feat: expand modern service dictionaries

README.md

@@ -89,12 +89,12 @@ provided. Use `--quiet` to suppress progress and summaries, or `--verbose` to
 print every query as it runs. Structured stdout remains machine-readable because
 status messages are sent to stderr.
 
-The bundled dictionary is split into `cloud`, `databases`, `devops`,
-`frameworks`, `private-keys`, `saas`, and `system` categories. Repeat
-`-c/--category` to combine categories. With no category or custom `--dork`
-file, the command uses the backward-compatible `github-dorks.txt` aggregate.
-That aggregate is generated from the category files with
-`python scripts/build-dorks.py`.
+The bundled dictionary is split into `ai`, `cloud`, `databases`, `devops`,
+`frameworks`, `identity`, `observability`, `private-keys`, `saas`, and `system`
+categories. Repeat `-c/--category` to combine categories. With no category or
+custom `--dork` file, the command uses the backward-compatible
+`github-dorks.txt` aggregate. That aggregate is generated from the category
+files with `python scripts/build-dorks.py`.
 
 ### Development
 

docs/dork-sources.md

@@ -21,6 +21,38 @@ dictionary. They are not exhaustive, and a match still requires manual review.
 - [OpenAI API key setup](https://platform.openai.com/docs/quickstart)
 - [Claude API authentication](https://platform.claude.com/docs/en/api/overview#authentication)
 - [Hugging Face user access tokens](https://huggingface.co/docs/hub/security-tokens)
+- [Groq API keys](https://console.groq.com/docs/quickstart)
+- [Mistral API authentication](https://docs.mistral.ai/api/)
+- [Cohere API keys](https://docs.cohere.com/docs/rate-limits)
+- [Replicate API tokens](https://replicate.com/docs/topics/security/api-tokens)
+- [Pinecone API keys](https://docs.pinecone.io/guides/get-started/authentication)
+- [LangSmith environment variables](https://docs.langchain.com/langsmith/observability-quickstart)
+
+## Identity and secrets management
+
+- [1Password service account tokens](https://developer.1password.com/docs/service-accounts/use-with-1password-cli/)
+- [Vault token environment variable](https://developer.hashicorp.com/vault/docs/commands#environment-variables)
+- [Doppler service tokens](https://docs.doppler.com/docs/service-tokens)
+- [Infisical machine identities](https://infisical.com/docs/documentation/platform/identities/machine-identities)
+- [Auth0 application credentials](https://auth0.com/docs/get-started/applications/application-settings)
+- [Clerk environment variables](https://clerk.com/docs/guides/development/clerk-environment-variables)
+
+## Databases and data platforms
+
+- [Neon API authentication](https://api-docs.neon.tech/reference/authentication)
+- [PlanetScale service tokens](https://planetscale.com/docs/concepts/service-tokens)
+- [Upstash Redis REST API](https://upstash.com/docs/redis/features/restapi)
+- [Upstash Vector REST API](https://upstash.com/docs/vector/api/get-started)
+- [MongoDB Atlas API authentication](https://www.mongodb.com/docs/atlas/configure-api-access/)
+- [Databricks personal access tokens](https://docs.databricks.com/aws/en/dev-tools/auth/pat)
+
+## Observability and developer security
+
+- [New Relic API keys](https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/)
+- [Grafana service account tokens](https://grafana.com/docs/grafana/latest/administration/service-accounts/)
+- [Honeycomb API keys](https://docs.honeycomb.io/configure/environments/manage-api-keys/)
+- [PagerDuty API access keys](https://developer.pagerduty.com/docs/rest-api-v2/authentication/)
+- [Snyk authentication](https://docs.snyk.io/snyk-cli/authenticate-to-use-the-cli)
 
