Secret Detection Patterns

This reference provides regex patterns and search strategies for detecting secrets in repositories.

tools-only Updated Sep 29, 2026 7 repo stars

Install

Press C to copy

$ npx skillmds@latest add tools-only/secret-detection-patterns

Installs into ~/.claude/skills (or .claude/skills inside a project). Restart Claude Code to pick it up.

＋ Add to plugin

README badge

[![SkillMD](https://skillmd.com/badge/tools-only/secret-detection-patterns.svg)](https://skillmd.com/skills/tools-only/secret-detection-patterns)

Trust & safety

0 of 3 audits passed

Last audited Sep 23, 2026 · commit 2ea789d

Works with: Claude Code Claude.ai OpenAI Codex +

File contents

Secret Detection Patterns

This reference provides regex patterns and search strategies for detecting secrets in repositories.

Cloud Provider Credentials

AWS

Secret Type	Pattern	Example
Access Key ID	`AKIA[0-9A-Z]{16}`	`AKIAIOSFODNN7EXAMPLE`
Secret Access Key	`[A-Za-z0-9/+=]{40}` (near AWS context)	40-char base64 string
MWS Auth Token	`amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}`

Google Cloud Platform

Secret Type	Pattern	Example
API Key	`AIza[0-9A-Za-z\\-_]{35}`	`AIzaSyDaGmWKa4JsXZ-example`
OAuth Client ID	`[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com`
Service Account	`"type":\s*"service_account"` (in JSON)

Azure

Secret Type	Pattern	Example
Storage Account Key	`[A-Za-z0-9+/]{86}==`	88-char base64 string
Connection String	`DefaultEndpointsProtocol=https;AccountName=`
SAS Token	`sv=\d{4}-\d{2}-\d{2}&s[a-z]=`

Version Control Platforms

GitHub

Secret Type	Pattern	Example
Personal Access Token (new)	`ghp_[A-Za-z0-9]{36}`	`ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
Personal Access Token (old)	`[0-9a-f]{40}` (in GitHub context)	40-char hex string
OAuth Access Token	`gho_[A-Za-z0-9]{36}`
App Token	`ghu_[A-Za-z0-9]{36}`
App Refresh Token	`ghr_[A-Za-z0-9]{76}`
Fine-grained PAT	`github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}`

GitLab

Secret Type	Pattern	Example
Personal Access Token	`glpat-[A-Za-z0-9\-]{20}`
Pipeline Token	`glpt-[A-Za-z0-9\-]{20}`
Runner Token	`GR1348941[A-Za-z0-9\-]{20}`

Bitbucket

Secret Type	Pattern	Example
App Password	`ATBB[A-Za-z0-9]{32}`

AI/ML Services

OpenAI

Secret Type	Pattern	Example
API Key	`sk-[A-Za-z0-9]{48}`	`sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`
Project Key	`sk-proj-[A-Za-z0-9]{48}`

Anthropic

Secret Type	Pattern	Example
API Key	`sk-ant-[A-Za-z0-9\-]{95}`

Hugging Face

Secret Type	Pattern	Example
Token	`hf_[A-Za-z0-9]{34}`	`hf_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`

Cohere

Secret Type	Pattern	Example
API Key	`[A-Za-z0-9]{40}` (near Cohere context)

Authentication Tokens

JWT

Secret Type	Pattern	Example
JWT Token	`eyJ[A-Za-z0-9_-]\.eyJ[A-Za-z0-9_-]\.[A-Za-z0-9_-]*`	Base64 encoded JSON

OAuth/Bearer

Secret Type	Pattern	Example
Bearer Token	`[Bb]earer\s+[A-Za-z0-9\-_\.]+`
OAuth Token	`ya29\.[0-9A-Za-z\-_]+`	Google OAuth

Database Credentials

Connection Strings

Secret Type	Pattern	Example
PostgreSQL	`postgres(ql)?://[^:]+:[^@]+@`	`postgres://user:pass@host`
MySQL	`mysql://[^:]+:[^@]+@`	`mysql://user:pass@host`
MongoDB	`mongodb(\+srv)?://[^:]+:[^@]+@`	`mongodb://user:pass@host`
Redis	`redis://:[^@]+@`	`redis://:password@host`
JDBC	`jdbc:[a-z]+://[^:]+:[^@]+@`

Password Fields

Secret Type	Pattern	Example
Password assignment	`[Pp]assword\s[=:]\s['"][^'"]+['"]`	`password = "secret"`
DB Password	`DB_PASSWORD\s=\s['"]?[^'"\\s]+`

