
| SEC101/650 | ProctorioConsumerKey | |||
| SEC101/651 | ProctorioLinkageKey | |||
| SEC101/652 | ProctorioRegistrationKey | |||
| SEC101/560 | ProctorioSecretKeyV2 | |||
| SEC101/653 | PulumiAccessToken | |||
| SEC101/654 | PyPiApiToken | |||
| SEC101/561 | ReadMeApiKey | |||
| SEC101/562 | RedirectPizzaApiToken | |||
| SEC101/733 | ReplicateApiToken | |||
| SEC101/655 | RubyGemsApiKey | |||
| SEC101/751 | RunpodApiKey | |||
| SEC101/664 | SSLMateApiKey | |||
| SEC101/665 | SSLMateClusterSecret | |||
| SEC101/734 | SalesforceOAuthConsumerCredentials | |||
| SEC101/563 | SamsaraApiAccessToken | |||
| SEC101/564 | SamsaraOAuth2AccessToken | |||
| SEC101/764 | ScalrApiToken | |||
| SEC101/656 | SegmentPublicApiToken | |||
| SEC101/025 | SendGridApiKey | |||
| SEC101/760 | SentryOrganizationAuthToken | |||
| SEC101/761 | SentryUserAuthToken | |||
| SEC101/568 | ShippoLiveApiToken | |||
| SEC101/657 | ShippoTestApiToken | |||
| SEC101/039 | ShopifyAccessToken | |||
| SEC101/658 | ShopifyAppClientCredentials | |||
| SEC101/659 | ShopifyAppClientSecret | |||
| SEC101/608 | ShopifyAppOAuthAccessToken | |||
| SEC101/603 | ShopifyCustomAppAccessToken | |||
| SEC101/661 | ShopifyMarketplaceToken | |||
| SEC101/660 | ShopifyMerchantToken | |||
| SEC101/662 | ShopifyPartnerApiToken | |||
| SEC101/666 | ShopifyPrivateAppPassword | |||
| SEC101/040 | ShopifySharedSecret | |||
| SEC101/752 | SiemensApiToken | |||
| SEC101/005 | SlackApiToken | |||
| SEC101/571 | SlackAppLevelToken | |||
| SEC101/012 | SlackWebhook | |||
| SEC101/048 | SlackWorkflowKey | |||
| SEC101/683 | SplunkHecApiKey | |||
| SEC101/684 | SplunkJwtToken | |||
| SEC101/685 | SplunkSessionKey | |||
| SEC101/663 | SquareApplicationSecret | |||
| SEC101/011 | SquareCredentials | |||
| SEC101/010 | SquarePat | |||
| SEC101/016 | StripeLiveApiKey | |||
| SEC101/052 | StripeLiveRestrictedApiKey | |||
| SEC101/051 | StripeTestApiKey | |||
| SEC101/053 | StripeTestRestrictedApiKey | |||
| SEC101/667 | StripeWebhookSigningSecret | |||
| SEC101/668 | SupabaseServiceKey | |||
| SEC101/669 | TableauPersonalAccessToken | |||
| SEC101/049 | TelegramBotToken | |||
| SEC101/670 | TelnyxApiV2Key | |||
| SEC101/572 | TencentCloudCredentials | |||
| SEC101/573 | TerraformCloudEnterpriseToken | |||
| SEC101/753 | ThunderstoreApiToken | |||
| SEC101/024 | TwilioApiKeyCredentials | |||
| SEC101/018 | TwilioCredentials | |||
| SEC101/574 | TypeformPat | |||
| SEC101/200 | UnclassifiedCommonAnnotatedSecurityKey | |||
| SEC101/124 | VisualStudioAppCenterKey | |||
| SEC101/575 | WISEFlowApiKey | |||
| SEC101/591 | WakaTimeAppCredentials | |||
| SEC101/592 | WakaTimeOAuthAccessToken | |||
| SEC101/593 | WakaTimeOAuthRefreshToken | |||
| SEC101/688 | WeatherstackApiKey | |||
| SEC101/576 | WorkOSProductionApiKey | |||
| SEC101/671 | WorkOSStagingApiKey | |||
| SEC101/747 | XAIApiKey | |||
| SEC101/748 | XAIManagementApiKey | |||
| SEC101/255 | XboxLiveSas | |||
| SEC101/672 | YandexCloudApiKey | |||
| SEC101/676 | YandexCloudIamAccessSecret | |||
| SEC101/673 | YandexCloudIamCookie | |||
| SEC101/674 | YandexCloudIamToken | |||
| SEC101/675 | YandexDictionaryApiKey | |||
| SEC101/577 | YandexPassportOAuthToken | |||
| SEC101/677 | YandexPredictorApiKey | |||
| SEC101/678 | YandexTranslateApiKey | |||
| SEC101/578 | ZuploConsumerApiKey |
Non-provider patterns
The following table lists the non-provider generated secrets detected by secret scanning. Non-provider secrets are viewable by selecting "Other" from the confidence dropdown on the secret scanning tab. For more information, see Manage secret scanning alerts.
Tip
The detection of non-provider patterns is currently in beta and subject to change.
| Rule ID | Token Name | User Alerts | Validity Checking |
|---|---|---|---|
| SEC101/122 | AspNetMachineKey | ||
| SEC101/042 | DynatraceToken | ||
| SEC101/032 | GpgCredentials | ||
| SEC101/009 | LinkedInCredentials | ||
| SEC101/033 | MongoDbCredentials | ||
| SEC101/036 | MySqlCredentials | ||
| SEC101/056 | OpenSshPrivateKey | ||
| SEC101/013 | PemPrivateKey | ||
| SEC101/058 | PgpPrivateKey | ||
| SEC101/055 | Pkcs12CertificatePrivateKeyBundle | ||
| SEC101/054 | PkcsPrivateKey | ||
| SEC101/038 | PostgreSqlCredentials | ||
| SEC101/057 | PuttyPrivateKey | ||
| SEC101/041 | RabbitMQCredentials | ||
| SEC101/059 | RsaPrivateKey | ||
| SEC101/037 | SqlLegacyCredentials | ||
| SEC101/528 | UnclassifiedJwt | ||
| SEC101/127 | UrlCredentials |