secret.generic_credential
A credential-shaped keyword next to a high-entropy value appears in the text, with no named provider's format matched.
Gitleaks rule generic-api-key.
What it looks at#
A keyword like api, auth, key, credential, secret, password or token,
immediately followed by an assignment-shaped separator (=, :, =>, and similar) and a
value with enough Shannon entropy to plausibly be a real secret rather than a placeholder.
This is gitleaks’ catch-all — it’s what flags an in-house or unrecognised service’s
credential that no named-provider rule matches.
Lower severity than secret.provider_token on the same reasoning /v1/pii uses for its
own lowest-confidence checks: broader, noisier, and the first to be suppressed by an
allowlist hit — the rule carries by far the largest allowlist of anything in the ruleset
(regexes, ~1,400 stopwords, and a line-scoped check for patterns like Docker secret
mounts and JS imports) specifically to hold down false positives on identifier-shaped code
that merely contains the word “key” or “token”.
Why it matters#
Even without a recognisable provider format, a high-entropy value sitting next to a credential keyword is very often a real secret — just one this ruleset has no dedicated pattern for.
What to do#
Medium severity. Treat a hit as “probably a real credential for something,” worth a human
look before you decide whether it needs rotating — this check has no provider to point you
at, unlike secret.provider_token.