REM build file list using for /R and extension filtering, skipping excludes for /R "%ROOT%" %%F in (%EXT_FILTER%) do ( set "FILE=%%~fF" REM check exclude patterns set "SKIP=0" for %%X in (%EXCLUDE:;= %) do ( echo "!FILE!" | findstr /i /c:"\\%%X\\" >nul if !errorlevel! equ 0 set "SKIP=1" ) if "!SKIP!"=="1" ( REM skip ) else ( REM Read file line by line set "LN=0" for /f "usebackq delims=" %%L in ("%%~fF") do ( set /a LN+=1 set "LINE=%%L" setlocal ENABLEDELAYEDEXPANSION set "L=!LINE!" endlocal & set "L=%L%" REM Quick presence checks for patterns to avoid expensive checks on every line echo "%L%" | findstr /i "AKIA AIza -----BEGIN PRIVATE KEY-----" >nul set "P1=%errorlevel%" echo "%L%" | findstr /r /c:"[A-Fa-f0-9]\8\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\4\-[A-Fa-f0-9]\12\" >nul set "P2=%errorlevel%" REM Generic long token heuristic: sequences of 20+ alnum or -_ characters echo "%L%" | findstr /r /c:"[A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-][A-Za-z0-9_-]" >nul set "P3=%errorlevel%" if "%P1%"=="0" (set "MATCHFOUND=1") else if "%P2%"=="0" (set "MATCHFOUND=1") else if "%P3%"=="0" (set "MATCHFOUND=1") else set "MATCHFOUND=0"
:: Timestamp for report for /f "tokens=1-6 delims=/:. " %%a in ("%date% %time%") do ( set "DT=%%a-%%b-%%c_%%d-%%e-%%f" ) if "%DT%"=="" ( REM fallback set "DT=%DATE%_%TIME%" set "DT=%DT::=-%" set "DT=%DT:/=-%" set "DT=%DT: =_%" set "DT=%DT:.=-%" ) get-keys.bat
:: parse other args set "EXTS=txt,env,conf,config,json,js,py,java,xml,ini,yml,yaml,md,log" set "EXCLUDE=.git;.venv;node_modules;venv" set "MASK=0" set "DRY=0" REM build file list using for /R and
:: -------------------------- :: Patterns to look for :: As batch lacks regex, we use findstr with /r and some heuristics :: -------------------------- REM Common patterns (simplified): REM - AWS Access Key ID: AKIA followed by 16 alphanumerics REM - AWS Secret Access Key: 40 base64-like chars (heuristic) REM - Google API key: "AIza" followed by 35 chars REM - JWT-like: three base64url segments separated by dots, present in a line REM - UUIDs: 8-4-4-4-12 hex pattern REM - Generic tokens: long alphanumeric strings >= 20 chars REM - Private key headers: -----BEGIN PRIVATE KEY----- log" set "EXCLUDE=.git