Private Keys

SSH/RSA Keys

Secret Type	Pattern	Example
RSA Private Key	`-----BEGIN RSA PRIVATE KEY-----`
OpenSSH Private Key	`-----BEGIN OPENSSH PRIVATE KEY-----`
DSA Private Key	`-----BEGIN DSA PRIVATE KEY-----`
EC Private Key	`-----BEGIN EC PRIVATE KEY-----`
PGP Private Key	`-----BEGIN PGP PRIVATE KEY BLOCK-----`
Generic Private Key	`-----BEGIN PRIVATE KEY-----`
Encrypted Private Key	`-----BEGIN ENCRYPTED PRIVATE KEY-----`

Communication Services

Slack

Secret Type	Pattern	Example
Bot Token	`xoxb-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24}`
User Token	`xoxp-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24}`
Webhook URL	`https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+`

Discord

Secret Type	Pattern	Example
Bot Token	`[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}`
Webhook URL	`https://discord(app)?\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+`

Twilio

Secret Type	Pattern	Example
Account SID	`AC[a-z0-9]{32}`
Auth Token	`[a-f0-9]{32}` (near Twilio context)

Payment Services

Stripe

Secret Type	Pattern	Example
Secret Key (Live)	`sk_live_[A-Za-z0-9]{24,}`
Secret Key (Test)	`sk_test_[A-Za-z0-9]{24,}`
Publishable Key	`pk_(live\|test)_[A-Za-z0-9]{24,}`

PayPal

Secret Type	Pattern	Example
Client ID	`A[A-Za-z0-9_-]{79}`

Square

Secret Type	Pattern	Example
Access Token	`sq0atp-[A-Za-z0-9_-]{22}`
OAuth Secret	`sq0csp-[A-Za-z0-9_-]{43}`

Other Services

SendGrid

Secret Type	Pattern	Example
API Key	`SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}`

Mailchimp

Secret Type	Pattern	Example
API Key	`[a-f0-9]{32}-us[0-9]{1,2}`

NPM

Secret Type	Pattern	Example
Token	`npm_[A-Za-z0-9]{36}`

PyPI

Secret Type	Pattern	Example
Token	`pypi-[A-Za-z0-9_-]{50,}`

Heroku

Secret Type	Pattern	Example
API Key	`[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}` (in Heroku context)

Generic Patterns

High-Entropy Strings

Strings matching these patterns warrant investigation:

Description	Pattern
API Key Generic	`[Aa]pi[_-]?[Kk]ey\s[=:]\s['"]?[A-Za-z0-9_\-]{20,}`
Secret Generic	`[Ss]ecret\s[=:]\s['"]?[A-Za-z0-9_\-]{20,}`
Token Generic	`[Tt]oken\s[=:]\s['"]?[A-Za-z0-9_\-]{20,}`
Credential	`[Cc]redential\s[=:]\s['"]?[A-Za-z0-9_\-]{20,}`

Environment Variable Values

Description	Pattern
Inline assignment	`[A-Z_]+_KEY=[^\\s]+`
Export statement	`export\s+[A-Z_]+(KEY\|SECRET\|TOKEN\|PASSWORD)=[^\\s]+`

Search Commands

Comprehensive grep search

# Search for common secret indicators
grep -rniE '(api[_-]?key|secret|token|password|credential|auth)\s*[=:]\s*['''"][^'''"]{8,}['''"]' .

# Search for AWS keys
grep -rniE 'AKIA[0-9A-Z]{16}' .

# Search for private keys
grep -rl '-----BEGIN.*PRIVATE KEY-----' .

# Search for connection strings
grep -rniE '(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@' .

Using git to search history

# Search all commits for pattern
git log -p --all -S 'AKIA' --source

# Search for pattern in specific branch
git log -p -S 'secret_value' branch_name

Files to Prioritize

Always check these files first:

.env, .env.*, .env.local, .env.production
config/*.json, config/*.yaml, config/*.yml
secrets.*, credentials.*
*.pem, *.key, *.p12, *.pfx
docker-compose*.yml, Dockerfile*
.github/workflows/*.yml, .gitlab-ci.yml
terraform.tfvars, *.tfstate
application.properties, application.yml (Java/Spring)
settings.py, local_settings.py (Django)
wp-config.php (WordPress)

