Secrets — Cloud Providers

AWS, Azure, GCP, Alibaba, Oracle, DigitalOcean, IBM and other cloud-provider credential detection rules.

All rules in this category are kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan.

Rule ID	Name	Severity	Detection
VNX-SEC-081	Cloudflare API token (cfk_)	Critical	keyword + regex
VNX-SEC-082	Cloudflare user/account token (cfut_/cfat_)	Critical	keyword + regex
VNX-SEC-083	Heroku API key (v2 HRKU-)	Critical	keyword + regex
VNX-SEC-084	Salesforce access token	Critical	regex
VNX-SEC-101	Oracle Cloud (OCI) API private key	Critical	keyword + regex
VNX-SEC-102	Oracle Cloud (OCI) auth token	High	keyword + regex + entropy
VNX-SEC-103	IBM Cloud IAM API key	Critical	keyword + regex + entropy
VNX-SEC-104	Tencent Cloud secret ID (AKID)	High	keyword + regex
VNX-SEC-105	Tencent Cloud secret key	Critical	keyword + regex + entropy
VNX-SEC-106	Yandex Cloud IAM token	High	keyword + regex
VNX-SEC-107	Yandex Cloud OAuth token	Critical	keyword + regex
VNX-SEC-108	Scaleway secret key (UUID)	Critical	keyword + regex
VNX-SEC-109	Scaleway access key (SCW prefix)	High	keyword + regex
VNX-SEC-110	Hetzner Cloud API token	Critical	keyword + regex + entropy
VNX-SEC-111	Linode personal access token	Critical	keyword + regex
VNX-SEC-112	Vultr API key	Critical	keyword + regex + entropy
VNX-SEC-113	Fastly API token	High	keyword + regex + entropy
VNX-SEC-114	Akamai EdgeGrid client token	High	keyword + regex
VNX-SEC-115	Akamai EdgeGrid client secret	Critical	keyword + regex + entropy
VNX-SEC-116	AWS SES SMTP password	High	keyword + regex + entropy
VNX-SEC-117	AWS MWS auth token	High	keyword + regex
VNX-SEC-118	AWS AppSync GraphQL API key (da2-)	High	keyword + regex
VNX-SEC-119	AWS Cognito identity/user pool ID	Medium	keyword + regex
VNX-SEC-120	AWS Cognito app client secret	High	keyword + regex + entropy
VNX-SEC-121	AWS Amplify app deploy/webhook ID	Medium	keyword + regex
VNX-SEC-122	AWS SNS topic ARN with credentials context	Medium	keyword + regex
VNX-SEC-123	Azure AD client secret	Critical	keyword + regex + entropy
VNX-SEC-124	Azure SAS token (shared access signature)	High	keyword + regex
VNX-SEC-125	Azure Service Bus connection string	Critical	keyword + regex
VNX-SEC-126	Azure Cosmos DB account key	Critical	keyword + regex
VNX-SEC-127	Azure Cognitive Search admin key	High	keyword + regex + entropy
VNX-SEC-128	Azure Container Registry password	High	keyword + regex + entropy
VNX-SEC-129	Azure DevOps personal access token	Critical	keyword + regex + entropy
VNX-SEC-130	GCP OAuth access token (ya29.)	High	keyword + regex
VNX-SEC-131	GCP OAuth refresh token (1//)	Critical	keyword + regex
VNX-SEC-132	Google reCAPTCHA secret key	Medium	keyword + regex
VNX-SEC-133	Firebase Cloud Messaging server key (AAAA)	High	keyword + regex
VNX-SEC-134	Firebase Realtime Database URL	Medium	keyword + regex
VNX-SEC-135	DigitalOcean Spaces access key	High	keyword + regex
VNX-SEC-136	DigitalOcean Spaces secret key	Critical	keyword + regex + entropy
VNX-SEC-137	Render API key (rnd_)	Critical	keyword + regex
VNX-SEC-138	Railway API/project token	Critical	keyword + regex
VNX-SEC-139	Fly.io API token (fo1_ / FlyV1)	Critical	keyword + regex
VNX-SEC-140	Aiven API token (aivenv1 / context)	Critical	keyword + regex + entropy
VNX-SEC-141	Cloudflare Origin CA key (v1.0-)	High	keyword + regex
