# Secret / API-Key regex patterns — PCRE-compatible, one per line.
# Source: extracted from PageZero sensitive_scan.js (26 patterns).
# Usage:
#   grep -oP -f wordlists/secret-patterns.txt <file>
#   rg -oP -f wordlists/secret-patterns.txt <dir>
# Lines starting with `#` are ignored by grep -f (they need --regexp=); filter first:
#   grep -oP "$(grep -v '^#' wordlists/secret-patterns.txt | tr '\n' '|' | sed 's/|$//')" target.js
eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}
AKIA[0-9A-Z]{16}
(?i)(?:aws.?secret|SecretAccessKey)[^A-Za-z0-9/+=]*([A-Za-z0-9/+=]{40})
(?i)Bearer\s+([A-Za-z0-9_\-\.]{20,})
Basic\s+([A-Za-z0-9+/]{16,}={0,2})
-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----
(?i)(?:api[_-]?key|x-api-key|apikey)\s*[:=]\s*["']?([A-Za-z0-9_\-]{20,})["']?
(?i)(?:access_token|oauth_token)\s*[:=]\s*["']?([A-Za-z0-9_\-\.]{20,})["']?
(?i)(?:password|passwd|secret)\s*[:=]\s*["']([^"']{6,})["']
[MN][A-Za-z0-9]{23}\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{27}
(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{24,}
ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{82}
xox[bpsa]-[A-Za-z0-9\-]{10,}
(?i)(?:client_secret|GOCSPX)[^A-Za-z0-9]*([A-Za-z0-9_\-]{20,})
(?i)(?:msal|azure)[^A-Za-z0-9]*(?:token|secret|key)\s*[:=]\s*["']?([A-Za-z0-9_\-\.]{20,})["']?
(?:AC|SK)[a-f0-9]{32}
(?i)(?:twilio)[^A-Za-z0-9]*(?:token|secret|auth)\s*[:=]\s*["']?([A-Za-z0-9]{32})["']?
SG\.[A-Za-z0-9_\-]{22,}\.[A-Za-z0-9_\-]{22,}
(?i)(?:heroku)[^A-Za-z0-9]*(?:api[_-]?key|token)\s*[:=]\s*["']?([A-Za-z0-9\-]{36,})["']?
(?i)(?:apiKey|authDomain|storageBucket|messagingSenderId|appId)\s*[:=]\s*["']([^"']{10,})["']
shp(?:pa|at|ca|ss)_[A-Fa-f0-9]{32,}
npm_[A-Za-z0-9]{36}
key-[A-Za-z0-9]{32}
sq0[a-z]{3}-[A-Za-z0-9_\-]{22,}
glpat-[A-Za-z0-9_\-]{20}