feat: add modern credential dorks

README.md

@@ -80,10 +80,17 @@ The CI test matrix covers Python 3.10 through 3.13.
 ### Contribution
 
 Please consider contributing dorks that can reveal potentially sensitive information on Github.
+Documented sources for newer credential families are maintained in
+[docs/dork-sources.md](docs/dork-sources.md).
 
 ### List of Dorks
 
-I am not categorizing at the moment. Instead, I am going to just the list of dorks with a description. Many of the dorks can be modified to make the search more specific or generic. You can see more options [here](https://github.com/search#search_cheatsheet_pane).
+The canonical, categorized dictionary is [github-dorks.txt](github-dorks.txt).
+The table below provides descriptions for many established patterns; newer
+credential families and their vendor references are tracked in
+[docs/dork-sources.md](docs/dork-sources.md). Many dorks can be modified to make
+the search more specific or generic. You can see more options
+[here](https://docs.github.com/en/search-github/github-code-search/understanding-github-code-search-syntax).
 
  Dork                                           | Description
 ------------------------------------------------|--------------------------------------------------------------------------

docs/dork-sources.md

@@ -0,0 +1,36 @@
+# Dork source references
+
+The primary `github-dorks.txt` dictionary favors documented token prefixes and
+canonical environment-variable names. Prefixes generally produce stronger
+signals; variable-name searches also catch providers that do not guarantee a
+stable public token format.
+
+These references support the modern credential families added to the
+dictionary. They are not exhaustive, and a match still requires manual review.
+
+## Git hosting and package registries
+
+- [GitHub token formats](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/about-authentication-to-github)
+- [GitLab token prefixes](https://docs.gitlab.com/security/tokens/#token-prefixes)
+- [npm access tokens](https://docs.npmjs.com/about-access-tokens/)
+- [PyPI token format](https://docs.pypi.org/trusted-publishers/internals/)
+
+## AI providers
+
+- [OpenAI API key setup](https://platform.openai.com/docs/quickstart)
+- [Claude API authentication](https://platform.claude.com/docs/en/api/overview#authentication)
+- [Hugging Face user access tokens](https://huggingface.co/docs/hub/security-tokens)
+
+## Cloud and infrastructure
+
+- [HCP Terraform CLI credentials](https://developer.hashicorp.com/terraform/cli/config/config-file#credentials)
+- [Cloudflare API tokens](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/)
+- [DigitalOcean API tokens](https://docs.digitalocean.com/reference/api/create-personal-access-token/)
+- [Pulumi access tokens](https://www.pulumi.com/docs/administration/access-identity/access-tokens/)
+- [Vercel access tokens](https://vercel.com/docs/rest-api/reference/welcome#creating-an-access-token)
+- [Supabase environment variables](https://supabase.com/docs/guides/functions/secrets)
+- [Sentry authentication tokens](https://docs.sentry.io/api/auth/)
+
+## General secret formats
+
+- [GitHub-supported secret patterns](https://docs.github.com/en/code-security/reference/secret-security/supported-secret-scanning-patterns)

github-dorks.txt

@@ -88,3 +88,54 @@ filename:discord_backup_codes.txt
 extension:yaml cloud.redislabs.com
 extension:json cloud.redislabs.com
 DATADOG_API_KEY language:shell
+
+# Git hosting and CI/CD tokens
+"github_pat_"
+"ghp_"
+"gho_" OR "ghu_" OR "ghs_" OR "ghr_"
+"glpat-"
+"gloas-" OR "gldt-"
+"glrt-" OR "glrtr-" OR "glcbt-" OR "glptt-"
+
+# Package registry tokens
+filename:.npmrc "_authToken="
+"pypi-" filename:.pypirc
+"NUGET_API_KEY" path:.env
+"GEM_HOST_API_KEY" path:.env
+
+# AI and machine learning provider credentials
+"OPENAI_API_KEY" path:.env
+"ANTHROPIC_API_KEY" path:.env
+"sk-ant-"
+"HF_TOKEN" path:.env
+"hf_" filename:token path:huggingface
+
+# Cloud, infrastructure, and deployment credentials
+"CLOUDFLARE_API_TOKEN" path:.env
+"DIGITALOCEAN_ACCESS_TOKEN" path:.env
+"dop_v1_"
+"PULUMI_ACCESS_TOKEN" path:.env
+"TFE_TOKEN" path:.env
+"atlasv1" filename:credentials.tfrc.json
+"VERCEL_TOKEN" path:.env
+"SUPABASE_SERVICE_ROLE_KEY" path:.env
+"SENTRY_AUTH_TOKEN" path:.env
+"sntrys_"
+
+# Payment and communications credentials
+"sk_live_" OR "rk_live_"
+"SENDGRID_API_KEY" path:.env
+"TWILIO_AUTH_TOKEN" path:.env
+"SLACK_BOT_TOKEN" path:.env
+"DISCORD_BOT_TOKEN" path:.env
+
+# Database connection strings and service accounts
+"mongodb+srv://" password
+"postgres://" password
+filename:service-account.json "private_key_id" "private_key"
+"GOOGLE_PRIVATE_KEY" path:.env
+
+# Modern private key formats
+"-----BEGIN OPENSSH PRIVATE KEY-----"
+"-----BEGIN PRIVATE KEY-----"
+"AGE-SECRET-KEY-1"

tests/test_github_dork.py

@@ -90,5 +90,38 @@ def test_rejects_missing_dorks_file_with_clear_error(self):
             github_dork.search(gh_dorks_file='/does/not/exist')
 
 
+class DorkDictionaryTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        dictionary = Path(__file__).parents[1] / 'github-dorks.txt'
+        cls.lines = dictionary.read_text(encoding='utf-8').splitlines()
+        cls.dorks = [
+            line for line in cls.lines
+            if line and not line.startswith(('#', ';'))
+        ]
+
+    def test_has_no_duplicate_dorks(self):
+        duplicates = sorted({dork for dork in self.dorks if self.dorks.count(dork) > 1})
+        self.assertEqual(duplicates, [])
+
+    def test_has_no_surrounding_whitespace(self):
+        untrimmed = [line for line in self.lines if line != line.strip()]
+        self.assertEqual(untrimmed, [])
+
+    def test_has_balanced_quotes(self):
+        malformed = [dork for dork in self.dorks if dork.count('"') % 2]
+        self.assertEqual(malformed, [])
+
+    def test_contains_modern_credential_families(self):
+        dictionary = '\n'.join(self.dorks)
+        for marker in (
+            'github_pat_', 'glpat-', 'pypi-', 'OPENAI_API_KEY',
+            'ANTHROPIC_API_KEY', 'HF_TOKEN', 'CLOUDFLARE_API_TOKEN',
+            'SUPABASE_SERVICE_ROLE_KEY', 'sk_live_',
+        ):
+            with self.subTest(marker=marker):
+                self.assertIn(marker, dictionary)
+
+
 if __name__ == '__main__':
     unittest.main()