秘密掃描模式
進階安全性會維護多組預設秘密掃描模式：
- 推送保護模式 - 用來在啟用秘密掃描推送保護的存放庫中偵測潛在的秘密。
- 使用者警示模式 - 用來偵測已啟用秘密掃描警示的存放庫中的潛在秘密。
- 非提供者模式 - 用來偵測已啟用秘密掃描警示的存放庫中常見的結構化秘密發生次數。
支援的機密資料
| 區段 | 說明 |
|---|---|
| 提供者 | 令牌提供者的名稱。 |
| 代幣名稱 | 進階安全性秘密掃描所發現的令牌類型。 |
| 使用者 | 用於向使用者報告洩漏問題的令牌，在推送完成後通知使用者。 適用於啟用進階安全性的所有存放庫 |
| 推送防護 | 當令牌洩漏時會向使用者報告推送資訊。 適用於啟用秘密推送保護的所有存放庫。 |
| 有效期 | 進階安全性嘗試執行有效性檢查的令牌。 |
合作夥伴提供者模式
下表列出秘密掃描所支援的合作夥伴提供者模式。
| 規則識別碼 | 代幣名稱 | 推送保護 | 使用者警示 | 有效性檢查 |
|---|---|---|---|---|
| SEC101/156 | AadClientAppIdentifiableCredentials |
|
|
|
| SEC101/501 | AdafruitIOKey |
|
|
|
| SEC101/201 | AdoIdentifiablePat |
|
|
|
| SEC101/102 | AdoLegacyPat |
|
|
|
| SEC101/600 | AdobeDeviceToken |
|
||
| SEC101/601 | AdobeServiceToken |
|
||
| SEC101/602 | AdobeShortLivedAccessToken |
|
||
| SEC101/015 | AkamaiCredentials |
|
||
| SEC101/029 | AlibabaCloudCredentials |
|
|
|
| SEC101/023 | AmazonMwsAuthToken |
|
||
| SEC101/503 | AmazonOAuthCredentials |
|
|
|
| SEC101/701 | AnthropicApiKey |
|
||
| SEC101/504 | AsanaPat |
|
|
|
| SEC101/605 | AtlassianJwt |
|
||
| SEC101/604 | AtlassianLegacyApiToken |
|
|
|
| SEC101/008 | AwsCredentials |
|
|
|
| SEC101/505 | AWS臨時憑證 |
|
|
|
| SEC101/157 | AzureApimDirectManagementSas |
|
||
| SEC101/186 | AzureApimGatewaySas |
|
||
| SEC101/181 | AzureApimIdentifiableDirectManagementKey |
|
|
|
| SEC101/183 | AzureApimIdentifiableGatewayKey |
|
|
|
| SEC101/184 | AzureApimIdentifiableRepositoryKey |
|
|
|
| SEC101/182 | AzureApimIdentifiableSubscriptionKey |
|
|
|
| SEC101/132 | AzureApimLegacyDirectManagementKey |
|
||
| SEC101/187 | AzureApimLegacyGatewayKey |
|
||
| SEC101/188 | AzureApimLegacyRepositoryKey |
|
||
| SEC101/133 | AzureApimLegacySubscriptionKey |
|
||
| SEC101/185 | AzureApimRepositorySas |
|
||
| SEC101/197 | Azure 應用程式設定可識別憑據 |
|
||
| SEC101/131 | AzureAppConfigurationLegacyCredentials |
|
||
| SEC101/138 | AzureApplicationInsightsCredentials |
|
||
| SEC101/194 | Azure 自動化帳戶金鑰 (AzureAutomationAccountKey) |
|
||
| SEC101/163 | AzureBatchIdentifiableKey |
|
|
|
| SEC101/113 | AzureBatchLegacyKey |
|
||
| SEC101/118 | AzureBlockchainCredentials |
|
||
| SEC101/154 | AzureCacheForRedisIdentifiableKey |
|
|
|
| SEC101/155 | AzureCacheForRedisIdentifiablePrivateServiceKey |
|
||
| SEC101/103 | AzureCacheForRedisLegacyKey |
|
||
| SEC101/151 | AzureCdnSas |
|
|
|
| SEC101/125 | AzureCognitiveServicesLegacyKey |
|
||
| SEC101/134 | Azure 認知服務翻譯器舊金鑰 |
|
||
| SEC101/204 | AzureCommunicationServicesIdentifiableKey |
|
||
| SEC101/137 | AzureCommunicationServicesLegacyKey |
|
||
