Find hard-coded secret literals
Recipe ID
org.openrewrite.kotlin.security.FindHardCodedSecrets$KtRecipeArtifact
io.moderne.recipe:recipes-kotlinHigh-confidence regex matches for AWS access keys, GitHub PATs, Stripe API keys, Google API keys, Slack tokens, and JWTs — plus a heuristic match for properties named password/secret/token/apiKey with non-empty string defaults. Each match needs immediate rotation if it is a real credential.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.kotlin.security.FindHardCodedSecrets$KtRecipeIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:recipes-kotlin:0.2.0Definition
This recipe runs the following recipes in order.
- Find AWS Access Key literals (
AKIA…)org.openrewrite.kotlin.security.FindAwsAccessKeyLiteral$KtRecipe - Find GitHub PAT literals (
ghp_…)org.openrewrite.kotlin.security.FindGitHubPatLiteral$KtRecipe - Find Stripe API key literals (
sk_live_…/sk_test_…)org.openrewrite.kotlin.security.FindStripeKeyLiteral$KtRecipe - Find Google API key literals (
AIza…)org.openrewrite.kotlin.security.FindGoogleApiKeyLiteral$KtRecipe - Find Slack token literals (
xoxb-/xoxp-/xoxa-/xoxr-/xoxs-)org.openrewrite.kotlin.security.FindSlackTokenLiteral$KtRecipe - Find JWT literals (
eyJ…-prefixed three-segment tokens)org.openrewrite.kotlin.security.FindJwtLiteral$KtRecipe - Find variables named
password/secret/token/apiKeywith a non-empty literal defaultorg.openrewrite.kotlin.security.FindSensitiveNamedVariableLiteral$KtRecipe - Find
-----BEGIN ... PRIVATE KEY-----literalsorg.openrewrite.kotlin.security.FindPrivateKeyHeaderLiteral$KtRecipe - Find
"Basic <base64>"literals in sourceorg.openrewrite.kotlin.security.FindBasicAuthLiteral$KtRecipe
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats