gitleaks / gitleaks

Protect and discover secrets using Gitleaks 🔑

Home Page:https://gitleaks.io

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

GitLeaks does not detect Jira api keys in source code

Maksym-Hrabar opened this issue · comments

During the use of gitleaks, it was found that it does not detect Jira API keys.

We found a rule that should check these key types, but it doesn't work:

[[rules]]
id = "atlassian-api-token"
description = "Detected an Atlassian API token, posing a threat to project management and collaboration tool security and data confidentiality."
regex = '''(?i)(?:atlassian|confluence|jira)(?:[0-9a-z\-_\t .]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|\"|\s|=|\x60){0,5}([a-z0-9]{24})(?:['|\"|\n|\r|\s|\x60|;]|$)'''
keywords = [
    "atlassian","confluence","jira",
]

For the test, we used this key: "ATATT3xFfGF0K3irG5tKKi-6u-wwaXQFeGwZ-IHR-hQ3CulkKtMSuteRQFfLZ6jihHThzZCg_UjnDt-4Wl_gIRf4zrZJs5JqaeuBhsfJ4W5GD6yGg3W7903gbvaxZPBjxIQQ7BgFDSkPS8oPispw4KLz56mdK-G6CIvLO6hHRrZHY0Q3tvJ6JxE=C63992E6"

This key in the source code wasn't detected.