| SEC101/176 | AzureContainerRegistryIdentifiableKey |
|
|
|
| SEC101/109 | Azure 容器註冊表舊金鑰 |
|
|
|
| SEC101/160 | AzureCosmosDBIdentifiableKey |
|
|
|
| SEC101/161 | AzureCosmosDBIdentifiablePrivateServiceKey |
|
||
| SEC101/104 | AzureCosmosDBLegacyKey |
|
||
| SEC101/250 | AzureCosmosDBSas |
|
|
|
| SEC101/110 | AzureDatabricksPat |
|
|
|
| SEC101/256 | AzureDatabricksPrivateServiceKey |
|
|
|
| SEC101/148 | AzureDevOpsOAuthToken |
|
||
| SEC101/199 | AzureEventGridIdentifiableKey |
|
||
| SEC101/119 | AzureEventGridLegacyKey |
|
|
|
| SEC101/172 | Azure 事件中心識別鍵 |
|
|
|
| SEC101/175 | Azure 事件集線器 可識別的私有服務系統金鑰 |
|
||
| SEC101/198 | AzureFluidRelayIdentifiableKey |
|
||
| SEC101/190 | Azure 流體中繼傳統密鑰 |
|
||
| SEC101/158 | Azure 功能可識別鍵 |
|
|
|
| SEC101/112 | AzureFunctionLegacyKey |
|
||
| SEC101/140 | AzureGenomicsKey |
|
||
| SEC101/141 | AzureHDInsightCredentials |
|
||
| SEC101/180 | Azure物聯網裝置識別鍵 |
|
|
|
| SEC101/146 | AzureIotDeviceLegacyCredentials |
|
||
| SEC101/179 | AzureIotDeviceProvisioningIdentifiableKey |
|
|
|
| SEC101/115 | AzureIotDeviceProvisioningLegacyCredentials |
|
||
| SEC101/178 | AzureIotHubIdentifiableKey |
|
|
|
| SEC101/114 | AzureIotHubLegacyCredentials |
|
||
| SEC101/150 | AzureLogicAppSas |
|
|
|
| SEC101/169 | AzureML可識別的私人服務主體憑證 (AzureMLIdentifiablePrivateServicePrincipalCredentials) |
|
||
| SEC101/170 | AzureMLWebServiceClassicIdentifiableKey |
|
|
|
| SEC101/123 | AzureMLWebServiceKey |
|
||
| SEC101/129 | AzureManagementCertificate |
|
||
| SEC101/203 | AzureMapsIdentifiableKey |
|
||
| SEC101/116 | AzureMapsLegacyKey |
|
||
| SEC101/105 | Azure 訊息傳統憑證 |
|
||
| SEC101/202 | Azure混合實境可識別憑證 |
|
||
| SEC101/136 | AzureMixedRealityLegacyCredentials |
|
||
| SEC101/189 | AzureOpenAILegacyKey |
|
||
| SEC101/246 | AzureRateCardSas |
|
|
|
| SEC101/173 | AzureRelayIdentifiableKey |
|
|
|
| SEC101/167 | AzureSearchIdentifiableAdminKey |
|
|
|
| SEC101/168 | Azure搜尋可識別的私人服務管理金鑰 |
|
||
| SEC101/166 | AzureSearchIdentifiableQueryKey |
|
|
|
| SEC101/111 | AzureSearchLegacyKey |
|
||
| SEC101/171 | AzureServiceBusIdentifiableKey |
|
|
|
| SEC101/174 | AzureServiceBusIdentifiablePrivateServiceSystemKey |
|
||
| SEC101/121 | AzureServiceDeploymentCredentials |
|
||
| SEC101/253 | AzureSignalRIdentifiableKey |
|
||
| SEC101/254 | Azure SignalR 可識別臨時密鑰 |
|
||
| SEC101/117 | AzureSignalRLegacyKey |
|
||
| SEC101/258 | Azure Spring 應用測試端點金鑰 |
|
||
| SEC101/152 | Azure 儲存帳戶可識別憑證 |
|
|
|
| SEC101/106 | AzureStorageAccountLegacyCredentials |
|
||
| SEC101/251 | Azure儲存可識別私人服務Kerberos密鑰 |