VNX-SEC-142	Cloudflare Stream signing key context	High	keyword + regex + entropy
VNX-SEC-143	OVH application secret / consumer key	High	keyword + regex + entropy
VNX-SEC-144	UpCloud API credentials context	High	keyword + regex + entropy
VNX-SEC-145	Alibaba Cloud STS temporary access key (STS.)	High	keyword + regex
VNX-SEC-146	IBM Cloud Object Storage HMAC secret access key	Critical	keyword + regex + entropy
VNX-SEC-147	Azure Storage connection string	Critical	keyword + regex
VNX-SEC-148	GCP service account email + key context	High	keyword + regex
VNX-SEC-149	Google Maps Platform API key (AIza, restricted-context)	Medium	keyword + regex
VNX-SEC-150	Scaleway API token (UUID, context)	High	keyword + regex
VNX-SEC-151	Tencent Cloud COS connection (SecretId+SecretKey)	High	keyword + regex
VNX-SEC-152	Cloudflare Global API key (legacy 37-hex)	Critical	keyword + regex + entropy
VNX-SEC-153	GCP Firebase web API config apiKey (AIza, firebase context)	Medium	keyword + regex
VNX-SEC-154	Hetzner DNS API token (context)	High	keyword + regex + entropy
VNX-SEC-155	Vultr Object Storage S3 secret (context)	High	keyword + regex + entropy
VNX-SEC-156	Fastly Compute / service ID with token context	Medium	keyword + regex + entropy
VNX-SEC-157	Render deploy hook URL	Medium	keyword + regex
VNX-SEC-158	Linode Object Storage access key (context)	High	keyword + regex + entropy
VNX-SEC-159	Azure Maps subscription key (context)	Medium	keyword + regex + entropy
VNX-SEC-160	GCP Cloud Run / IAP service identity token (context)	High	keyword + regex
VNX-SEC-161	Alibaba Cloud secret access key (context)	Critical	keyword + regex + entropy
VNX-SEC-162	OVH application key (context)	Medium	keyword + regex + entropy
VNX-SEC-163	Yandex Cloud API key (AQVN context)	Critical	keyword + regex
VNX-SEC-164	IBM Cloud IAM bearer token (context)	High	keyword + regex
VNX-SEC-165	Aiven service connection URI (context)	Critical	keyword + regex
VNX-SEC-166	Scaleway IAM API secret key (context)	Critical	keyword + regex
VNX-SEC-167	Tencent Cloud SCF / API gateway secret (context)	Critical	keyword + regex + entropy
VNX-SEC-168	Cloudflare R2 S3 secret access key (context)	Critical	keyword + regex + entropy
VNX-SEC-169	Azure subscription / tenant credential bundle (context)	Critical	keyword + regex + entropy
VNX-SEC-170	GCP API key (AIza) generic	High	keyword + regex
VNX-SEC-171	Hetzner Cloud robot webservice password (context)	High	keyword + regex + entropy
VNX-SEC-172	Vultr deploy / API token (context, hex)	High	keyword + regex + entropy
VNX-SEC-173	Akamai EdgeGrid access token (context)	High	keyword + regex
VNX-SEC-174	GCP service account private key (PEM in JSON)	Critical	keyword + regex
VNX-SEC-175	Railway project deploy token (context, base64)	High	keyword + regex + entropy
VNX-SEC-176	Oracle Cloud (OCI) config fingerprint+key context	Medium	keyword + regex
VNX-SEC-177	DigitalOcean App Platform / function deploy URL (context)	Medium	keyword + regex
VNX-SEC-178	Fly.io org deploy token (FlyV1 macaroon)	High	keyword + regex
VNX-SEC-179	Tencent Cloud webhook URL (context)	Medium	keyword + regex

Remediation

Rotate any exposed credential immediately, remove it from source, and load it from a secrets manager or environment variable instead. Purge it from git history with git filter-repo. See CWE-798 and the OWASP Secrets Management Cheat Sheet.