 ## Cloud and infrastructure
 
@@ -31,6 +63,9 @@ dictionary. They are not exhaustive, and a match still requires manual review.
 - [Vercel access tokens](https://vercel.com/docs/rest-api/reference/welcome#creating-an-access-token)
 - [Supabase environment variables](https://supabase.com/docs/guides/functions/secrets)
 - [Sentry authentication tokens](https://docs.sentry.io/api/auth/)
+- [Netlify access tokens](https://docs.netlify.com/api-and-cli-guides/api-guides/get-started-with-api/)
+- [Fly.io access tokens](https://fly.io/docs/security/tokens/)
+- [Firebase CLI authentication](https://firebase.google.com/docs/cli#cli-ci-systems)
 
 ## General secret formats
 

github-dorks.txt

@@ -1,5 +1,22 @@
 # Generated by scripts/build-dorks.py. Edit github_dorks/dorks/*.txt.
 
+# Category: ai
+# AI model providers, inference platforms, and vector services
+"GROQ_API_KEY" path:.env
+"MISTRAL_API_KEY" path:.env
+"COHERE_API_KEY" path:.env
+"GEMINI_API_KEY" path:.env
+"REPLICATE_API_TOKEN" path:.env
+"TOGETHER_API_KEY" path:.env
+"OPENROUTER_API_KEY" path:.env
+"PPLX_API_KEY" path:.env
+"PINECONE_API_KEY" path:.env
+"WEAVIATE_API_KEY" path:.env
+"QDRANT_API_KEY" path:.env
+"LANGCHAIN_API_KEY" path:.env
+"MODAL_TOKEN_SECRET" path:.env
+"FAL_KEY" path:.env
+
 # Category: cloud
 # Cloud provider, infrastructure, observability, and deployment credentials
 filename:credentials aws_access_key_id
@@ -22,6 +39,11 @@ DATADOG_API_KEY language:shell
 "sntrys_"
 filename:service-account.json "private_key_id" "private_key"
 "GOOGLE_PRIVATE_KEY" path:.env
+"NETLIFY_AUTH_TOKEN" path:.env
+"RAILWAY_TOKEN" path:.env
+"RENDER_API_KEY" path:.env
+"FLY_API_TOKEN" path:.env
+"FIREBASE_TOKEN" path:.env
 
 # Category: databases
 # Database dumps, configuration, credentials, and connection strings
@@ -40,6 +62,14 @@ filename:dbeaver-data-sources.xml
 .mlab.com password
 "mongodb+srv://" password
 "postgres://" password
+"NEON_API_KEY" path:.env
+"PLANETSCALE_SERVICE_TOKEN" path:.env
+"UPSTASH_REDIS_REST_TOKEN" path:.env
+"UPSTASH_VECTOR_REST_TOKEN" path:.env
+"COCKROACH_API_KEY" path:.env
+"MONGODB_ATLAS_PRIVATE_KEY" path:.env
+"CLICKHOUSE_PASSWORD" path:.env
+"DATABRICKS_TOKEN" path:.env
 
 # Category: devops
 # Source control, CI/CD, and package registry credentials
@@ -65,6 +95,14 @@ filename:.npmrc "_authToken="
 "pypi-" filename:.pypirc
 "NUGET_API_KEY" path:.env
 "GEM_HOST_API_KEY" path:.env
+"CIRCLE_TOKEN" path:.env
+"BUILDKITE_AGENT_TOKEN" path:.env
+"AZURE_DEVOPS_EXT_PAT" path:.env
+"BITBUCKET_APP_PASSWORD" path:.env
+filename:config path:.kube "client-key-data"
+filename:kubeconfig "client-key-data"
+filename:credentials.tfrc.json "token"
+filename:.terraformrc "credentials"
 
 # Category: frameworks
 # Web framework and application configuration secrets
@@ -76,6 +114,33 @@ filename:prod.secret.exs
 filename:settings.py SECRET_KEY
 filename:secrets.yml password
 