---name: secret-detection-patternsdescription: This reference provides regex patterns and search strategies for detecting secrets in repositories.---# Secret Detection PatternsThis reference provides regex patterns and search strategies for detecting secrets in repositories.## Cloud Provider Credentials### AWS| Secret Type | Pattern | Example ||-------------|---------|---------|| Access Key ID | `AKIA[0-9A-Z]{16}` | `AKIAIOSFODNN7EXAMPLE` || Secret Access Key | `[A-Za-z0-9/+=]{40}` (near AWS context) | 40-char base64 string || MWS Auth Token | `amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}` | |### Google Cloud Platform| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `AIza[0-9A-Za-z\\-_]{35}` | `AIzaSyDaGmWKa4JsXZ-example` || OAuth Client ID | `[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com` | || Service Account | `"type":\s*"service_account"` (in JSON) | |### Azure| Secret Type | Pattern | Example ||-------------|---------|---------|| Storage Account Key | `[A-Za-z0-9+/]{86}==` | 88-char base64 string || Connection String | `DefaultEndpointsProtocol=https;AccountName=` | || SAS Token | `sv=\d{4}-\d{2}-\d{2}&s[a-z]=` | |## Version Control Platforms### GitHub| Secret Type | Pattern | Example ||-------------|---------|---------|| Personal Access Token (new) | `ghp_[A-Za-z0-9]{36}` | `ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` || Personal Access Token (old) | `[0-9a-f]{40}` (in GitHub context) | 40-char hex string || OAuth Access Token | `gho_[A-Za-z0-9]{36}` | || App Token | `ghu_[A-Za-z0-9]{36}` | || App Refresh Token | `ghr_[A-Za-z0-9]{76}` | || Fine-grained PAT | `github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}` | |### GitLab| Secret Type | Pattern | Example ||-------------|---------|---------|| Personal Access Token | `glpat-[A-Za-z0-9\-]{20}` | || Pipeline Token | `glpt-[A-Za-z0-9\-]{20}` | || Runner Token | `GR1348941[A-Za-z0-9\-]{20}` | |### Bitbucket| Secret Type | Pattern | Example ||-------------|---------|---------|| App Password | `ATBB[A-Za-z0-9]{32}` | |## AI/ML Services### OpenAI| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `sk-[A-Za-z0-9]{48}` | `sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` || Project Key | `sk-proj-[A-Za-z0-9]{48}` | |### Anthropic| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `sk-ant-[A-Za-z0-9\-]{95}` | |### Hugging Face| Secret Type | Pattern | Example ||-------------|---------|---------|| Token | `hf_[A-Za-z0-9]{34}` | `hf_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx` |### Cohere| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `[A-Za-z0-9]{40}` (near Cohere context) | |## Authentication Tokens### JWT| Secret Type | Pattern | Example ||-------------|---------|---------|| JWT Token | `eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*` | Base64 encoded JSON |### OAuth/Bearer| Secret Type | Pattern | Example ||-------------|---------|---------|| Bearer Token | `[Bb]earer\s+[A-Za-z0-9\-_\.]+` | || OAuth Token | `ya29\.[0-9A-Za-z\-_]+` | Google OAuth |## Database Credentials### Connection Strings| Secret Type | Pattern | Example ||-------------|---------|---------|| PostgreSQL | `postgres(ql)?://[^:]+:[^@]+@` | `postgres://user:pass@host` || MySQL | `mysql://[^:]+:[^@]+@` | `mysql://user:pass@host` || MongoDB | `mongodb(\+srv)?://[^:]+:[^@]+@` | `mongodb://user:pass@host` || Redis | `redis://:[^@]+@` | `redis://:password@host` || JDBC | `jdbc:[a-z]+://[^:]+:[^@]+@` | |### Password Fields| Secret Type | Pattern | Example ||-------------|---------|---------|| Password assignment | `[Pp]assword\s*[=:]\s*['"][^'"]+['"]` | `password = "secret"` || DB Password | `DB_PASSWORD\s*=\s*['"]?