Secrets — SaaS & Developer APIs

Atlassian, Notion, Linear, Airtable, Shopify, Figma, Vercel, Netlify and other SaaS tokens.

All rules in this category are kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan.

Rule ID	Name	Severity	Detection
VNX-SEC-090	Figma personal access token (figd_)	Critical	keyword + regex
VNX-SEC-091	Vercel API token (vc*_)	Critical	keyword + regex
VNX-SEC-092	Netlify API token (nf*_)	Critical	keyword + regex
VNX-SEC-093	HubSpot private app token (pat-)	Critical	keyword + regex
VNX-SEC-094	Canva client secret (cnvca)	Critical	keyword + regex
VNX-SEC-100	Linear API key (lin_api_)	High	keyword + regex
VNX-SEC-481	Auth0 client secret	Critical	keyword + regex + entropy
VNX-SEC-482	Auth0 Management API token (JWT)	Critical	keyword + regex + entropy
VNX-SEC-483	Okta SSWS API token	Critical	keyword + regex
VNX-SEC-484	Okta API token (00 prefix)	Critical	keyword + regex + entropy
VNX-SEC-485	Clerk secret key (live)	Critical	keyword + regex
VNX-SEC-486	Clerk secret key (test)	High	keyword + regex
VNX-SEC-487	Clerk publishable key (live)	Medium	keyword + regex
VNX-SEC-488	WorkOS API key (live)	Critical	keyword + regex
VNX-SEC-489	WorkOS API key (test)	High	keyword + regex
VNX-SEC-490	Stytch secret (live)	Critical	keyword + regex
VNX-SEC-491	Stytch secret (test)	High	keyword + regex
VNX-SEC-492	Supabase service_role JWT	Critical	keyword + regex + entropy
VNX-SEC-493	Supabase anon JWT	Medium	keyword + regex + entropy
VNX-SEC-494	Supabase access token (sbp_)	Critical	keyword + regex
VNX-SEC-495	Contentful Content Management token (CFPAT-)	Critical	keyword + regex
VNX-SEC-496	Contentful Content Delivery API token	Medium	keyword + regex + entropy
VNX-SEC-497	Contentful Content Preview API token	High	keyword + regex + entropy
VNX-SEC-498	Sanity API token (sk)	High	keyword + regex + entropy
VNX-SEC-499	Storyblok personal access token	High	keyword + regex + entropy
VNX-SEC-500	Algolia admin API key	Critical	keyword + regex + entropy
VNX-SEC-501	Typesense API key	High	keyword + regex + entropy
VNX-SEC-502	Meilisearch master/API key	Critical	keyword + regex + entropy
VNX-SEC-503	Typeform personal access token (tfp_)	High	keyword + regex
VNX-SEC-504	Calendly personal access token	High	keyword + regex + entropy
VNX-SEC-505	Webflow API token	High	keyword + regex + entropy
VNX-SEC-506	Framer API token	High	keyword + regex + entropy
VNX-SEC-507	Retool API token	Critical	keyword + regex + entropy
VNX-SEC-508	Asana personal access token (1/)	High	keyword + regex
VNX-SEC-509	Asana personal access token (2/)	High	keyword + regex
VNX-SEC-510	monday.com API token (JWT)	High	keyword + regex + entropy
VNX-SEC-511	ClickUp personal API token (pk_)	High	keyword + regex
VNX-SEC-512	Trello API key	Medium	keyword + regex + entropy
VNX-SEC-513	Trello API token	High	keyword + regex + entropy
VNX-SEC-514	Miro access token	High	keyword + regex + entropy
VNX-SEC-515	Loom API key	Medium	keyword + regex + entropy
VNX-SEC-516	Dropbox short-lived access token (sl.)	High	keyword + regex
VNX-SEC-517	Dropbox long-lived access token	Critical	keyword + regex + entropy
VNX-SEC-518	Box developer token	High	keyword + regex + entropy
VNX-SEC-519	Zoom Server-to-Server OAuth client secret	Critical	keyword + regex + entropy
VNX-SEC-520	Zoom JWT app token	High	keyword + regex + entropy
VNX-SEC-521	DocuSign integration secret key	Critical	keyword + regex + entropy
VNX-SEC-522	Dropbox Sign (HelloSign) API key	Critical	keyword + regex + entropy
VNX-SEC-523	Adobe IMS client secret	Critical	keyword + regex + entropy
VNX-SEC-524	Salesforce consumer key (3MVG9)	High	keyword + regex
VNX-SEC-525	Salesforce refresh token (5Aep861)	Critical	keyword + regex
VNX-SEC-526	ServiceNow credentials	High	keyword + regex + entropy
VNX-SEC-527	Zoho OAuth token (1000.)	High	keyword + regex
VNX-SEC-528	Freshservice/Freshworks API key	High	keyword + regex + entropy
