Erweitert :
PATTERNS = [
# ── Mail Server ─────────────────────────────────────────────────────────
{'name':'SMTP URL', 'type':'smtp_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'smtps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'smtp[s]://user:pass@host[:port]', 'prefix_len':7},
{'name':'IMAP URL', 'type':'imap_url', 'category':'Mail Server', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'imaps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'imap[s]://user:pass@host[:port]', 'prefix_len':7},
# ── File Transfer ────────────────────────────────────────────────────────
{'name':'FTP URL', 'type':'ftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'ftps?://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?(?:/[^\s"\'<>]*)?', 'format_hint':'ftp[s]://user:pass@host[:port]', 'prefix_len':6},
{'name':'SFTP URL', 'type':'sftp_url', 'category':'FTP/SFTP', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sftp://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'sftp://user:pass@host[:port]', 'prefix_len':7},
# ── Remote Access ────────────────────────────────────────────────────────
{'name':'RDP URL', 'type':'rdp_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'rdp://[a-zA-Z0-9._%+\\\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'rdp://user:pass@host[:3389]', 'prefix_len':6},
{'name':'VNC URL', 'type':'vnc_url', 'category':'Remote Access', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'vnc://[a-zA-Z0-9._%+\-]+:[^@\s"\'<>{}\[\]|]{4,}@[a-zA-Z0-9.\-]+(?::\d+)?', 'format_hint':'vnc://user:pass@host[:5900]', 'prefix_len':6},
# ── VPN ──────────────────────────────────────────────────────────────────
{'name':'WireGuard Private Key', 'type':'wireguard_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?m)^PrivateKey\s*=\s*([A-Za-z0-9+/]{43}=)', 'format_hint':'PrivateKey = [44 base64 chars]', 'prefix_len':0},
{'name':'OpenVPN Static Key', 'type':'openvpn_key', 'category':'VPN', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OpenVPN Static key V1-----', 'format_hint':'-----BEGIN OpenVPN Static key V1-----', 'prefix_len':37},
# ── Private Keys / SSH ───────────────────────────────────────────────────
{'name':'RSA Private Key', 'type':'rsa_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN RSA PRIVATE KEY-----', 'format_hint':'-----BEGIN RSA PRIVATE KEY----- (PEM)', 'prefix_len':31},
{'name':'OpenSSH Private Key', 'type':'openssh_private_key','category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN OPENSSH PRIVATE KEY-----', 'format_hint':'-----BEGIN OPENSSH PRIVATE KEY----- (PEM)', 'prefix_len':35},
{'name':'EC Private Key', 'type':'ec_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN EC PRIVATE KEY-----', 'format_hint':'-----BEGIN EC PRIVATE KEY----- (PEM)', 'prefix_len':29},
{'name':'PGP Private Key', 'type':'pgp_private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'format_hint':'-----BEGIN PGP PRIVATE KEY BLOCK-----', 'prefix_len':37},
{'name':'Generic Private Key', 'type':'private_key', 'category':'Private Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'-----BEGIN PRIVATE KEY-----', 'format_hint':'-----BEGIN PRIVATE KEY----- (PKCS#8)', 'prefix_len':26},
# ── Database ─────────────────────────────────────────────────────────────
{'name':'Database Connection URL', 'type':'database_url', 'category':'Database', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)(mongodb(?:\+srv)?|postgres(?:ql)?|mysql|mariadb|redis(?:is)?|amqp|mssql|cockroachdb|cassandra|couchdb)://[a-zA-Z0-9._\-]+:[^@\s"\'<>{}\[\]]{4,}@[a-zA-Z0-9._\-]+', 'format_hint':'protocol://user:pass@host/db', 'prefix_len':12},
# ── Cloud ────────────────────────────────────────────────────────────────
{'name':'AWS Access Key ID', 'type':'aws_access_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'AKIA[0-9A-Z]{16}', 'format_hint':'AKIA[16 uppercase alphanumeric]', 'prefix_len':4},
