API key, access token or private key in a string literal
Critical — a working credential committed to the repository; rotate it, git history keeps it.
What it catches
Vendors give their secrets recognisable prefixes precisely so that leaks can be caught: sk_live_ (Stripe), AKIA (AWS), ghp_ (GitHub), xoxb- (Slack), -----BEGIN PRIVATE KEY-----. One of those in an INSERT, an UPDATE or a column DEFAULT is a working credential committed to the repository. The rule matches only published formats, never entropy — a uuid, a bcrypt hash or a base64 blob is not a token, and the rule stays silent on all of them.
Fires on
INSERT INTO settings (key, value) VALUES ('stripe_secret', 'sk_live_51H8zK2eZvKYlo2CabcDEFghij');Do this instead
Never seed a live token through a migration. Store a reference (the secret's name in your vault) or a placeholder the deploy substitutes, and have the application read the value at runtime. Rotate the token that was already committed — git history keeps it.
INSERT INTO settings (key, value) VALUES ('stripe_secret', 'vault:stripe/live/secret_key'); This rule runs locally in the free CLI — or with the full corpus through the hosted service: npx bolvrk check migration.sql