mcp-server-semgrep/semgrep-rules/generic/secrets/security/detected-onfido-live-api-token.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: detected-onfido-live-api-token
  pattern-regex: (?:api_live(?:_[a-zA-Z]{2})?\.[a-zA-Z0-9-_]{11}\.[-_a-zA-Z0-9]{32})
  languages: [regex]
  message: Onfido live API Token detected
  severity: ERROR
  metadata:
    cwe:
    - 'CWE-798: Use of Hard-coded Credentials'
    category: security
    technology:
    - secrets
    - onfido
    confidence: HIGH
    references:
    - https://documentation.onfido.com/api/latest/#api-tokens
    subcategory:
    - audit
    likelihood: HIGH
    impact: HIGH