|
|
|
| SEC101/153 | Azure儲存可識別的私有服務密鑰 |
|
||
| SEC101/120 | AzureWebAppBotCredentials |
|
||
| SEC101/257 | AzureWebAppBot識別金鑰 |
|
|
|
| SEC101/142 | AzureWebAppBotLegacyKey |
|
||
| SEC101/248 | AzureWebPubSubIdentifiableCredentials |
|
||
| SEC101/249 | Azure Web PubSub 短暫憑證識別碼 |
|
||
| SEC101/144 | AzureWebPubSubLegacyCredentials |
|
||
| SEC101/606 | BeamerApiKey |
|
||
| SEC101/143 | BingApiKey |
|
||
| SEC101/128 | Bing 地圖金鑰 |
|
||
| SEC101/135 | Bing 搜尋金鑰 |
|
||
| SEC101/566 | BrevoApiKey |
|
|
|
| SEC101/567 | BrevoSmtpKey |
|
|
|
| SEC101/692 | BrowserStackCredentials |
|
||
| SEC101/594 | CdsCanadaNotifyApiKey |
|
|
|
| SEC101/507 | CheckoutApiKey |
|
||
| SEC101/579 | ChiefToolsToken |
|
|
|
| SEC101/145 | 思科本地帳戶憑證 |
|
||
| SEC101/508 | ClojarsDeployToken |
|
|
|
| SEC101/035 | CloudantCredentials |
|
||
| SEC101/697 | CohereApiKey |
|
||
| SEC101/200 | 常見註釋安全密鑰 |
|
|
|
| SEC101/609 | ContentfulPersonalAccessToken（個人存取令牌） |
|
||
| SEC101/034 | CredentialObject |
|
||
| SEC101/509 | DevCycleClientApiKey |
|
|
|
| SEC101/557 | DevCycleManagementApiToken |
|
||
| SEC101/510 | DevCycleMobileApiKey |
|
|
|
| SEC101/511 | DevCycleServerApiKey |
|
|
|
| SEC101/512 | DigitalOceanOAuthToken |
|
|
|
| SEC101/513 | DigitalOceanPat |
|
|
|
| SEC101/514 | DigitalOceanRefreshToken |
|
|
|
| SEC101/515 | DigitalOceanSystemToken |
|
|
|
| SEC101/046 | Discord API 凭证 |
|
||
| SEC101/516 | DiscordApiToken |
|
|
|
| SEC101/517 | DopplerAuditToken |
|
|
|
| SEC101/518 | DopplerCliToken |
|
|
|
| SEC101/519 | DopplerPersonalToken |
|
|
|
| SEC101/520 | DopplerScimToken |
|
|
|
| SEC101/521 | DopplerServiceToken |
|
|
|
| SEC101/020 | DropboxAccessToken |
|
||
| SEC101/021 | DropboxAppCredentials |
|
||
| SEC101/522 | DropboxOAuth2ShortLivedAccessToken |
|
|
|
| SEC101/523 | DuffelAccessToken |
|
|
|
| SEC101/611 | DynatraceInternalToken |
|
||
| SEC101/613 | EBayProductionClientCredentials |
|
||
| SEC101/614 | EBaySandboxClientCredentials |
|
||
| SEC101/524 | EasyPostApiKey |
|
|
|
| SEC101/682 | ElasticCloudApiKey |
|
||
| SEC101/681 | ElasticStack API 金鑰 |
|
||
| SEC101/196 | EntraToken |
|
||
| SEC101/014 | FacebookAccessToken |
|
||
| SEC101/525 | FigmaPat |
|
|
|
| SEC101/618 | FinicityAppKey |
|
||
| SEC101/625 | Firebase 雲端通訊伺服器密鑰 (FirebaseCloudMessagingServerKey) |
|
||
| SEC101/687 | FlickrApiKey |
|
||
| SEC101/526 | FlutterwaveLiveApiSecretKey |
|
|
|
| SEC101/619 | FlutterwaveTestApiSecretKey |
|
||
| SEC101/621 | FrameIODeveloperToken |
|
||
| SEC101/620 | FrameIOJwt |
|