{'name':'AWS Secret Access Key', 'type':'aws_secret_key', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'(?i)aws[_\-\s\.]{0,5}secret[_\-\s\.]{0,10}["\']?\b([A-Za-z0-9/+=]{40})\b', 'format_hint':'aws_secret = [40 base64]', 'prefix_len':0},
{'name':'Azure Storage Connection', 'type':'azure_storage', 'category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'DefaultEndpointsProtocol=https;AccountName=[^;]+;AccountKey=[A-Za-z0-9+/=]{85,}', 'format_hint':'AccountKey=[88 base64]', 'prefix_len':32},
{'name':'DigitalOcean Token', 'type':'do_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'dop_v1_[a-fA-F0-9]{64}', 'format_hint':'dop_v1_[64 hex]', 'prefix_len':7},
{'name':'Google Service Account', 'type':'google_service_acct','category':'Cloud', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'"type"\s*:\s*"service_account"', 'format_hint':'{"type":"service_account",...}', 'prefix_len':27},
# ── Payment ──────────────────────────────────────────────────────────────
{'name':'Stripe Live Secret Key', 'type':'stripe_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk_live_[0-9a-zA-Z]{24,}', 'format_hint':'sk_live_[24+ alphanumeric]', 'prefix_len':8},
{'name':'PayPal Client Secret', 'type':'paypal_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)paypal[^"\']{0,30}(?:secret|client_secret)[^"\']{0,10}["\']([A-Za-z0-9\-_]{20,})["\']', 'format_hint':'paypal client_secret = "[20+]"', 'prefix_len':0},
# ── AI / LLM ─────────────────────────────────────────────────────────────
{'name':'OpenAI API Key', 'type':'openai_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-[a-zA-Z0-9]{48}', 'format_hint':'sk-[48 alphanumeric]', 'prefix_len':7},
{'name':'OpenAI Project Key', 'type':'openai_project_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-proj-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-proj-[20+ chars]', 'prefix_len':10},
{'name':'Anthropic API Key', 'type':'anthropic_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'sk-ant-[a-zA-Z0-9\-_]{20,}', 'format_hint':'sk-ant-[20+ chars]', 'prefix_len':10},
# ── Auth Tokens ──────────────────────────────────────────────────────────
{'name':'GitHub PAT (classic)', 'type':'github_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'ghp_[A-Za-z0-9]{36}', 'format_hint':'ghp_[36 alphanumeric]', 'prefix_len':4},
{'name':'GitHub Fine-grained PAT', 'type':'github_fine_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'github_pat_[A-Za-z0-9_]{82}', 'format_hint':'github_pat_[82 chars]', 'prefix_len':11},
{'name':'Slack Bot Token', 'type':'slack_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'xoxb-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24}', 'format_hint':'xoxb-[team]-[bot]-[24]', 'prefix_len':5},
{'name':'Discord Bot Token', 'type':'discord_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'[MN][a-zA-Z0-9_\-]{23,25}\.[a-zA-Z0-9_\-]{6}\.[a-zA-Z0-9_\-]{27}', 'format_hint':'[M/N][23-25].[6].[27]', 'prefix_len':6},
{'name':'Telegram Bot Token', 'type':'telegram_bot', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\b[0-9]{9,10}:AA[a-zA-Z0-9_\-]{33}\b', 'format_hint':'[bot_id]:AA[33]', 'prefix_len':10},
{'name':'SendGrid API Key', 'type':'sendgrid_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'SG\.[a-zA-Z0-9_\-]{22}\.[a-zA-Z0-9_\-]{43}', 'format_hint':'SG.[22].[43]', 'prefix_len':3},
{'name':'Google API Key', 'type':'google_api_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'AIza[0-9A-Za-z\-_]{35}', 'format_hint':'AIza[35 alphanumeric]', 'prefix_len':4},
{'name':'Mailgun API Key', 'type':'mailgun_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bkey-[0-9a-zA-Z]{32}\b', 'format_hint':'key-[32 alphanumeric]', 'prefix_len':4},
{'name':'NPM Access Token', 'type':'npm_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'npm_[A-Za-z0-9]{36}', 'format_hint':'npm_[36 alphanumeric]', 'prefix_len':4},
