LeakSnitchInstall free

Detection pattern library

Radical transparency means you can read every rule, test it, and verify it in real time. These are the public patterns behind LeakSnitch's detection engine.

API Keys, Tokens and Secrets

API KeyCritical
(api[_-]?key\s*(?:is|:|=)\s*["']?)([A-Za-z0-9\-_]{8,})
JWT TokenCritical
\b(eyJ[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+\.[A-Za-z0-9-_\/=]*)\b
Bearer TokenCritical
Bearer\s+([A-Za-z0-9\-_.=]{20,})
AWS Access KeyCritical
(AKIA[0-9A-Z]{16})
AWS Secret KeyCritical
(AWS_SECRET_ACCESS_KEY\s*=\s*)([A-Za-z0-9/+=]{20,})
Google Cloud APICritical
(AIza[0-9A-Za-z\-_]{35})
Google OAuth Client SecretCritical
\b(GOCSPX-[A-Za-z0-9-_]{28,32})\b
GitHub Access TokenCritical
\b(gh[pousr]_[A-Za-z0-9_]{36,255})\b
Slack WebhookCritical
(https:\/\/hooks\.slack\.com\/services\/[A-Z0-9]+\/[A-Z0-9]+
OAuth Access TokenCritical
(?:gho|ghu|ghs|ghr|ya29|xox[pbar]-|xoxa-|xoxs-|xoxc-|xoxb-|y
API SecretCritical
AAAA[A-Za-z0-9_-]{7}:[A-Za-z0-9_-]{140}
Stripe Secret KeyCritical
(sk_(live|test)_[0-9a-zA-Z]{16,})
OpenAI API KeyCritical
\bsk-proj-[A-Za-z0-9-_]{32,48}\b
HuggingFace API KeyCritical
hf_[A-Za-z0-9]{32,}
Anthropic API KeyCritical
(sk-ant-[a-zA-Z0-9\-_]{20,})
Session CookieCritical
(Set-Cookie:\s*session=[^;\s]+)
Cookie HeaderHigh
(?:Set-Cookie|Cookie):\s*[^\n]*?(?:session|auth|token|sid|jw
Authorization HeaderCritical
(Authorization:\s*(?:Bearer|Basic|OAuth)\s+[A-Za-z0-9\-_.=:+
Slack Channel ReferenceMedium
\B#(?![a-f0-9]{3,6}\b)[a-z][a-z0-9\-_]{2,}
Base64 Auth HeaderCritical
(Authorization:\s*Basic\s+[A-Za-z0-9+/=]{16,})

Sensitive Business Data

Password AssignmentCritical
\b(password|pwd)\s*(?:is|:|=)\s*["']?([^\s,;]{6,})
Internal Document TextHigh
(notion\.so|docs\.google\.com\/document|confluence\.[^\s]+|a

Personal Data (PII)

AadhaarCritical
\b([2-9]\d{11})\b
Credit CardCritical
\b(\d{13,19})\b
PANHigh
\b([A-Z]{5}[0-9]{4}[A-Z])\b
Phone (IN)Medium
((?:\+91[\s-]*)?[6-9](?:[\s-]?\d){9})
Phone (US)Medium
\(\d{3}\)[\s-]?\d{3}[\s-]?\d{4}
EmailMedium
([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})
GPS CoordinatesMedium
(?:lat|latitude)\s*[:=]\s*([+-]?\d+\.\d+).*?(?:lng|longitude
AddressMedium
(?:pincode|pin\s*code|flat\s*no|landmark)\s*[:=]\s*([^\s,;]+
Bank Account + IFSCCritical
\b([A-Z]{4}0[A-Z0-9]{6})\b.*?\b(\d{9,18})\b
Employee/Customer IDMedium
\b(EMP\d{3,}|CUST\d{3,}|USER\d{3,}|STU\d{3,})\b
Medical/Prescription DataHigh
(Rx\s*No\.?\s*\d+|prescription\s*:\s*\w+)
Student DataMedium
(Roll\s*No\.?\s*\d+|CGPA\s*[:=]\s*\d{1,2}\.\d{1,2})
Invoice/Tax IDHigh
(TIN\s*[:=]\s*\w+|GSTIN\s*[:=]\s*\w+)
Browser Fingerprint DataMedium
(User-Agent:\s*[^\n]+|\b\d{1,3}(?:\.\d{1,3}){3}\b|session\s*
UPI IDHigh
\b([a-zA-Z0-9.\-_]{2,}@(okaxis|oksbi|okhdfcbank|okicici|okid
PayTM/PhonePe QR LinkHigh
(https?:\/\/(paytm\.me|phon\.pe|upi\.pay|gpay\.app|pay\.goog
Insurance Policy NumberHigh
policy\s*(no\.?|number)?\s*[:=\-]?\s*([a-zA-Z0-9]{8,16})

Infrastructure and Internal Systems

Generic Private KeyCritical
-----BEGIN\s+(?:RSA|EC|DSA|OPENSSH|PRIVATE)\s+KEY-----\s*[\r
Environment VariableHigh
([A-Z][A-Z0-9_]{1,}\s*=\s*)([^\s]+)
Database URICritical
((?:mongodb|postgres(?:ql)?|mysql|mariadb|redis|sqlite|sqlse
Internal URLHigh
(https?:\/\/[^\s]+\.(?:local|internal|corp|intranet|private)
SaaS Admin URL with TokenCritical
(https?:\/\/[^\s]+\?(?:[^\s]*&)?auth_token=[A-Za-z0-9\-_]+)
Google Analytics IDHigh
(UA-\d{4,10}-\d+|G-\w{7,10})
S3/GCS PathHigh
(s3:\/\/[a-z0-9\-\.\/]+|gs:\/\/[a-z0-9\-\.\/]+)
DevOps Config File ReferenceHigh
\.(github|gitlab|circleci|travis|bitbucket)\/(workflows|pipe

Password and Credential Disclosures

Password DisclosureCritical
(?:here(?:'s| is)|this is|please use|use (?:this|the)|don'?t
API Key DisclosureCritical
(?:here(?:'s| is)|this is|please use|use (?:this|the)|my|the
Secret Key DisclosureCritical
(?:here(?:'s| is)|my|the|please use|don'?t share(?:\s+this)?
JWT DisclosureCritical
(?:here(?:'s| is)|this is|please use|use (?:this|the)|my|the
Token DisclosureCritical
(?:here(?:'s| is)|this is|please use|use (?:this|the)|my|the
AWS Key DisclosureCritical
(?:here(?:'s| is)|my|the|please use|use (?:this|the))\s+(?:a
Stripe Key DisclosureCritical
(?:here(?:'s| is)|my|the|please use)\s+(?:stripe\s+)?(?:secr
Database URI DisclosureCritical
(?:here(?:'s| is)|my|the|please use|use (?:this|the))\s+(?:(
Bearer Token DisclosureCritical
(?:here(?:'s| is)|my|the|please use|use (?:this|the))\s+bear
UPI DisclosureCritical
(?:the\s+)?(?:upi\s*(?:id)?|vpa|payment\s+(?:id|details?))(?
Credential DisclosureCritical
(?:credential|login\s+details?)\s*(?:is|:|=|-)?\s*["']?([^\s