VNX-SEC-529	Pipedrive API token	High	keyword + regex + entropy
VNX-SEC-530	Close API key	High	keyword + regex
VNX-SEC-531	Copper API key	High	keyword + regex + entropy
VNX-SEC-532	Segment write key	Medium	keyword + regex + entropy
VNX-SEC-533	LaunchDarkly SDK key (sdk-)	High	keyword + regex
VNX-SEC-534	LaunchDarkly API access token (api-)	Critical	keyword + regex
VNX-SEC-535	LaunchDarkly mobile key (mob-)	Medium	keyword + regex
VNX-SEC-536	Split.io API key	High	keyword + regex + entropy
VNX-SEC-537	Statsig server secret key (secret-)	High	keyword + regex
VNX-SEC-538	Unleash API token	High	keyword + regex + entropy
VNX-SEC-539	Optimizely SDK/API token	High	keyword + regex + entropy
VNX-SEC-540	PostHog personal API key (phx_)	Critical	keyword + regex
VNX-SEC-541	PostHog project API key (phc_)	Medium	keyword + regex
VNX-SEC-542	Mixpanel API secret	High	keyword + regex + entropy
VNX-SEC-543	Mixpanel service account secret	Critical	keyword + regex + entropy
VNX-SEC-544	Amplitude API key	Medium	keyword + regex + entropy
VNX-SEC-545	Amplitude secret key	High	keyword + regex + entropy
VNX-SEC-546	Pendo integration key	High	keyword + regex + entropy
VNX-SEC-547	Heap app ID / API key	Medium	keyword + regex + entropy
VNX-SEC-548	FullStory API key	High	keyword + regex + entropy
VNX-SEC-549	Hotjar API key	Medium	keyword + regex + entropy
VNX-SEC-550	Smartsheet API access token	High	keyword + regex + entropy
VNX-SEC-551	WorkOS publishable key	Medium	keyword + regex
VNX-SEC-552	Okta client secret	Critical	keyword + regex + entropy
VNX-SEC-553	Auth0 API key/token (generic)	High	keyword + regex + entropy
VNX-SEC-554	Sanity project token (keyword)	High	keyword + regex + entropy
VNX-SEC-555	Algolia search/usage key (keyword)	Medium	keyword + regex + entropy
VNX-SEC-556	Statsig console API key (console-)	Critical	keyword + regex
VNX-SEC-557	Meilisearch tenant token (JWT)	Medium	keyword + regex + entropy
VNX-SEC-558	Contentful management token (keyword)	Critical	keyword + regex + entropy
VNX-SEC-559	Calendly OAuth client secret	High	keyword + regex + entropy
VNX-SEC-560	Webflow site API token (Bearer keyword)	High	keyword + regex + entropy
VNX-SEC-675	Twitch client ID	Medium	keyword + regex + entropy
VNX-SEC-676	Twitch client secret	High	keyword + regex + entropy
VNX-SEC-677	Twitch OAuth access token (oauth:)	High	keyword + regex
VNX-SEC-678	Spotify client secret	High	keyword + regex + entropy
VNX-SEC-679	Reddit client secret	High	keyword + regex + entropy
VNX-SEC-680	LinkedIn client secret	High	keyword + regex + entropy
VNX-SEC-681	Facebook/Meta app secret	Critical	keyword + regex + entropy
VNX-SEC-682	Facebook/Meta access token (EAAB)	Critical	keyword + regex + entropy
VNX-SEC-683	Instagram access token (IGQ)	Critical	keyword + regex + entropy
VNX-SEC-684	Twitter/X API key (consumer key)	High	keyword + regex + entropy
VNX-SEC-685	Twitter/X API secret (consumer secret)	High	keyword + regex + entropy
VNX-SEC-686	Twitter/X bearer token (AAAAAAAA)	High	keyword + regex + entropy
VNX-SEC-687	Twitter/X access token	High	keyword + regex + entropy
VNX-SEC-688	TikTok client secret	High	keyword + regex + entropy
VNX-SEC-689	Pinterest access token	High	keyword + regex + entropy
VNX-SEC-690	Snapchat client secret	High	keyword + regex + entropy
VNX-SEC-691	Mastodon access token	High	keyword + regex + entropy
VNX-SEC-692	Bluesky app password	High	keyword + regex
VNX-SEC-693	WooCommerce consumer key (ck_)	High	keyword + regex
VNX-SEC-694	WooCommerce consumer secret (cs_)	High	keyword + regex
VNX-SEC-695	Magento integration access token	High	keyword + regex + entropy
VNX-SEC-696	PuTTY private key MAC line	High	keyword + regex
VNX-SEC-701	Spotify access token (BQ…)	High	keyword + regex + entropy
VNX-SEC-702	YouTube data API client secret (GOCSPX context)	High	keyword + regex