+# Category: identity
+# Authentication, identity, and secrets-management credentials
+"AUTH0_CLIENT_SECRET" path:.env
+"CLERK_SECRET_KEY" path:.env
+"WORKOS_API_KEY" path:.env
+"OKTA_API_TOKEN" path:.env
+"STYTCH_SECRET" path:.env
+"OP_SERVICE_ACCOUNT_TOKEN" path:.env
+"OP_CONNECT_TOKEN" path:.env
+"VAULT_TOKEN" path:.env
+"DOPPLER_TOKEN" path:.env
+"INFISICAL_TOKEN" path:.env
+
+# Category: observability
+# Monitoring, telemetry, incident-response, and code-quality credentials
+"NEW_RELIC_LICENSE_KEY" path:.env
+"NEW_RELIC_API_KEY" path:.env
+"GRAFANA_API_KEY" path:.env
+"HONEYCOMB_API_KEY" path:.env
+"SPLUNK_HEC_TOKEN" path:.env
+"DT_API_TOKEN" path:.env
+"PAGERDUTY_API_TOKEN" path:.env
+"OPSGENIE_API_KEY" path:.env
+"SNYK_TOKEN" path:.env
+"SONAR_TOKEN" path:.env
+"CODECOV_TOKEN" path:.env
+
 # Category: private-keys
 # Cryptographic private keys and decryption keys
 extension:pem private
@@ -84,6 +149,9 @@ filename:id_rsa or filename:id_dsa
 filename:master.key path:config
 "-----BEGIN OPENSSH PRIVATE KEY-----"
 "-----BEGIN PRIVATE KEY-----"
+"-----BEGIN RSA PRIVATE KEY-----"
+"-----BEGIN EC PRIVATE KEY-----"
+"-----BEGIN PGP PRIVATE KEY BLOCK-----"
 "AGE-SECRET-KEY-1"
 
 # Category: saas

github_dorks/dorks/ai.txt

@@ -0,0 +1,15 @@
+# AI model providers, inference platforms, and vector services
+"GROQ_API_KEY" path:.env
+"MISTRAL_API_KEY" path:.env
+"COHERE_API_KEY" path:.env
+"GEMINI_API_KEY" path:.env
+"REPLICATE_API_TOKEN" path:.env
+"TOGETHER_API_KEY" path:.env
+"OPENROUTER_API_KEY" path:.env
+"PPLX_API_KEY" path:.env
+"PINECONE_API_KEY" path:.env
+"WEAVIATE_API_KEY" path:.env
+"QDRANT_API_KEY" path:.env
+"LANGCHAIN_API_KEY" path:.env
+"MODAL_TOKEN_SECRET" path:.env
+"FAL_KEY" path:.env

github_dorks/dorks/cloud.txt

@@ -19,3 +19,8 @@ DATADOG_API_KEY language:shell
 "sntrys_"
 filename:service-account.json "private_key_id" "private_key"
 "GOOGLE_PRIVATE_KEY" path:.env
+"NETLIFY_AUTH_TOKEN" path:.env
+"RAILWAY_TOKEN" path:.env
+"RENDER_API_KEY" path:.env
+"FLY_API_TOKEN" path:.env
+"FIREBASE_TOKEN" path:.env

github_dorks/dorks/databases.txt

@@ -14,3 +14,11 @@ filename:dbeaver-data-sources.xml
 .mlab.com password
 "mongodb+srv://" password
 "postgres://" password
+"NEON_API_KEY" path:.env
+"PLANETSCALE_SERVICE_TOKEN" path:.env
+"UPSTASH_REDIS_REST_TOKEN" path:.env
+"UPSTASH_VECTOR_REST_TOKEN" path:.env
+"COCKROACH_API_KEY" path:.env
+"MONGODB_ATLAS_PRIVATE_KEY" path:.env
+"CLICKHOUSE_PASSWORD" path:.env
+"DATABRICKS_TOKEN" path:.env

