Secrets — Source Control & CI/CD

GitHub, GitLab, Bitbucket, Azure DevOps tokens and CI/CD pipeline credentials.

All rules in this category are kind secrets. They run under vulnetix secrets and the secrets stage of vulnetix scan.

Rule ID	Name	Severity	Detection
VNX-SEC-181	Bitbucket app password	High	keyword + regex + entropy
VNX-SEC-182	Bitbucket app password (ATBB prefix)	High	keyword + regex
VNX-SEC-183	Bitbucket OAuth client secret	High	keyword + regex + entropy
VNX-SEC-184	Azure DevOps personal access token	Critical	keyword + regex + entropy
VNX-SEC-185	CircleCI personal API token	High	keyword + regex + entropy
VNX-SEC-186	CircleCI project API token (CCIP)	High	keyword + regex
VNX-SEC-187	Travis CI API token	High	keyword + regex + entropy
VNX-SEC-188	Buildkite agent token	Critical	keyword + regex + entropy
VNX-SEC-189	Buildkite API access token	High	keyword + regex + entropy
VNX-SEC-190	Jenkins API token	High	keyword + regex + entropy
VNX-SEC-191	Jenkins crumb (CSRF token)	Medium	keyword + regex + entropy
VNX-SEC-192	Drone CI token	High	keyword + regex + entropy
VNX-SEC-193	TeamCity access token	High	keyword + regex
VNX-SEC-194	TeamCity access token (generic)	High	keyword + regex + entropy
VNX-SEC-195	Gitea access token	High	keyword + regex + entropy
VNX-SEC-196	Gitee access token	High	keyword + regex + entropy
VNX-SEC-197	Codecov upload token	Medium	keyword + regex
VNX-SEC-198	Coveralls repo token	Medium	keyword + regex + entropy
VNX-SEC-199	Code Climate test reporter ID	Medium	keyword + regex + entropy
VNX-SEC-200	Sourcegraph access token (sgp_)	High	keyword + regex
VNX-SEC-201	Sourcegraph dotcom token (sgph_)	High	keyword + regex
VNX-SEC-202	Semaphore CI token	High	keyword + regex + entropy
VNX-SEC-203	Harness personal access token (pat.)	Critical	keyword + regex
VNX-SEC-204	Harness service account token (sat.)	Critical	keyword + regex
VNX-SEC-205	Spacelift API token	High	keyword + regex
VNX-SEC-206	Pulumi access token (pul-)	Critical	keyword + regex
VNX-SEC-207	Octopus Deploy API key (API-)	High	keyword + regex + entropy
VNX-SEC-208	Terraform Cloud team/org token	Critical	keyword + regex
VNX-SEC-209	JFrog access/identity token	High	keyword + regex + entropy
VNX-SEC-210	JFrog reference token (cmVmdGtuOjA)	High	keyword + regex
VNX-SEC-211	Argo CD auth token (JWT)	Critical	keyword + regex
VNX-SEC-212	FluxCD git credentials	High	keyword + regex + entropy
VNX-SEC-213	GitHub App private key (PEM)	Critical	keyword + regex
VNX-SEC-214	GitHub Actions runner registration token (BBBB)	High	keyword + regex + entropy
VNX-SEC-215	Vercel deploy hook URL	High	keyword + regex
VNX-SEC-216	Vercel API token	Critical	keyword + regex + entropy
VNX-SEC-217	Bitrise access token	High	keyword + regex + entropy
VNX-SEC-218	Codefresh API token	High	keyword + regex + entropy
VNX-SEC-219	Woodpecker CI token	High	keyword + regex + entropy
VNX-SEC-220	Concourse CI token	High	keyword + regex + entropy
VNX-SEC-221	GoCD access token	High	keyword + regex + entropy
VNX-SEC-222	Sentry CLI auth token (sntrys_)	High	keyword + regex
VNX-SEC-223	Sentry user auth token (sntryu_)	High	keyword + regex
VNX-SEC-224	ReadTheDocs API token	Medium	keyword + regex + entropy
VNX-SEC-225	Netlify build hook URL	High	keyword + regex
VNX-SEC-226	Netlify API access token	Critical	keyword + regex + entropy
VNX-SEC-227	Cloudsmith API key	High	keyword + regex + entropy
VNX-SEC-228	Bitbucket Pipelines OIDC/step token	High	keyword + regex + entropy
VNX-SEC-229	TeamCity superuser token	Critical	keyword + regex
VNX-SEC-230	Drone CI RPC secret	Critical	keyword + regex + entropy
VNX-SEC-231	Sourcegraph dotcom token (sgd_)	High	keyword + regex
VNX-SEC-232	Buildkite registration token (bkua_)	Critical	keyword + regex
VNX-SEC-233	Codecov global upload token (legacy)	Medium	keyword + regex + entropy
VNX-SEC-234	Argo CD admin password	Critical	keyword + regex + entropy
VNX-SEC-235	Semaphore organization API token (legacy)	High	keyword + regex
VNX-SEC-236	Spacelift API key secret	High	keyword + regex + entropy
VNX-SEC-237	Codefresh runtime/agent token	High	keyword + regex + entropy
VNX-SEC-238	TeamCity build agent authorization token	High	keyword + regex + entropy
VNX-SEC-239	JFrog Pipelines integration token	High	keyword + regex + entropy
VNX-SEC-240	GitHub Actions runner token (config.sh)	High	keyword + regex
VNX-SEC-241	Gitea OAuth client secret	High	keyword + regex
VNX-SEC-242	Travis CI Pro/Enterprise access token (legacy)	High	keyword + regex + entropy
VNX-SEC-243	FluxCD GitRepository SSH private key	Critical	keyword + regex
VNX-SEC-244	Concourse fly target token	High	keyword + regex
VNX-SEC-245	Cloudsmith entitlement token (cmVudA / ent_)	High	keyword + regex + entropy
VNX-SEC-246	Octopus Deploy server API key (assignment)	High	keyword + regex
VNX-SEC-247	Pulumi config passphrase	High	keyword + regex + entropy
VNX-SEC-248	Drone CI machine/user token (legacy)	High	keyword + regex + entropy
VNX-SEC-249	Gitee OAuth client secret	High	keyword + regex + entropy
VNX-SEC-250	CircleCI context/environment token (assignment)	High	keyword + regex + entropy

Remediation

Rotate any exposed credential immediately, remove it from source, and load it from a secrets manager or environment variable instead. Purge it from git history with git filter-repo. See CWE-798 and the OWASP Secrets Management Cheat Sheet.