VNX-SEC-703	TikTok access token (act.)	High	keyword + regex + entropy
VNX-SEC-704	Reddit refresh token	High	keyword + regex + entropy
VNX-SEC-705	Discourse API key	High	keyword + regex + entropy
VNX-SEC-709	LinkedIn access token (AQ…)	High	keyword + regex + entropy
VNX-SEC-710	Snapchat OAuth access token	High	keyword + regex + entropy
VNX-SEC-711	Pinterest app secret	High	keyword + regex + entropy
VNX-SEC-712	Mastodon application client secret	High	keyword + regex + entropy
VNX-SEC-720	Twitch app access token (context)	High	keyword + regex + entropy
VNX-SEC-721	Facebook page/app access token (context)	High	keyword + regex + entropy
VNX-SEC-722	YouTube/Google OAuth refresh token (1//)	Critical	keyword + regex + entropy
VNX-SEC-723	Twitch refresh token (context)	High	keyword + regex + entropy
VNX-SEC-726	Discord webhook URL	Medium	keyword + regex
VNX-SEC-727	Slack webhook URL	Medium	keyword + regex
VNX-SEC-728	Telegram bot token	High	keyword + regex
VNX-SEC-729	Vimeo access token	High	keyword + regex + entropy
VNX-SEC-730	Twitch extension secret	High	keyword + regex + entropy
VNX-SEC-736	PostHog project API key (phc_)	Medium	keyword + regex
VNX-SEC-737	PostHog personal API key (phx_)	High	keyword + regex
VNX-SEC-738	LaunchDarkly SDK/API key (sdk-/api-)	High	keyword + regex
VNX-SEC-739	Flagsmith / Unleash feature-flag server key	Medium	keyword + regex + entropy
VNX-SEC-740	Statsig server secret key (secret-)	High	keyword + regex + entropy
VNX-SEC-741	Workday OAuth client secret	Critical	keyword + regex + entropy
VNX-SEC-742	Workday ISU integration password	High	keyword + regex + entropy
VNX-SEC-743	SAP BTP XSUAA client secret	Critical	keyword + regex + entropy
VNX-SEC-744	SAP SuccessFactors OAuth API key	High	keyword + regex + entropy
VNX-SEC-745	SAP Concur OAuth access token	High	keyword + regex + entropy
VNX-SEC-746	SAP Concur OAuth refresh token	Critical	keyword + regex + entropy
VNX-SEC-747	NetSuite TBA consumer secret	Critical	keyword + regex + entropy
VNX-SEC-748	NetSuite TBA token secret	Critical	keyword + regex + entropy
VNX-SEC-749	ADP OAuth client secret	High	keyword + regex + entropy
VNX-SEC-750	Paychex OAuth client secret	High	keyword + regex + entropy
VNX-SEC-751	Justworks API access token	High	keyword + regex + entropy
VNX-SEC-752	Gusto OAuth access token	High	keyword + regex
VNX-SEC-753	Gusto API token	High	keyword + regex + entropy
VNX-SEC-754	BambooHR API key	High	keyword + regex + entropy
VNX-SEC-755	Rippling API token	Critical	keyword + regex + entropy
VNX-SEC-756	Deel API token	High	keyword + regex + entropy
VNX-SEC-757	Expensify partner user secret	High	keyword + regex + entropy
VNX-SEC-758	Greenhouse Harvest API key	High	keyword + regex + entropy
VNX-SEC-759	Lever Data API key	High	keyword + regex + entropy
VNX-SEC-760	Workable API access token	High	keyword + regex + entropy
VNX-SEC-761	SmartRecruiters SmartToken	High	keyword + regex + entropy
VNX-SEC-762	DocuSign JWT user access token	Critical	keyword + regex + entropy
VNX-SEC-763	DocuSign OAuth secret key	Critical	keyword + regex + entropy
VNX-SEC-764	Box JWT app private-key passphrase	Critical	keyword + regex + entropy
VNX-SEC-765	Box client secret	Critical	keyword + regex + entropy
VNX-SEC-766	Egnyte access token	High	keyword + regex + entropy
VNX-SEC-767	Smartsheet API access token	High	keyword + regex + entropy
VNX-SEC-768	ZoomInfo private key	High	keyword + regex + entropy
VNX-SEC-769	Apollo.io API key	High	keyword + regex + entropy
VNX-SEC-770	Outreach OAuth access token	High	keyword + regex + entropy
VNX-SEC-771	Salesloft API key	High	keyword + regex + entropy
VNX-SEC-772	Gong API access key secret	Critical	keyword + regex + entropy
VNX-SEC-773	Chorus.ai API token	High	keyword + regex + entropy
VNX-SEC-774	Clari API token	High	keyword + regex + entropy
VNX-SEC-775	Pipedrive OAuth access token	High	keyword + regex + entropy
