This is a GitHub Advanced Security (GHAS) Secret Scanning Custom Pattern I created to detect likely hardcoded credentials while reducing common false positives in code.
Goal: detect assignments for these key names:
password
secret
apikey / api_key / api-key
Pattern regex:
(?i)\b(password|secret|api[_-]?key)\b\s*[:=]\s*(?!\s*\$\{)(?!\s*process\.env\b)(?:['"])?[A-Za-z0-9!*@#$%^&*()_+=-]{5,}(?:['"])?
What it should catch (examples):
password: "ahsjdfahsjfhdjsahj"
secret = 'kjfskahfsdhfj'
apikey: ABCDE12345!@# (unquoted)
What it tries NOT to catch (common false positives):
password: ${password_somename} (template/variable placeholder)
secret: ${VAULT_SECRET}
password: process.env.DB_PASSWORD (env var reference, not a hardcoded secret)
This is intended as a practical baseline; it won’t be perfect for every language/config style. If you have suggestions to improve the detection accuracy (reduce false positives/false negatives) for GHAS custom patterns, please share.