# ── Additional AI providers ──────────────────────────────────────────────
{'name':'Groq API Key', 'type':'groq_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'gsk_[A-Za-z0-9]{52}', 'format_hint':'gsk_[52 chars]', 'prefix_len':4},
{'name':'Replicate API Key', 'type':'replicate_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'r8_[A-Za-z0-9]{40}', 'format_hint':'r8_[40 chars]', 'prefix_len':3},
{'name':'Mistral API Key', 'type':'mistral_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'MISTRAL_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'MISTRAL_API_KEY=[32-64 chars]', 'prefix_len':0},
{'name':'Cohere API Key', 'type':'cohere_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'COHERE_API_KEY\s*[=:]\s*["\']?([A-Za-z0-9_\-]{32,64})["\']?', 'format_hint':'COHERE_API_KEY=[32-64 chars]', 'prefix_len':0},
{'name':'Together AI Key', 'type':'together_key', 'category':'AI API Keys', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'TOGETHER(?:AI)?_API_KEY\s*[=:]\s*["\']?([a-f0-9]{64})["\']?', 'format_hint':'TOGETHER_API_KEY=[64 hex chars]', 'prefix_len':0},
# ── Stripe test key (lower severity — no real money) ─────────────────────
{'name':'Stripe Test Key', 'type':'stripe_test', 'category':'Payment Keys', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'sk_test_[A-Za-z0-9]{24,}', 'format_hint':'sk_test_[24+ chars]', 'prefix_len':8},
# ── Version Control ──────────────────────────────────────────────────────
{'name':'GitLab PAT', 'type':'gitlab_pat', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'glpat-[A-Za-z0-9\-_]{20}', 'format_hint':'glpat-[20 chars]', 'prefix_len':6},
{'name':'GitLab CI Token', 'type':'gitlab_ci_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'glcbt-[A-Za-z0-9\-_]{20}', 'format_hint':'glcbt-[20 chars]', 'prefix_len':6},
# ── Cloud / Infrastructure ───────────────────────────────────────────────
{'name':'Heroku API Key', 'type':'heroku_key', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'(?i)HEROKU_API_KEY\s*[=:]\s*["\']?([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})["\']?', 'format_hint':'HEROKU_API_KEY=[UUID]', 'prefix_len':0},
{'name':'Fly.io Token', 'type':'flyio_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'fo1_[A-Za-z0-9\-_]{40,}', 'format_hint':'fo1_[40+ chars]', 'prefix_len':4},
{'name':'Cloudflare API Token', 'type':'cloudflare_token', 'category':'Cloud', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'(?i)CLOUDFLARE_(?:API_)?TOKEN\s*[=:]\s*["\']?([A-Za-z0-9_\-]{40})["\']?', 'format_hint':'CLOUDFLARE_TOKEN=[40 chars]', 'prefix_len':0},
{'name':'Azure AD Client Secret', 'type':'azure_client_secret','category':'Cloud', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)AZURE_CLIENT_SECRET\s*[=:]\s*["\']?([A-Za-z0-9~._\-]{30,})["\']?', 'format_hint':'AZURE_CLIENT_SECRET=[30+ chars]', 'prefix_len':0},
# ── Developer Tools ──────────────────────────────────────────────────────
{'name':'Hugging Face Token', 'type':'huggingface_token', 'category':'AI API Keys', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'hf_[a-zA-Z0-9]{34}', 'format_hint':'hf_[34 chars]', 'prefix_len':3},
{'name':'Databricks PAT', 'type':'databricks_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'dapi[a-f0-9]{32}', 'format_hint':'dapi[32 hex]', 'prefix_len':4},
{'name':'PyPI API Token', 'type':'pypi_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'pypi-[A-Za-z0-9\-_]{32,}', 'format_hint':'pypi-[32+ chars]', 'prefix_len':5},
{'name':'HashiCorp Vault Token', 'type':'vault_token', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'hvs\.[A-Za-z0-9]{90,}', 'format_hint':'hvs.[90+ chars]', 'prefix_len':4},