||
| SEC101/527 | FullStory API 密鑰 |
|
|
|
| SEC101/007 | GitHubAppCredentials |
|
||
| SEC101/529 | GitHubAppToken |
|
|
|
| SEC101/530 | GitHubOAuthAccessToken |
|
|
|
| SEC101/690 | GitHubOauth2Credentials |
|
||
| SEC101/534 | GitHubPat |
|
|
|
| SEC101/531 | GitHubRefreshToken |
|
|
|
| SEC101/532 | GitHubServerToServerToken |
|
|
|
| SEC101/535 | GitHubUserToServerToken |
|
|
|
| SEC101/622 | GitLab存取權杖 |
|
||
| SEC101/623 | GoCardlessLiveAccessToken |
|
||
| SEC101/624 | GoCardlessSandboxAccessToken |
|
||
| SEC101/003 | GoogleApiKey |
|
|
|
| SEC101/626 | GoogleCloudPrivateKeyId |
|
|
|
| SEC101/536 | GoogleCloudStorageServiceAccountAccessKey |
|
|
|
| SEC101/537 | Google 雲端儲存使用者存取密鑰 |
|
|
|
| SEC101/627 | 谷歌OAuth存取令牌 |
|
||
| SEC101/002 | GoogleOAuthCredentials |
|
||
| SEC101/628 | GoogleOAuthRefreshToken |
|
||
| SEC101/030 | Google服務帳戶私鑰 (GoogleServiceAccountKey) |
|
||
| SEC101/538 | GrafanaCloudApiKey |
|
|
|
| SEC101/629 | GrafanaCloudApiToken |
|
|
|
| SEC101/630 | GrafanaProjectApiKey |
|
|
|
| SEC101/631 | Grafana專案服務帳戶Token |
|
|
|
| SEC101/581 | HashiCorpVaultBatchLegacyToken |
|
|
|
| SEC101/582 | HashiCorpVaultBatchToken |
|
|
|
| SEC101/580 | HashiCorpVaultRootServiceToken |
|
|
|
| SEC101/583 | HashiCorpVaultServiceLegacyToken |
|
|
|
| SEC101/584 | HashiCorpVaultServiceToken |
|
|
|
| SEC101/732 | HereApiKey |
|
||
| SEC101/585 | HighnoteRkKey |
|
|
|
| SEC101/586 | HighnoteSkKey |
|
|
|
| SEC101/589 | HubSpotApiPersonalAccessKey |
|
|
|
| SEC101/539 | HubspotApiKey |
|
|
|
| SEC101/686 | Hugging Face 訪問令牌 |
|
||
| SEC101/693 | InfuraApiKey |
|
||
| SEC101/540 | IntercomAccessToken |
|
|
|
| SEC101/541 | IonicPat |
|
|
|
| SEC101/542 | IonicRefreshToken |
|
|
|
| SEC101/590 | JFrogPlatformAccessToken |
|
|
|
| SEC101/543 | JFrogPlatformApiKey |
|
|
|
| SEC101/632 | JdCloudAccessKey |
|
||
| SEC101/696 | KaggleApiToken |
|
||
| SEC101/700 | LangChainApiKey |
|
||
| SEC101/691 | LaunchDarklyApiKey |
|
||
| SEC101/544 | LinearApiKey |
|
|
|
| SEC101/545 | LinearOAuthAccessToken |
|
|
|
| SEC101/633 | LobLiveApiKey |
|
||
| SEC101/634 | LobTestApiKey |
|
||
| SEC101/635 | LocalStackApiKey |
|
||
| SEC101/546 | LogicMonitor用戶端令牌 |
|
|
|
| SEC101/547 | LogicMonitorLmv1AccessKey |
|
|
|
| SEC101/027 | MailChimpApiKey |
|
||
| SEC101/026 | MailgunApiCredentials |
|
||
| SEC101/636 | MapboxSecretAccessToken（Mapbox 秘密訪問令牌） |
|
||
| SEC101/548 | MidtransServerKey |
|
|
|
| SEC101/699 | MistralApiKey |
|
||
| SEC101/549 | NewRelicInsightsQueryKey |
|
|
|
| SEC101/639 | NewRelicLicenseKey |
