truf-server/app/trufflehog-custom-detectors.yaml

detectors:
- name: GoogleAIStudio
  description: Google AI Studio API key in AQ-prefixed format.
  keywords:
  - AQ.
  regex:
    google_ai_studio_aq: '(?:^|[^A-Za-z0-9_-])(AQ\.[A-Za-z0-9_-]{50})(?:$|[^A-Za-z0-9_-])'
  entropy: 4.0
- name: QwenDashScope
  description: Alibaba Cloud Model Studio / DashScope Qwen API key in an explicit environment or JSON assignment.
  keywords:
  - DASHSCOPE_API_KEY
  - QWEN_API_KEY
  regex:
    qwen_dashscope_assignment: '(?:^|[^A-Za-z0-9_])(?:DASHSCOPE_API_KEY|QWEN_API_KEY)\s*["'']?\s*[:=]\s*["'']?(sk-(?:sp-)?[A-Za-z0-9][A-Za-z0-9_-]{20,505})(?:$|[^A-Za-z0-9_-])'
  entropy: 3.5
- name: DeepSeekApiKey
  description: DeepSeek API key in an explicit environment or JSON assignment.
  keywords:
  - DEEPSEEK_API_KEY
  regex:
    deepseek_api_key_assignment: '(?:^|[^A-Za-z0-9_])DEEPSEEK_API_KEY\s*["'']?\s*[:=]\s*["'']?(sk-[a-z0-9]{32})(?:$|[^A-Za-z0-9_-])'
  entropy: 3.5
- name: KimiMoonshot
  description: Kimi / Moonshot AI API key in an explicit environment or JSON assignment.
  keywords:
  - MOONSHOT_API_KEY
  - KIMI_API_KEY
  regex:
    kimi_moonshot_assignment: '(?:^|[^A-Za-z0-9_])(?:MOONSHOT_API_KEY|KIMI_API_KEY)\s*["'']?\s*[:=]\s*["'']?(sk-[A-Za-z0-9][A-Za-z0-9_-]{20,505})(?:$|[^A-Za-z0-9_-])'
  entropy: 3.5
- name: Xai
  description: xAI / Grok API key near xAI-specific context.
  keywords:
  - XAI_API_KEY
  - api.x.ai
  - xai-
  - xAI
  - grok
  - Grok
  regex:
    xai_context_before: '(?i)(?:XAI_API_KEY|api\.x\.ai|xAI|grok)[\s\S]{0,120}\b(xai-[A-Za-z0-9_-]{20,})\b'
  entropy: 3.5
- name: XaiContextAfter
  description: xAI / Grok API key before xAI-specific context.
  keywords:
  - XAI_API_KEY
  - api.x.ai
  - xai-
  - xAI
  - grok
  - Grok
  regex:
    xai_context_after: '(?i)\b(xai-[A-Za-z0-9_-]{20,})\b[\s\S]{0,120}(?:XAI_API_KEY|api\.x\.ai|xAI|grok)'
  entropy: 3.5
- name: ZaiGLM
  description: Z.ai / ZhipuAI / GLM API key near GLM-specific context.
  keywords:
  - ZAI_API_KEY
  - GLM_API_KEY
  - ZHIPUAI_API_KEY
  - BIGMODEL_API_KEY
  - api.z.ai
  - z.ai
  - Z.ai
  - bigmodel.cn
  - open.bigmodel.cn
  - zhipuai
  - ZhipuAI
  - GLM
  - glm
  - ChatGLM
  - chatglm
  - glm-
  regex:
    zai_glm_context_before: '(?i)(?:ZAI_API_KEY|GLM_API_KEY|ZHIPUAI_API_KEY|BIGMODEL_API_KEY|api\.z\.ai|bigmodel\.cn|open\.bigmodel\.cn|zhipuai|chatglm|glm)[\s\S]{0,120}\b((?:zai|sk)-[A-Za-z0-9][A-Za-z0-9_-]{20,505}|[A-Fa-f0-9]{32}\.[A-Za-z0-9_-]{16,128})\b'
  entropy: 3.5
- name: ZaiGLMContextAfter
  description: Z.ai / ZhipuAI / GLM API key before GLM-specific context.
  keywords:
  - ZAI_API_KEY
  - GLM_API_KEY
  - ZHIPUAI_API_KEY
  - BIGMODEL_API_KEY
  - api.z.ai
  - z.ai
  - Z.ai
  - bigmodel.cn
  - open.bigmodel.cn
  - zhipuai
  - ZhipuAI
  - GLM
  - glm
  - ChatGLM
  - chatglm
  - glm-
  regex:
    zai_glm_context_after: '(?i)\b((?:zai|sk)-[A-Za-z0-9][A-Za-z0-9_-]{20,505}|[A-Fa-f0-9]{32}\.[A-Za-z0-9_-]{16,128})\b[\s\S]{0,120}(?:ZAI_API_KEY|GLM_API_KEY|ZHIPUAI_API_KEY|BIGMODEL_API_KEY|api\.z\.ai|bigmodel\.cn|open\.bigmodel\.cn|zhipuai|chatglm|glm)'
  entropy: 3.5
- name: AzureFoundryEndpointBeforeKey
  description: Azure AI Foundry / model inference endpoint before an API key or bearer token.
  keywords:
  - services.ai.azure.com
  - models.ai.azure.com
  - inference.ai.azure.com
  - AZURE_AI_FOUNDRY
  - AZURE_FOUNDRY
  - AI_FOUNDRY
  - foundry
  regex:
    azure_foundry_endpoint_before_key: '(?i)((?:https?://)?[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:models\.ai\.azure\.com|services\.ai\.azure\.com|inference\.ai\.azure\.com)(?:/[^\s"''<>\\]*)?[\s\S]{0,240}(?:authorization|api[_-]?key|key|token|secret|credential|bearer)[^\n:=]{0,80}[:=]\s*["'']?(?:bearer\s+)?[A-Za-z0-9_./+=\-]{20,512})'
  entropy: 3.5
- name: AzureFoundryKeyBeforeEndpoint
  description: Azure AI Foundry / model inference API key or bearer token before an endpoint.
  keywords:
  - services.ai.azure.com
  - models.ai.azure.com
  - inference.ai.azure.com
  - AZURE_AI_FOUNDRY
  - AZURE_FOUNDRY
  - AI_FOUNDRY
  - foundry
  regex:
    azure_foundry_key_before_endpoint: '(?i)((?:authorization|api[_-]?key|key|token|secret|credential|bearer)[^\n:=]{0,80}[:=]\s*["'']?(?:bearer\s+)?[A-Za-z0-9_./+=\-]{20,512}[\s\S]{0,240}(?:https?://)?[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:models\.ai\.azure\.com|services\.ai\.azure\.com|inference\.ai\.azure\.com)(?:/[^\s"''<>\\]*)?)'
  entropy: 3.5