examples/inputs/security-audit-samples/aws_credentials.txt
examples/inputs/security-audit-samples/config_with_secrets.env
examples/inputs/security-audit-samples/private_keys.pem
# Security Audit Profile
# Comprehensive profile for security audits focusing on credentials and sensitive data
decode = ["base64", "hex", "percent-encoding", "html-entity"]
max-file-size = 52428800 # 50 MiB
include-path-globs = []
exclude-path-globs = ["**/node_modules/**", "**/vendor/**", "**/.git/**", "**/venv/**", "**/__pycache__/**"]
tag = "security-audit"
# AWS Credentials
[[patterns]]
name = "AWS Access Key"
pattern = "AKIA[0-9A-Z]{16}"
type = "regex"
[[patterns]]
name = "AWS Secret Key"
pattern = "(?i)aws(.{0,20})?['\"][0-9a-zA-Z/+]{40}['\"]"
type = "regex"
# Private Keys
[[patterns]]
name = "RSA Private Key"
pattern = "-----BEGIN RSA PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "Generic Private Key"
pattern = "-----BEGIN PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "Encrypted Private Key"
pattern = "-----BEGIN ENCRYPTED PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "DSA Private Key"
pattern = "-----BEGIN DSA PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "EC Private Key"
pattern = "-----BEGIN EC PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "OpenSSH Private Key"
pattern = "-----BEGIN OPENSSH PRIVATE KEY-----"
type = "string"
[[patterns]]
name = "PGP Private Key"
pattern = "-----BEGIN PGP PRIVATE KEY BLOCK-----"
type = "string"
# SSH Keys
[[patterns]]
name = "SSH Public Key"
pattern = "ssh-rsa\\s+[A-Za-z0-9+/]+[=]{0,2}"
type = "regex"
# Passwords
[[patterns]]
name = "Password Assignment"
pattern = "(password|passwd|pwd)\\s*[:=]\\s*['\"][^'\"]+['\"]"
type = "regex"
case-insensitive = true
[[patterns]]
name = "Password in URL"
pattern = "://[^:]+:[^@]+@"
type = "regex"
# API Keys
[[patterns]]
name = "Generic API Key"
pattern = "api[_-]?key\\s*[:=]\\s*['\"][^'\"]+['\"]"
type = "regex"
case-insensitive = true
[[patterns]]
name = "Authorization Header"
pattern = "Authorization:\\s*(Bearer|Basic)\\s+\\S+"
type = "regex"
case-insensitive = true
# Database Connection Strings
[[patterns]]
name = "JDBC Connection URL"
pattern = "jdbc:[a-z]+://[^\\s'\"<>]+"
type = "regex"
case-insensitive = true
[[patterns]]
name = "MongoDB Connection"
pattern = "mongodb(\\+srv)?://[^\\s'\"<>]+"
type = "regex"
case-insensitive = true
[[patterns]]
name = "PostgreSQL Connection"
pattern = "postgres(ql)?://[^\\s'\"<>]+"
type = "regex"
case-insensitive = true
# Signatures for advanced detection
[[signatures]]
name = "High Entropy Files"
query = "SELECT sha256 FROM unique_files WHERE shannon_entropy > 7.5"
[[signatures]]
name = "Files with Credential Patterns"
query = "SELECT DISTINCT sha256 FROM pattern_matches WHERE pattern_name IN ('AWS Access Key', 'Password Assignment', 'Generic API Key', 'RSA Private Key')"
total_files 3 critical_count 0 high_count 0 medium_count 0 low_count 0 minimal_count 3 must_investigate_count 0 all_scores None generated_at 2025-12-03T09:19:43.519723872+00:00
characteristics_score file_type file_type_score must_investigate path pattern_count_score pattern_matches pattern_severity_score reasons risk_level score sha256 0 Other 0 False /config_with_secrets.env 15 14 13 ["14 suspicious patterns detected"] Minimal 28 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b 0 Other 0 False /private_keys.pem 5 3 5 ["3 suspicious patterns detected"] Minimal 10 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de 0 Other 0 False /aws_credentials.txt 5 3 5 ["3 suspicious patterns detected"] Minimal 10 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e
Empty CSV
path file_name sha256 file_created file_modified file_accessed mime_types_from_file_extension is_symbolic_link is_extracted_file is_decoded_file is_deobfuscated_file tag /private_keys.pem private_keys.pem 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z ["application/x-x509-ca-cert"] 0 0 0 0 /aws_credentials.txt aws_credentials.txt 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z ["text/plain"] 0 0 0 0 /config_with_secrets.env config_with_secrets.env b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z 2025-12-03T08:56:20.496889204Z [] 0 0 0 0