|
||
| SEC101/550 | NewRelicPersonalApiKey |
|
|
|
| SEC101/551 | NewRelicRestApiKey |
|
|
|
| SEC101/694 | NitroApiKey |
|
||
| SEC101/640 | NotionIntegrationToken |
|
||
| SEC101/641 | NotionOAuthClientCredentials |
|
||
| SEC101/050 | NpmAuthorToken（npm作者權杖） |
|
|
|
| SEC101/044 | NpmCredentials |
|
|
|
| SEC101/031 | NuGetApiKey |
|
|
|
| SEC101/043 | NuGetCredentials |
|
||
| SEC101/642 | OctopusDeployApiKey |
|
||
| SEC101/643 | OculusAccessToken |
|
||
| SEC101/147 | OfficeIncomingWebhook |
|
|
|
| SEC101/552 | OnfidoApiToken |
|
|
|
| SEC101/553 | OpenAIApiKeyV2 |
|
|
|
| SEC101/695 | OpenWeather API 金鑰 |
|
||
| SEC101/645 | PalantirJwt |
|
||
| SEC101/022 | PayPalBraintreeAccessToken |
|
||
| SEC101/698 | PerplexityApiKey |
|
||
| SEC101/646 | PersonaProductionApiKey |
|
|
|
| SEC101/647 | PersonaSandboxApiKey |
|
||
| SEC101/019 | PicaticApiKey |
|
||
| SEC101/680 | PineconeApiKey |
|
||
| SEC101/554 | PlanetScaleDatabasePassword |
|
|
|
| SEC101/555 | PlanetScaleOAuthToken |
|
|
|
| SEC101/556 | PlanetScaleServiceToken |
|
|
|
| SEC101/648 | PlivoCredentials |
|
||
| SEC101/045 | PostmanApiKey |
|
|
|
| SEC101/558 | PrefectServerApiToken |
|
|
|
| SEC101/559 | PrefectUserApiToken |
|
|
|
| SEC101/650 | ProctorioConsumerKey |
|
||
| SEC101/651 | ProctorioLinkageKey |
|
||
| SEC101/652 | ProctorioRegistrationKey (註冊金鑰) |
|
||
| SEC101/560 | ProctorioSecretKeyV2 |
|
|
|
| SEC101/653 | PulumiAccessToken |
|
||
| SEC101/654 | PyPiApiToken |
|
||
| SEC101/561 | ReadMeApiKey |
|
|
|
| SEC101/562 | RedirectPizzaApiToken |
|
|
|
| SEC101/655 | RubyGemsApiKey |
|
||
| SEC101/664 | SSLMateApiKey |
|
||
| SEC101/665 | SSLMateClusterSecret |
|
||
| SEC101/563 | SamsaraApiAccessToken |
|
|
|
| SEC101/564 | SamsaraOAuth2AccessToken |
|
|
|
| SEC101/656 | SegmentPublicApiToken |
|
||
| SEC101/025 | SendGridApiKey |
|
|
|
| SEC101/568 | ShippoLiveApiToken |
|
|
|
| SEC101/657 | ShippoTestApiToken |
|
||
| SEC101/039 | ShopifyAccessToken |
|
|
|
| SEC101/658 | ShopifyAppClientCredentials |
|
||
| SEC101/659 | ShopifyAppClientSecret（Shopify 應用程式客戶端密鑰） |
|
||
| SEC101/608 | ShopifyApp OAuth 存取令牌 |
|
||
| SEC101/603 | ShopifyCustomAppAccessToken |
|
||
| SEC101/661 | ShopifyMarketplaceToken |
|
||
| SEC101/660 | Shopify商家代幣 |
|
||
| SEC101/662 | ShopifyPartnerApiToken |
|
||
| SEC101/666 | ShopifyPrivateAppPassword |
|
||
| SEC101/040 | ShopifySharedSecret |
|
|
|
| SEC101/005 | SlackApiKey |
|
|
|
| SEC101/571 | Slack 應用程式級別權杖 (SlackAppLevelToken) |
|
|
|
| SEC101/012 | SlackWebhook |
