Practical Security Automation and Testing

Sensitive information discovery

In addition to PII, there is also other sensitive information related to the system and applications that needs to be discovered and secured. The purpose of identifying these is to avoid such information, which may be hardcoded in the source code or within the configuration files, being exposed to debug logs:

System-related sensitive/vulnerable information	Examples of regular expression patterns
Password	Passw(d|ord)?|secret | username | key
Private key	(private|api|secret|aws)[_-]?key
Hardcoded URL	(http | https | ftp | ftps)
MD5 hash	^[a-f0-9]{32}$
SHA1 hash	\b([a-f0-9]{40})\b
Base64 encoding	^(?:[A-Za-z0-9+/]{4})* (?:[A-Za-z0-9+/]{2}==| [A-Za-z0-9+/]{3}=| [A-Za-z0-9+/]{4})$ ...