VNX-SEC-776	Freshsales CRM API key	High	keyword + regex + entropy
VNX-SEC-777	Keap/Infusionsoft OAuth access token	High	keyword + regex + entropy
VNX-SEC-778	Keap/Infusionsoft legacy API key	High	keyword + regex + entropy
VNX-SEC-779	Insightly API key	High	keyword + regex + entropy
VNX-SEC-780	ActiveCampaign API key	High	keyword + regex + entropy
VNX-SEC-781	Copper CRM API token	High	keyword + regex + entropy
VNX-SEC-782	Salesforce OAuth bearer JWT	Critical	keyword + regex + entropy
VNX-SEC-783	Salesforce session ID (00D)	Critical	keyword + regex
VNX-SEC-784	ServiceNow OAuth refresh token	Critical	keyword + regex + entropy
VNX-SEC-785	ServiceNow OAuth client secret	Critical	keyword + regex + entropy
VNX-SEC-786	ClickUp OAuth access token	High	keyword + regex + entropy
VNX-SEC-787	Wrike permanent access token	Critical	keyword + regex + entropy
VNX-SEC-788	Confluence/Jira OAuth 2.0 access token	High	keyword + regex + entropy
VNX-SEC-789	Confluence/Jira Connect app shared secret	Critical	keyword + regex + entropy
VNX-SEC-790	Productboard API token	High	keyword + regex + entropy
VNX-SEC-791	Pendo integration key	High	keyword + regex + entropy
VNX-SEC-792	Amplitude secret key	High	keyword + regex + entropy
VNX-SEC-793	Heap server API key	High	keyword + regex + entropy
VNX-SEC-794	FullStory server API key	High	keyword + regex + entropy
VNX-SEC-795	LogRocket API key	High	keyword + regex + entropy
VNX-SEC-796	Smartlook API token	High	keyword + regex + entropy
VNX-SEC-797	Mouseflow API key	Medium	keyword + regex + entropy
VNX-SEC-798	Hotjar API token	Medium	keyword + regex + entropy
VNX-SEC-799	Qualtrics API token	High	keyword + regex + entropy
VNX-SEC-800	SurveyMonkey access token	High	keyword + regex + entropy
VNX-SEC-801	Delighted API key	High	keyword + regex + entropy
VNX-SEC-802	Sprig API key	High	keyword + regex + entropy
VNX-SEC-803	Intercom OAuth access token	Critical	keyword + regex + entropy
VNX-SEC-804	Zoho CRM client secret	Critical	keyword + regex + entropy
VNX-SEC-821	BigCommerce API access token	Critical	keyword + regex + entropy
VNX-SEC-822	BigCommerce client secret	Critical	keyword + regex + entropy
VNX-SEC-823	WooCommerce REST consumer key (ck_)	High	keyword + regex
VNX-SEC-824	WooCommerce REST consumer secret (cs_)	Critical	keyword + regex
VNX-SEC-825	Magento integration access token	Critical	keyword + regex + entropy
VNX-SEC-826	Squarespace API key	High	keyword + regex + entropy
VNX-SEC-827	Wix API key	Critical	keyword + regex + entropy
VNX-SEC-828	Wix OAuth app secret	Critical	keyword + regex + entropy
VNX-SEC-829	Ecwid secret token	Critical	keyword + regex
VNX-SEC-830	Ecwid public token	Medium	keyword + regex
VNX-SEC-831	PrestaShop webservice API key	High	keyword + regex + entropy
VNX-SEC-832	Recharge API token (sk_)	Critical	keyword + regex
VNX-SEC-833	Gorgias API key	High	keyword + regex + entropy
VNX-SEC-834	Loop Returns API key	High	keyword + regex + entropy
VNX-SEC-835	ShipStation API key	High	keyword + regex + entropy
VNX-SEC-836	ShipStation API secret	Critical	keyword + regex + entropy
VNX-SEC-837	Shippo live API token (shippo_live_)	Critical	keyword + regex
VNX-SEC-838	Shippo test API token (shippo_test_)	Medium	keyword + regex
VNX-SEC-839	EasyPost production API key (EZAK)	Critical	keyword + regex
VNX-SEC-840	EasyPost test API key (EZTK)	Medium	keyword + regex
VNX-SEC-841	Avalara AvaTax license key	High	keyword + regex + entropy
VNX-SEC-842	TaxJar API token	High	keyword + regex + entropy
VNX-SEC-843	Printful API token	High	keyword + regex + entropy
VNX-SEC-844	Printify API token (JWT)	High	keyword + regex + entropy
VNX-SEC-845	Gelato API key	High	keyword + regex + entropy
VNX-SEC-846	eBay OAuth user access token (v^1.1)	Critical	keyword + regex + entropy
VNX-SEC-847	eBay developer cert id (client secret)	Critical	keyword + regex + entropy