|
||
| SEC101/048 | SlackWorkflowKey |
|
||
| SEC101/683 | SplunkHecApiKey |
|
||
| SEC101/684 | SplunkJwtToken |
|
||
| SEC101/685 | SplunkSessionKey |
|
||
| SEC101/177 | SQL可識別憑證 |
|
|
|
| SEC101/663 | SquareApplicationSecret |
|
||
| SEC101/011 | SquareCredentials |
|
||
| SEC101/010 | SquarePat |
|
||
| SEC101/016 | StripeLiveApiKey |
|
|
|
| SEC101/052 | StripeLiveRestrictedApiKey |
|
||
| SEC101/051 | StripeTestApiKey |
|
||
| SEC101/053 | StripeTestRestrictedApiKey |
|
||
| SEC101/667 | StripeWebhookSigningSecret |
|
||
| SEC101/668 | SupabaseServiceKey |
|
||
| SEC101/669 | Tableau個人存取令牌 |
|
||
| SEC101/049 | TelegramBotToken |
|
||
| SEC101/670 | TelnyxApiV2Key |
|
||
| SEC101/572 | 騰訊CloudCredentials |
|
||
| SEC101/573 | TerraformCloudEnterpriseToken |
|
||
| SEC101/024 | TwilioApiKeyCredentials |
|
||
| SEC101/018 | TwilioCredentials |
|
||
| SEC101/574 | TypeformPat |
|
|
|
| SEC101/124 | VisualStudioAppCenterKey |
|
||
| SEC101/575 | WISEFlowApiKey |
|
|
|
| SEC101/591 | WakaTimeAppCredentials |
|
|
|
| SEC101/592 | WakaTimeOAuthAccessToken |
|
|
|
| SEC101/593 | WakaTimeOAuthRefreshToken |
|
|
|
| SEC101/688 | WeatherstackApiKey |
|
||
| SEC101/576 | WorkOSProductionApiKey |
|
|
|
| SEC101/671 | WorkOSStagingApiKey |
|
||
| SEC101/255 | XboxLiveSas |
|
|
|
| SEC101/672 | YandexCloudApiKey |
|
||
| SEC101/676 | Yandex雲端IAM存取密鑰 |
|
||
| SEC101/673 | YandexCloudIamCookie |
|
||
| SEC101/674 | YandexCloudIamToken |
|
||
| SEC101/675 | YandexDictionaryApiKey |
|
||
| SEC101/577 | YandexPassportOAuthToken |
|
|
|
| SEC101/677 | YandexPredictorApiKey |
|
||
| SEC101/678 | YandexTranslateApiKey |
|
||
| SEC101/578 | ZuploConsumerApiKey |
|
|
非提供者模式
下表列出秘密掃描偵測到的非提供者產生的秘密。 從 [秘密掃描] 索引標籤的 [信賴度] 下拉式清單中選取 [其他]，即可檢視非提供者密碼。如需詳細資訊，請參閱 管理秘密掃描警示。
提示
非提供者模式的偵測目前處於 Beta 版中，而且可能會變更。
| 規則標識碼 | 代幣名稱 | 使用者警示 | 有效性檢查 |
|---|---|---|---|
| SEC101/122 | AspNetMachineKey |
|
|
| SEC101/042 | DynatraceToken |
|
|
| SEC101/528 | GenericJwt |
|
|
| SEC101/032 | GpgCredentials |
|
|
| SEC101/009 | LinkedIn帳戶憑證 |
|
|
| SEC101/033 | MongoDbCredentials |
|
|
| SEC101/036 | MySqlCredentials |
|
|
| SEC101/056 | OpenSshPrivateKey |
|
|
| SEC101/013 | PemPrivateKey |
|
|
| SEC101/058 | PgpPrivateKey |
|
|
| SEC101/055 | Pkcs12CertificatePrivateKeyBundle |
|
|
| SEC101/054 | PkcsPrivateKey |
|
|
| SEC101/038 | PostgreSqlCredentials |
|
|
| SEC101/057 | PuttyPrivateKey |
|
|
| SEC101/041 | RabbitMQ憑證 |
|
|
| SEC101/059 | RSA私有密鑰 |
|
|
| SEC101/037 | SqlLegacyCredentials |
|
|
| SEC101/127 | UrlCredentials |
|