github_dorks/dorks/devops.txt

@@ -21,3 +21,11 @@ filename:.npmrc "_authToken="
 "pypi-" filename:.pypirc
 "NUGET_API_KEY" path:.env
 "GEM_HOST_API_KEY" path:.env
+"CIRCLE_TOKEN" path:.env
+"BUILDKITE_AGENT_TOKEN" path:.env
+"AZURE_DEVOPS_EXT_PAT" path:.env
+"BITBUCKET_APP_PASSWORD" path:.env
+filename:config path:.kube "client-key-data"
+filename:kubeconfig "client-key-data"
+filename:credentials.tfrc.json "token"
+filename:.terraformrc "credentials"

github_dorks/dorks/identity.txt

@@ -0,0 +1,11 @@
+# Authentication, identity, and secrets-management credentials
+"AUTH0_CLIENT_SECRET" path:.env
+"CLERK_SECRET_KEY" path:.env
+"WORKOS_API_KEY" path:.env
+"OKTA_API_TOKEN" path:.env
+"STYTCH_SECRET" path:.env
+"OP_SERVICE_ACCOUNT_TOKEN" path:.env
+"OP_CONNECT_TOKEN" path:.env
+"VAULT_TOKEN" path:.env
+"DOPPLER_TOKEN" path:.env
+"INFISICAL_TOKEN" path:.env

github_dorks/dorks/observability.txt

@@ -0,0 +1,12 @@
+# Monitoring, telemetry, incident-response, and code-quality credentials
+"NEW_RELIC_LICENSE_KEY" path:.env
+"NEW_RELIC_API_KEY" path:.env
+"GRAFANA_API_KEY" path:.env
+"HONEYCOMB_API_KEY" path:.env
+"SPLUNK_HEC_TOKEN" path:.env
+"DT_API_TOKEN" path:.env
+"PAGERDUTY_API_TOKEN" path:.env
+"OPSGENIE_API_KEY" path:.env
+"SNYK_TOKEN" path:.env
+"SONAR_TOKEN" path:.env
+"CODECOV_TOKEN" path:.env

github_dorks/dorks/private-keys.txt

@@ -5,4 +5,7 @@ filename:id_rsa or filename:id_dsa
 filename:master.key path:config
 "-----BEGIN OPENSSH PRIVATE KEY-----"
 "-----BEGIN PRIVATE KEY-----"
+"-----BEGIN RSA PRIVATE KEY-----"
+"-----BEGIN EC PRIVATE KEY-----"
+"-----BEGIN PGP PRIVATE KEY BLOCK-----"
 "AGE-SECRET-KEY-1"

tests/test_github_dork.py

@@ -431,11 +431,20 @@ def test_contains_modern_credential_families(self):
         for marker in (
             'github_pat_', 'glpat-', 'pypi-', 'OPENAI_API_KEY',
             'ANTHROPIC_API_KEY', 'HF_TOKEN', 'CLOUDFLARE_API_TOKEN',
-            'SUPABASE_SERVICE_ROLE_KEY', 'sk_live_',
+            'SUPABASE_SERVICE_ROLE_KEY', 'sk_live_', 'GROQ_API_KEY',
+            'PINECONE_API_KEY', 'UPSTASH_REDIS_REST_TOKEN',
+            'OP_SERVICE_ACCOUNT_TOKEN', 'CLERK_SECRET_KEY',
+            'NEW_RELIC_LICENSE_KEY', 'PAGERDUTY_API_TOKEN',
         ):
             with self.subTest(marker=marker):
                 self.assertIn(marker, dictionary)
 
+    def test_contains_focused_modern_categories(self):
+        categories = dictionaries.available_categories()
+        for category in ('ai', 'identity', 'observability'):
+            with self.subTest(category=category):
+                self.assertIn(category, categories)
+
     def test_aggregate_matches_categorized_dictionaries(self):
         category_dorks = list(dictionaries.iter_dorks(
             dictionaries.category_files().values()