/secrets-and-dorks

name: secrets-and-dorks
description: "Secret regex catalog, dork corpus, GitHub code-search dorks, and read-only credential validators for authorized secret discovery and verification."
when_to_use: "Use for authorized secret discovery and verification: matching API-key/credential regexes (Anthropic, OpenAI, AWS, GitHub PAT, and many more), dorking across GitHub/Google/Bing/DDG, scanning JS/sourcemaps for leaked credentials, or validating found credentials read-only."

Secrets & Dorks

> Sub-skill of `offensive-osint`. Load `osint-methodology` for pipeline and triage context. > Authorized targets only. Read-only validators only — never use a validated credential to create, modify, or delete anything.

---

BEHAVIORAL CONTRACT

**When triggered:** Secret scanning, leaked credential hunting, GitHub/Google/Bing dorking, API key discovery, or credential verification is needed.

**Execute:**

1. Run the 48-pattern secret catalog (§1) against the target corpus — GitHub code, Postman workspaces, JS bodies, sourceMaps, mobile strings, Wayback HTML, paste sites, Stack Exchange code blocks. Process patterns in order (most-specific first) to minimize false positives. 2. Run the dork corpus (§2) across Google, Bing, Brave, DDG — substitute `{domain}` and `{company}`. Run across multiple engines (they surface different results). 3. Run GitHub code-search dorks (§3) against the target domain stem, full domain, and company name. 4. For every secret match: classify by catalog severity, then validate using the matching read-only validator from §4 (if one exists for that provider). 5. Never validate credentials for which no read-only endpoint exists. Never validate AWS root ARNs (`:root`). 6. For validated-live credentials: emit `SECRET_LEAK` finding at catalog severity, then chain to `post-discovery` for enumeration (gated on RoE).

**Output:** `SECRET_LEAK` findings per `osint-methodology` §3 schema. Validator results per §4.10 schema (status, provider, account_id, scope, checked_at, detectability).

**Severity rules:** Per catalog table (§1). False-positive-prone patterns (22 JWT, 23 Bearer, 29 Generic) require context check before emitting.

**Gating rules:** Read-only validators only. Never create/modify/delete/send. Tag every validation with detectability + checked_at UTC.

**Chain to:** Feed validated-live credentials to `post-discovery` for enumeration workflows. Feed GitHub dork results through §1 catalog for automated secret scanning. Feed all findings to `analysis-and-reporting` for severity classification and attack-path hints.

---

1. Secret-Pattern Catalog — 48 Patterns

Run against: GitHub code, Postman workspaces, JS bodies, sourcesContent blobs, mobile strings, Wayback HTML, paste sites, Stack Exchange code blocks. **Order matters: most-specific first.**

| # | Name | Regex | Severity | Category | | --- | ------------------------- | -------------------------------------------------------------------------------------------------------------------- | ------------ | ---------------- | | 1 | AWS Access Key | `\b(AKIA\|ASIA)[0-9A-Z]{16}\b` | **CRITICAL** | aws | | 2 | AWS Secret Key (typed) | `(?i)aws[_\-]?secret[_\-]?access[_\-]?key['"\s:=]+([A-Za-z0-9/+=]{40})` | **CRITICAL** | aws | | 3 | AWS Secret (loose) | `(?i)aws(.{0,20})?(secret\|sk)["'=: ]+([0-9a-z/+=]{40})` | HIGH | aws | | 4 | GCP Service Account JSON | `"type"\s*:\s*"service_account"` | **CRITICAL** | gcp | | 5 | Google API Key | `\bAIza[0-9A-Za-z_\-]{35}\b` | HIGH | gcp | | 6 | GitHub Classic PAT | `\bghp_[A-Za-z0-9]{36}\b` | **CRITICAL** | github | | 7 | GitHub Fine-grained PAT | `\bgithub_pat_[A-Za-z0-9_]{82}\b` | **CRITICAL** | github | | 8 | GitHub OAuth | `\bgho_[A-Za-z0-9]{36}\b` | HIGH | github | | 9 | GitHub Server-to-Server | `\bgh[usr]_[A-Za-z0-9]{36,}\b` | HIGH | github | | 10 | Stripe Live Key | `\bsk_live_[0-9A-Za-z]{24,}\b` | **CRITICAL** | stripe | | 11 | Stripe Test Key | `\bsk_test_[0-9A-Za-z]{24,}\b` | LOW | stripe | | 12 | Slack Token | `\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b` | HIGH | slack | | 13 | Slack Webhook | `<https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+`> | MEDIUM | slack | | 14 | SendGrid Key | `\bSG\.[A-Za-z0-9_\-]{22}\.[A-Za-z0-9_\-]{43}\b` | HIGH | email_svc | | 15 | Mailgun Key (v1) | `\bkey-[0-9a-zA-Z]{32}\b` |