id: codeclimate-token

info:
  name: CodeClimate Token
  author: DhiyaneshDK
  severity: info
  reference:
    - https://github.com/praetorian-inc/noseyparker/blob/main/crates/noseyparker/data/default/builtin/rules/codeclimate.yml
    - https://github.com/codeclimate/ruby-test-reporter/issues/34
    - https://docs.codeclimate.com/docs/finding-your-test-coverage-token#should-i-keep-my-test-reporter-id-secret
  classification:
    cwe-id: CWE-522,CWE-540
  metadata:
    verified: true
    max-request: 1
  tags: codeclimate,token,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        part: body
        regex:
          - '(?i)codeclima.{0,50}\b([a-f0-9]{64})\b'
# digest: 490a00463044022039f1bfd5b9c9453025f95aa7ecdb99847e11218628223d8a6c5d407e9166c1f602201190115a71c97ab0bc5ff4bf16b956e88797a8277d9b49504f55a9cb87e9bac8:922c64590222798bb761d5b6d8e72950