# ── Webhooks ─────────────────────────────────────────────────────────────
{'name':'Slack Incoming Webhook', 'type':'slack_webhook', 'category':'Webhooks', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://hooks\.slack\.com/services/T[A-Z0-9]{6,11}/B[A-Z0-9]{8,11}/[A-Za-z0-9]{24}', 'format_hint':'hooks.slack.com/services/T.../B.../[24]', 'prefix_len':29},
{'name':'Discord Webhook URL', 'type':'discord_webhook', 'category':'Webhooks', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://discord(?:app)?\.com/api/webhooks/[0-9]{17,20}/[A-Za-z0-9_\-]{60,80}', 'format_hint':'discord.com/api/webhooks/[id]/[token]', 'prefix_len':33},
{'name':'Twilio Account SID', 'type':'twilio_sid', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bAC[a-f0-9]{32}\b', 'format_hint':'AC[32 hex]', 'prefix_len':2},
{'name':'Twilio Auth Token', 'type':'twilio_auth', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'MEDIUM', 'pattern':r'(?i)TWILIO_AUTH_TOKEN\s*[=:]\s*["\']?([a-f0-9]{32})["\']?', 'format_hint':'TWILIO_AUTH_TOKEN=[32 hex]', 'prefix_len':0},
# ── SaaS / Analytics / Identity ──────────────────────────────────────────
{'name':'New Relic License Key', 'type':'newrelic_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'NRAK-[A-Z0-9]{27}', 'format_hint':'NRAK-[27 uppercase]', 'prefix_len':5},
{'name':'Sentry DSN', 'type':'sentry_dsn', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'https://[a-f0-9]{32}@(?:o[0-9]+\.)?(?:ingest\.)?sentry\.io/[0-9]+', 'format_hint':'https://[32hex]@...sentry.io/[id]', 'prefix_len':8},
{'name':'Okta API Token', 'type':'okta_token', 'category':'Auth Tokens', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'SSWS[A-Za-z0-9_\-]{40,}', 'format_hint':'SSWS[40+ chars]', 'prefix_len':4},
{'name':'Notion Integration Token', 'type':'notion_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'secret_[A-Za-z0-9]{43}', 'format_hint':'secret_[43 chars]', 'prefix_len':7},
{'name':'Airtable Personal Token', 'type':'airtable_key', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bpat[A-Za-z0-9]{14}\.[a-f0-9]{64}\b', 'format_hint':'pat[14].[64hex]', 'prefix_len':3},
{'name':'Mapbox Token', 'type':'mapbox_token', 'category':'Auth Tokens', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'pk\.eyJ1[A-Za-z0-9\-_]+\.eyJ[A-Za-z0-9\-_]+', 'format_hint':'pk.eyJ1...(Mapbox JWT)', 'prefix_len':3},
# ── E-Commerce ────────────────────────────────────────────────────────────
{'name':'Shopify Private App Token', 'type':'shopify_token', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'shpat_[a-fA-F0-9]{32}', 'format_hint':'shpat_[32 hex]', 'prefix_len':6},
{'name':'Shopify Shared Secret', 'type':'shopify_secret', 'category':'Payment', 'severity':'CRITICAL','confidence':'HIGH', 'pattern':r'shpss_[a-fA-F0-9]{32}', 'format_hint':'shpss_[32 hex]', 'prefix_len':6},
{'name':'WooCommerce Consumer Key', 'type':'woo_key', 'category':'Payment', 'severity':'HIGH', 'confidence':'HIGH', 'pattern':r'\bck_[a-f0-9]{40}\b', 'format_hint':'ck_[40 hex]', 'prefix_len':3},
# ── Email Credentials ─────────────────────────────────────────────────────
{'name':'Mail Password (ENV)', 'type':'mail_password', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'(?i)(?:MAIL|EMAIL|SMTP)_(?:PASS(?:WORD)?|PWD)\s*[=:]\s*["\']?([^\s"\']{8,})["\']?', 'format_hint':'MAIL_PASSWORD=[8+ chars]', 'prefix_len':0},
{'name':'Gmail App Password', 'type':'gmail_app_pass', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'(?i)(?:gmail|google)[^"\']{0,40}["\']([a-z]{4} [a-z]{4} [a-z]{4} [a-z]{4})["\']', 'format_hint':'xxxx xxxx xxxx xxxx (Gmail App Pass)', 'prefix_len':0},
{'name':'Email:Password Pair', 'type':'email_password', 'category':'Email Credentials', 'severity':'HIGH', 'confidence':'MEDIUM', 'pattern':r'[a-zA-Z0-9._%+\-]{3,40}@(?!github\.com|gitlab\.com|bitbucket\.org|example\.|test\.)[a-zA-Z0-9.\-]{3,}\.[a-z]{2,6}:(?!//)[A-Za-z0-9!#$%^&*()\-_+=]{8,64}', 'format_hint':'
[email protected]:password', 'prefix_len':0},
]