VNX-SEC-848	Etsy API keystring	High	keyword + regex + entropy
VNX-SEC-849	Amazon SP-API LWA refresh token (Atzr	)	Critical
VNX-SEC-850	Amazon LWA client secret (amzn1)	Critical	keyword + regex
VNX-SEC-851	Walmart Marketplace client secret	Critical	keyword + regex + entropy
VNX-SEC-852	Rakuten API secret	High	keyword + regex + entropy
VNX-SEC-853	Mercado Libre access token (APP_USR)	Critical	keyword + regex
VNX-SEC-854	Mercado Libre client secret (APP_USR secret)	Critical	keyword + regex + entropy
VNX-SEC-855	Faire API access token	High	keyword + regex + entropy
VNX-SEC-856	Cratejoy API secret	High	keyword + regex + entropy
VNX-SEC-857	ActiveCampaign API key	High	keyword + regex + entropy
VNX-SEC-858	ConvertKit API key	High	keyword + regex + entropy
VNX-SEC-859	ConvertKit API secret	Critical	keyword + regex + entropy
VNX-SEC-860	Drip API token	High	keyword + regex + entropy
VNX-SEC-861	Omnisend API key	High	keyword + regex + entropy
VNX-SEC-862	Yotpo API secret	High	keyword + regex + entropy
VNX-SEC-863	Mailmodo API key	High	keyword + regex + entropy
VNX-SEC-864	Customer.io app API token (Bearer)	Critical	keyword + regex + entropy
VNX-SEC-865	Customer.io tracking site/key pair	High	keyword + regex + entropy
VNX-SEC-866	Klaviyo private API key (pk_)	Critical	keyword + regex
VNX-SEC-867	Mailchimp Transactional (Mandrill) API key	Critical	keyword + regex + entropy
VNX-SEC-868	Constant Contact access token (JWT)	Critical	keyword + regex + entropy
VNX-SEC-869	Constant Contact client secret	Critical	keyword + regex + entropy
VNX-SEC-870	Campaign Monitor API key	High	keyword + regex + entropy
VNX-SEC-871	GetResponse API key	High	keyword + regex + entropy
VNX-SEC-872	MailerLite API token (JWT)	High	keyword + regex + entropy
VNX-SEC-873	Moosend API key	High	keyword + regex + entropy
VNX-SEC-874	Brevo (Sendinblue) API key (xkeysib-)	Critical	keyword + regex
VNX-SEC-875	Brevo SMTP key (xsmtpsib-)	Critical	keyword + regex
VNX-SEC-876	Beehiiv API key	High	keyword + regex + entropy
VNX-SEC-877	Substack session cookie token	High	keyword + regex + entropy
VNX-SEC-878	Ghost Admin API key (id:secret)	Critical	keyword + regex + entropy
VNX-SEC-879	Ghost Content API key	Medium	keyword + regex + entropy
VNX-SEC-880	WordPress.com OAuth access token	Critical	keyword + regex + entropy
VNX-SEC-881	Webflow API token (site/v2 Bearer)	Critical	keyword + regex + entropy
VNX-SEC-882	Shopify Storefront API access token	High	keyword + regex + entropy
VNX-SEC-883	Shopify private app API secret key (shpss alt)	Critical	keyword + regex + entropy
VNX-SEC-884	Snipcart API key (secret)	Critical	keyword + regex + entropy
VNX-SEC-885	Swell API secret key	Critical	keyword + regex + entropy
VNX-SEC-886	Medusa API token (JWT)	Critical	keyword + regex + entropy
VNX-SEC-887	Saleor app auth token	Critical	keyword + regex + entropy
VNX-SEC-888	commercetools client secret	Critical	keyword + regex + entropy
VNX-SEC-889	BigCommerce client id	Medium	keyword + regex + entropy
VNX-SEC-890	Recharge API token (legacy hex)	High	keyword + regex + entropy
VNX-SEC-891	Klaviyo company id (public key)	Medium	keyword + regex + entropy
VNX-SEC-892	Avalara account id	Medium	keyword + regex
VNX-SEC-893	Gorgias account subdomain credential pair	High	keyword + regex + entropy
VNX-SEC-894	ShipStation v2 API key (TEST/PROD)	Critical	keyword + regex + entropy
VNX-SEC-895	TaxJar sandbox API token	Medium	keyword + regex + entropy
VNX-SEC-896	Printful store API key (legacy basic)	High	keyword + regex + entropy
VNX-SEC-897	ActiveCampaign account API URL	Medium	keyword + regex
VNX-SEC-898	Webflow site api token (legacy prefix)	High	keyword + regex + entropy
VNX-SEC-899	Etsy OAuth2 access token (prefix.token)	Critical	keyword + regex + entropy
VNX-SEC-900	Gelato API key (single uuid form)	High	keyword + regex + entropy
