Generic Sanctum token

Description

General

This detector catches personal access tokens issued by Laravel Sanctum, sent as Authorization: Bearer credentials.

Sanctum is only the library that mints the token: it authenticates to whichever application issued it, which may be a self-hosted Laravel app or a product built on Sanctum. GitGuardian cannot infer that service, hence a generic detector.

Specifications

The {value} must:

• Be assigned to a variable whose name contains secret, token, credential, auth, or a *_key form, like the Generic high entropy secret detector
• Match [0-9]{1,20} then | then 40 alphanumeric characters, optionally followed by an 8-character crc32 suffix
• Contain at least one digit, have a Shannon entropy of at least 3, and look random rather than like natural language

Revoke the secret

Revocation is manual: Sanctum has no central revocation endpoint. Sanctum tokens do not expire by default, so a leaked token stays valid until deleted.

1. Identify the application the token authenticates to, using the API host called in the surrounding code.
2. If that application exposes token settings, revoke it there.
3. Otherwise, delete the token in the Laravel application itself, as described in Revoking Tokens. The digits before | are the token id:

$user->tokens()->where('id', $tokenId)->delete();

Examples

Examples that WILL be caught

- text: |
    TOKEN = "67|foPpeJkEtftjB2uG565IkEwset7KeKCJ86NjwiaEfb9bfb39"
  apikey: 67|foPpeJkEtftjB2uG565IkEwset7KeKCJ86NjwiaEfb9bfb39

Examples that WILL NOT be caught

• The part after the | separator is not 40 alphanumeric characters:

- text: |
    access_token = "1234567890|abcdef0123456789abcdef0123456789"