Crates.io Key

Description

General

• Documentation: https://doc.rust-lang.org/cargo/reference/publishing.html
• Summary: Crates.io is Rust community's package registry. This detector catches the API key used by the crate command. At the time of writing there is no documented API that uses the key. The key allows to create new crates, push updates, delete them, etc.
• IPs allowlist: Crates.io does not have a way to restrict IPs.
• Scopes: Crates.io does not support scopes.

Revoke the secret

To revoke the key, just go to the account settings and in the "API Access" search the key and click on "Revoke".

Check for suspicious activity

The keys' listing in the account settings has the date and time of the last time the key was used.

Details for Crates io key

• Family: Api

• Category: Package registry

• Company: Rust Foundation

• High recall: True

• Validity check available: False

• Minimum number of matches: 1

• Occurrences found for one million commits: 2.07

• Prefixed: True

• PreValidators:

- type: FilenameBanlistPreValidator
  banlist_extensions:
    - ipynb
  banlist_filenames: []
  check_binaries: false
  include_default_banlist_extensions: false
  ban_markup: false
- type: ContentWhitelistPreValidator
  patterns:
    - cio[a-z0-9]{32}

Examples

- text: cioMErjYDbpRA00nE5TxOfch8fwolERGs8A
  apikey: cioMErjYDbpRA00nE5TxOfch8fwolERGs8A