[^'"\\s]+` | |## Private Keys### SSH/RSA Keys| Secret Type | Pattern | Example ||-------------|---------|---------|| RSA Private Key | `-----BEGIN RSA PRIVATE KEY-----` | || OpenSSH Private Key | `-----BEGIN OPENSSH PRIVATE KEY-----` | || DSA Private Key | `-----BEGIN DSA PRIVATE KEY-----` | || EC Private Key | `-----BEGIN EC PRIVATE KEY-----` | || PGP Private Key | `-----BEGIN PGP PRIVATE KEY BLOCK-----` | || Generic Private Key | `-----BEGIN PRIVATE KEY-----` | || Encrypted Private Key | `-----BEGIN ENCRYPTED PRIVATE KEY-----` | |## Communication Services### Slack| Secret Type | Pattern | Example ||-------------|---------|---------|| Bot Token | `xoxb-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24}` | || User Token | `xoxp-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24}` | || Webhook URL | `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+` | |### Discord| Secret Type | Pattern | Example ||-------------|---------|---------|| Bot Token | `[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}` | || Webhook URL | `https://discord(app)?\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+` | |### Twilio| Secret Type | Pattern | Example ||-------------|---------|---------|| Account SID | `AC[a-z0-9]{32}` | || Auth Token | `[a-f0-9]{32}` (near Twilio context) | |## Payment Services### Stripe| Secret Type | Pattern | Example ||-------------|---------|---------|| Secret Key (Live) | `sk_live_[A-Za-z0-9]{24,}` | || Secret Key (Test) | `sk_test_[A-Za-z0-9]{24,}` | || Publishable Key | `pk_(live\|test)_[A-Za-z0-9]{24,}` | |### PayPal| Secret Type | Pattern | Example ||-------------|---------|---------|| Client ID | `A[A-Za-z0-9_-]{79}` | |### Square| Secret Type | Pattern | Example ||-------------|---------|---------|| Access Token | `sq0atp-[A-Za-z0-9_-]{22}` | || OAuth Secret | `sq0csp-[A-Za-z0-9_-]{43}` | |## Other Services### SendGrid| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}` | |### Mailchimp| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `[a-f0-9]{32}-us[0-9]{1,2}` | |### NPM| Secret Type | Pattern | Example ||-------------|---------|---------|| Token | `npm_[A-Za-z0-9]{36}` | |### PyPI| Secret Type | Pattern | Example ||-------------|---------|---------|| Token | `pypi-[A-Za-z0-9_-]{50,}` | |### Heroku| Secret Type | Pattern | Example ||-------------|---------|---------|| API Key | `[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}` (in Heroku context) | |## Generic Patterns### High-Entropy StringsStrings matching these patterns warrant investigation:| Description | Pattern ||-------------|---------|| API Key Generic | `[Aa]pi[_-]?[Kk]ey\s*[=:]\s*['"]?[A-Za-z0-9_\-]{20,}` || Secret Generic | `[Ss]ecret\s*[=:]\s*['"]?[A-Za-z0-9_\-]{20,}` || Token Generic | `[Tt]oken\s*[=:]\s*['"]?[A-Za-z0-9_\-]{20,}` || Credential | `[Cc]redential\s*[=:]\s*['"]?[A-Za-z0-9_\-]{20,}` |### Environment Variable Values| Description | Pattern ||-------------|---------|| Inline assignment | `[A-Z_]+_KEY=[^\\s]+` || Export statement | `export\s+[A-Z_]+(KEY\|SECRET\|TOKEN\|PASSWORD)=[^\\s]+` |## Search Commands### Comprehensive grep search```bash# Search for common secret indicatorsgrep -rniE '(api[_-]?key|secret|token|password|credential|auth)\s*[=:]\s*['''"][^'''"]{8,}['''"]' .# Search for AWS keysgrep -rniE 'AKIA[0-9A-Z]{16}' .# Search for private keysgrep -rl '-----BEGIN.*PRIVATE KEY-----' .# Search for connection stringsgrep -rniE '(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@' .```### Using git to search history```bash# Search all commits for patterngit log -p --all -S 'AKIA' --source# Search for pattern in specific branchgit log -p -S 'secret_value' branch_name```## Files to PrioritizeAlways check these files first:1. `.env`, `.env.*`, `.env.local`, `.env.production`2. `config/*.json`, `config/*.yaml`, `config/*.yml`3. `secrets.*`, `credentials.*`4. `*.pem`, `*.key`, `*.p12`, `*.pfx`5. `docker-compose*.yml`, `Dockerfile*`6. `.github/workflows/*.yml`, `.gitlab-ci.yml`7. `terraform.tfvars`, `*.tfstate`8. `application.properties`, `application.yml` (Java/Spring)9. `settings.py`, `local_settings.py` (Django)10. `wp-config.php` (WordPress)

tools-only/X-Skills/tree/main/automation/workflow/261-secret_patterns_d16fd451 commit 2ea789d787

Frequently asked questions

npx skillmds@latest add tools-only/secret-detection-patterns