VNX-SEC-901	HERE Maps API key	High	keyword + regex + entropy
VNX-SEC-902	TomTom API key	High	keyword + regex + entropy
VNX-SEC-903	MapQuest API key	Medium	keyword + regex + entropy
VNX-SEC-904	Mapbox secret access token (sk.)	Critical	keyword + regex
VNX-SEC-905	Google Maps server API key (context)	High	keyword + regex + entropy
VNX-SEC-906	OpenWeatherMap API key	Medium	keyword + regex + entropy
VNX-SEC-907	Weatherbit API key	Medium	keyword + regex + entropy
VNX-SEC-908	AccuWeather API key	Medium	keyword + regex + entropy
VNX-SEC-909	Visual Crossing weather API key	Medium	keyword + regex + entropy
VNX-SEC-910	Tomorrow.io API key	Medium	keyword + regex + entropy
VNX-SEC-911	IPstack API access key	Medium	keyword + regex + entropy
VNX-SEC-912	IPinfo access token	Medium	keyword + regex + entropy
VNX-SEC-913	IPgeolocation API key	Medium	keyword + regex + entropy
VNX-SEC-914	ipdata API key	Medium	keyword + regex + entropy
VNX-SEC-915	MaxMind license key	High	keyword + regex + entropy
VNX-SEC-916	Abstract API key	Medium	keyword + regex + entropy
VNX-SEC-917	Clearbit API key (sk_)	High	keyword + regex
VNX-SEC-918	Hunter.io API key	Medium	keyword + regex + entropy
VNX-SEC-919	People Data Labs API key	High	keyword + regex + entropy
VNX-SEC-920	FullContact API key	Medium	keyword + regex + entropy
VNX-SEC-921	Numverify API access key	Medium	keyword + regex + entropy
VNX-SEC-922	NumLookup API key	Medium	keyword + regex + entropy
VNX-SEC-923	Veriphone API key	Medium	keyword + regex + entropy
VNX-SEC-924	Apollo.io API key	High	keyword + regex + entropy
VNX-SEC-925	AWS IoT certificate private key (context)	Critical	keyword + regex + entropy
VNX-SEC-926	Azure IoT Hub SharedAccessKey	Critical	keyword + regex + entropy
VNX-SEC-927	GCP IoT Core device key (context)	Critical	keyword + regex + entropy
VNX-SEC-928	Particle access token	Critical	keyword + regex + entropy
VNX-SEC-929	Blynk auth token	High	keyword + regex + entropy
VNX-SEC-930	Losant access token	High	keyword + regex + entropy
VNX-SEC-931	ThingSpeak write/read API key	Medium	keyword + regex + entropy
VNX-SEC-932	Adafruit IO key (aio_)	High	keyword + regex
VNX-SEC-933	Ubidots API token	High	keyword + regex + entropy
VNX-SEC-934	Helium API key	High	keyword + regex + entropy
VNX-SEC-935	Sigfox API credential	High	keyword + regex + entropy
VNX-SEC-936	Soracom auth/API key	High	keyword + regex + entropy
VNX-SEC-937	Twilio Super SIM / IoT API key (SK)	High	keyword + regex + entropy
VNX-SEC-938	46elks API credential	High	keyword + regex + entropy
VNX-SEC-939	BulkSMS token / credential	High	keyword + regex + entropy
VNX-SEC-940	Telesign customer ID + API key	High	keyword + regex + entropy
VNX-SEC-941	Agora App Certificate	Critical	keyword + regex + entropy
VNX-SEC-942	Agora App ID	Medium	keyword + regex + entropy
VNX-SEC-943	Daily.co API key	High	keyword + regex + entropy
VNX-SEC-944	LiveKit API secret	Critical	keyword + regex + entropy
VNX-SEC-945	LiveKit API key (APIxxxx)	High	keyword + regex + entropy
VNX-SEC-946	100ms management token / secret	Critical	keyword + regex + entropy
VNX-SEC-947	Vonage Video / OpenTok API secret	High	keyword + regex + entropy
VNX-SEC-1018	GitGuardian personal access token (ggp_)	High	keyword + regex
VNX-SEC-1019	GitGuardian service account token (gg_)	High	keyword + regex
VNX-SEC-1020	Snyk API token (UUID, assignment)	High	keyword + regex + entropy
VNX-SEC-1021	Snyk org/service account token (snyk_ prefix)	High	keyword + regex
VNX-SEC-1022	Doppler service token (dp.st.)	Critical	keyword + regex
VNX-SEC-1023	Doppler CLI token (dp.ct.)	Critical	keyword + regex
VNX-SEC-1024	Doppler service-account token (dp.sa.)	Critical	keyword + regex
VNX-SEC-1025	Doppler audit token (dp.audit.)	High	keyword + regex
VNX-SEC-1026	HashiCorp Vault service token (hvs.)	Critical	keyword + regex
VNX-SEC-1027	HashiCorp Vault batch token (hvb.)	High	keyword + regex