id sha256 pattern_name match_type match location length 1 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de RSA Private Key string -----BEGIN RSA PRIVATE KEY----- 0:0 31 2 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de Generic Private Key string -----BEGIN PRIVATE KEY----- 7:1 27 3 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de OpenSSH Private Key string -----BEGIN OPENSSH PRIVATE KEY----- 12:1 35 4 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e AWS Access Key regex AKIAIOSFODNN7EXAMPLE 4:18 20 5 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e AWS Access Key regex AKIAI44QH8DHBEXAMPLE 8:14 20 6 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e AWS Secret Key regex AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" 5:0 64 7 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b SSH Public Key regex ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFakeKeyForTestingPurposesOnlyDoNotUseInProduction1234567890abcdef 19:0 104 8 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password Assignment regex password = "MySecretPassword123!" 14:0 33 9 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password Assignment regex PASSWORD: "AnotherTestPassword" 15:0 31 10 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password Assignment regex password="admin123" 16:6 19 11 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password in URL regex ://admin:SuperSecretPassword123@ 4:23 32 12 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password in URL regex ://user:password123@ 5:23 20 13 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password in URL regex ://localhost:3306/testdb?user=root&password=secret# API ConfigurationAPI_KEY = "sk-1234567890abcdefghijklmnopqrstuvwxyz"api_key: "test-api-key-12345678"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U# User credentials (DO NOT USE IN PRODUCTION)password = "MySecretPassword123!"PASSWORD: "AnotherTestPassword"admin_password="admin123"# SSH Keyssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDFakeKeyForTestingPurposesOnlyDoNotUseInProduction1234567890abcdef test@ 6:19 548 14 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Password in URL regex ://user:password@ 22:3 17 15 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Generic API Key regex API_KEY = "sk-1234567890abcdefghijklmnopqrstuvwxyz" 9:0 51 16 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Generic API Key regex api_key: "test-api-key-12345678" 10:0 32 17 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b Authorization Header regex Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U 11:0 130 18 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b JDBC Connection URL regex jdbc:mysql://localhost:3306/testdb?user=root&password=secret 6:9 60 19 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b MongoDB Connection regex mongodb+srv://user:password123@cluster.mongodb.net/database 5:12 59 20 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b PostgreSQL Connection regex postgresql://admin:SuperSecretPassword123@db.example.com:5432/myapp 4:13 67
id signature_name sha256 1 Files with Credential Patterns 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e 2 Files with Credential Patterns b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b 3 Files with Credential Patterns 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de
sha256 sha1 md5 file_size mime_type_for_content shannon_entropy 0091c2a702bc8cc8130bffb5638cdbf0162396251f737c634568af23ec54a8de 4109a9c0dc6cdc2ea9dc6f37a0f2ad18e84a3394 91dbfca56498590a6d1b70c7beab2718 681 application/x-pem-file 5.3871589121742 5964c750b2220b877737247f9ea4cfa7c82eadb65d614ac92648bcf46fc8e91e c8e4b788302bc5aa5e7e664fc330be3799c1c6f0 0293f7de0c62a5250d8f27edb2c76912 314 text/plain 5.36704333995266 b56f97584131413e099ccf4effe9476ac892328888db8ce68a7a12f6d1cc479b 6b7f51ab4e5ebe29cd1a07b3322dadffd6755685 225ac88b0bc222303b86cfea552ce119 880 text/plain 5.76111717536657