VNX-SEC-1028	HashiCorp Vault recovery token (hvr.)	Critical	keyword + regex
VNX-SEC-1029	Vault AppRole role_id (assignment)	High	keyword + regex + entropy
VNX-SEC-1030	Vault AppRole secret_id (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1031	HCP Vault Secrets / HCP API client secret (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1032	Bitwarden / Secrets Manager access token (0.uuid)	Critical	keyword + regex
VNX-SEC-1033	Akeyless access ID (p-)	High	keyword + regex
VNX-SEC-1034	Akeyless access key (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1035	CyberArk Conjur API key (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1036	Keeper Secrets Manager config token (assignment)	High	keyword + regex + entropy
VNX-SEC-1037	Infisical service token (st.)	Critical	keyword + regex
VNX-SEC-1038	Infisical machine identity client secret (ssk-/st- assignment)	Critical	keyword + regex + entropy
VNX-SEC-1039	AWS Secrets Manager secret ARN	Medium	keyword + regex
VNX-SEC-1040	Veracode API ID (assignment)	High	keyword + regex + entropy
VNX-SEC-1041	Veracode API key (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1042	Checkmarx API key / refresh token (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1043	SonarQube/SonarCloud user token (squ_)	High	keyword + regex
VNX-SEC-1044	SonarCloud project analysis token (sqp_)	High	keyword + regex
VNX-SEC-1045	SonarQube global analysis token (sqa_)	High	keyword + regex
VNX-SEC-1046	Mend/WhiteSource API key (assignment)	High	keyword + regex + entropy
VNX-SEC-1047	FOSSA API token (fossa_)	High	keyword + regex
VNX-SEC-1048	Semgrep AppSec API token (assignment)	High	keyword + regex + entropy
VNX-SEC-1049	Aqua Security API key (assignment)	High	keyword + regex + entropy
VNX-SEC-1050	Sysdig Secure API token (assignment)	High	keyword + regex + entropy
VNX-SEC-1051	Wiz service account client secret (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1052	Orca Security API token (assignment)	High	keyword + regex + entropy
VNX-SEC-1053	Lacework API secret (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1054	Prisma Cloud access key secret (assignment)	Critical	keyword + regex + entropy
VNX-SEC-1055	Tenable.io access/secret key (assignment)	High	keyword + regex + entropy
VNX-SEC-1056	Qualys API credentials (basic auth, assignment)	High	keyword + regex + entropy
VNX-SEC-1057	Rapid7 InsightVM/InsightAppSec API key (assignment)	High	keyword + regex + entropy
VNX-SEC-1058	Detectify API key (assignment)	High	keyword + regex + entropy
VNX-SEC-1059	Probely API token (assignment)	High	keyword + regex + entropy
VNX-SEC-1060	StackHawk API key (hawk.)	High	keyword + regex
VNX-SEC-1061	Steam Web API key	High	keyword + regex + entropy
VNX-SEC-1062	Riot Games API key (RGAPI-)	High	keyword + regex
VNX-SEC-1063	Twitch app access token (OAuth)	High	keyword + regex + entropy
VNX-SEC-1064	Twitch EventSub webhook secret	High	keyword + regex + entropy
VNX-SEC-1065	Unity Cloud Build API key	High	keyword + regex + entropy
VNX-SEC-1066	PlayFab secret key	Critical	keyword + regex + entropy
VNX-SEC-1068	Vimeo access token (bearer)	High	keyword + regex + entropy
VNX-SEC-1069	Brightcove OAuth client secret	High	keyword + regex + entropy
VNX-SEC-1070	JW Player API v2 secret	High	keyword + regex + entropy
VNX-SEC-1071	Wistia API token	High	keyword + regex + entropy
VNX-SEC-1072	api.video API key	High	keyword + regex + entropy
VNX-SEC-1073	Dolby.io API secret	High	keyword + regex + entropy
VNX-SEC-1074	Spotify refresh token	High	keyword + regex + entropy
VNX-SEC-1075	SoundCloud OAuth client secret	High	keyword + regex + entropy
VNX-SEC-1076	Last.fm API secret	Medium	keyword + regex + entropy
VNX-SEC-1077	Discogs personal access token	Medium	keyword + regex + entropy
VNX-SEC-1078	TMDB API key (v3)	Medium	keyword + regex + entropy
VNX-SEC-1079	TMDB API read access token (v4 JWT)	High	keyword + regex + entropy
VNX-SEC-1080	OMDb API key	Medium	keyword + regex + entropy
VNX-SEC-1081	Giphy API key	Medium	keyword + regex + entropy
VNX-SEC-1082	Tenor API key	Medium	keyword + regex + entropy
VNX-SEC-1083	Unsplash access key (Client-ID)	Medium	keyword + regex + entropy
VNX-SEC-1084	Unsplash secret key	High	keyword + regex + entropy
VNX-SEC-1085	Pexels API key	Medium	keyword + regex + entropy
VNX-SEC-1086	Pixabay API key	Medium	keyword + regex + entropy
VNX-SEC-1087	Flickr API secret	Medium	keyword + regex + entropy
VNX-SEC-1088	Imgur Client-ID	Medium	keyword + regex + entropy
VNX-SEC-1089	Imgur client secret	High	keyword + regex + entropy
VNX-SEC-1090	KeyCDN API key	High	keyword + regex + entropy
VNX-SEC-1091	StackPath client secret	High	keyword + regex + entropy
VNX-SEC-1092	G-Core Labs API token (APIKey)	High	keyword + regex + entropy
VNX-SEC-1093	CDN77 API token	High	keyword + regex + entropy
VNX-SEC-1094	ConfigCat SDK key (configcat-)	Medium	keyword + regex
VNX-SEC-1095	Flagsmith server-side environment key (ser.)	High	keyword + regex
VNX-SEC-1096	GrowthBook SDK secret key	High	keyword + regex
VNX-SEC-1103	Steam publisher Web API key (partner)	Critical	keyword + regex + entropy
VNX-SEC-1104	Riot Games production API key (production RGAPI)	Critical	keyword + regex + entropy
VNX-SEC-1105	Twitch client ID	Medium	keyword + regex + entropy
VNX-SEC-1106	Unity Cloud Build organization secret	High	keyword + regex + entropy
VNX-SEC-1107	PlayFab title ID + secret context	Critical	keyword + regex + entropy
VNX-SEC-1108	Vimeo OAuth client secret	High	keyword + regex + entropy
VNX-SEC-1109	JW Player API v1 secret	High	keyword + regex + entropy
VNX-SEC-1110	Brightcove policy key (BCpkc)	Medium	keyword + regex
VNX-SEC-1111	Wistia OAuth access token	High	keyword + regex
VNX-SEC-1112	Deepgram-style media key skip placeholder	High	keyword + regex + entropy
VNX-SEC-1113	Dolby.io media app key	Medium	keyword + regex + entropy
VNX-SEC-1114	SoundCloud OAuth access token	High	keyword + regex + entropy
VNX-SEC-1115	Discogs consumer secret	High	keyword + regex + entropy
VNX-SEC-1116	Giphy production app key context	Medium	keyword + regex + entropy
VNX-SEC-1117	Pixabay numeric key context	Medium	keyword + regex + entropy
VNX-SEC-1118	Flickr API key	Medium	keyword + regex + entropy
VNX-SEC-1119	Imgur access token (bearer)	High	keyword + regex + entropy
VNX-SEC-1120	KeyCDN account-context API key	High	keyword + regex + entropy
VNX-SEC-1121	StackPath client ID	Medium	keyword + regex + entropy
VNX-SEC-1122	CDN77 login token context	High	keyword + regex + entropy
VNX-SEC-1123	G-Core Labs permanent API token (gcore_)	High	keyword + regex
VNX-SEC-1127	TMDB v4 access token context	High	keyword + regex + entropy
VNX-SEC-1128	Unsplash application id context	Medium	keyword + regex + entropy
VNX-SEC-1129	Vimeo personal access token context	High	keyword + regex + entropy
VNX-SEC-1130	JW Player API key (v2 key)	Medium	keyword + regex + entropy
VNX-SEC-1131	TMDB session id	High	keyword + regex + entropy
VNX-SEC-1132	Last.fm API key	Medium	keyword + regex + entropy
VNX-SEC-1133	Spotify OAuth access token (bearer)	High	keyword + regex + entropy
VNX-SEC-1135	Tenor v2 client key context	Medium	keyword + regex + entropy
VNX-SEC-1136	Steam server API key context	High	keyword + regex + entropy
VNX-SEC-1137	Wistia data API token context	High	keyword + regex + entropy
VNX-SEC-1138	PlayFab title shared secret context	Critical	keyword + regex + entropy
VNX-SEC-1139	api.video sandbox key context	Medium	keyword + regex + entropy

Remediation

Rotate any exposed credential immediately, remove it from source, and load it from a secrets manager or environment variable instead. Purge it from git history with git filter-repo. See CWE-798 and the OWASP Secrets Management Cheat Sheet.