Add freemius secret key detection (#1611)

cmd/generate/config/main.go

@@ -90,6 +90,7 @@ func main() {
 		rules.FlutterwaveEncKey(),
 		rules.FlyIOAccessToken(),
 		rules.FrameIO(),
+		rules.Freemius(),
 		rules.FreshbooksAccessToken(),
 		rules.GoCardless(),
 		// TODO figure out what makes sense for GCP

cmd/generate/config/rules/freemius.go

@@ -0,0 +1,47 @@
+package rules
+
+import (
+	"github.com/zricethezav/gitleaks/v8/cmd/generate/config/utils"
+	"github.com/zricethezav/gitleaks/v8/config"
+	"regexp"
+)
+
+func Freemius() *config.Rule {
+	// define rule
+	r := config.Rule{
+		RuleID:      "freemius-secret-key",
+		Description: "Detected a Freemius secret key, potentially exposing sensitive information.",
+		Regex:       regexp.MustCompile(`(?i)["']secret_key["']\s*=>\s*["'](sk_[\S]{29})["']`),
+		Keywords:    []string{"secret_key"},
+		Path:        regexp.MustCompile(`(?i)\.php$`),
+	}
+
+	// validate
+	tps := map[string]string{
+		"file.php": `$config = array(
+			"secret_key" => "sk_ubb4yN3mzqGR2x8#P7r5&@*xC$utE",
+		);`,
+	}
+	// It's only used in PHP SDK snippet.
+	// see https://freemius.com/help/documentation/wordpress-sdk/integrating-freemius-sdk/
+	fps := map[string]string{
+		// Invalid format: missing quotes around `secret_key`.
+		"foo.php": `$config = array(
+			secret_key => "sk_abcdefghijklmnopqrstuvwxyz123",
+		);`,
+		// Invalid format: missing quotes around the key value.
+		"bar.php": `$config = array(
+			"secret_key" => sk_abcdefghijklmnopqrstuvwxyz123,
+		);`,
+		// Invalid: different key name.
+		"baz.php": `$config = array(
+			"other_key" => "sk_abcdefghijklmnopqrstuvwxyz123",
+		);`,
+		// Invalid: file extension, should validate only .php files.
+		"foo.html": `$config = array(
+			"secret_key" => "sk_ubb4yN3mzqGR2x8#P7r5&@*xC$utE",
+		);`,
+	}
+
+	return utils.ValidateWithPaths(r, tps, fps)
+}

config/gitleaks.toml

@@ -515,6 +515,13 @@ description = "Found a Frame.io API token, potentially compromising video collab
 regex = '''fio-u-(?i)[a-z0-9\-_=]{64}'''
 keywords = ["fio-u-"]
 
+[[rules]]
+id = "freemius-secret-key"
+description = "Detected a Freemius secret key, potentially exposing sensitive information."
+regex = '''(?i)["']secret_key["']\s*=>\s*["'](sk_[\S]{29})["']'''
+path = '''(?i)\.php$'''
+keywords = ["secret_key"]
+
 [[rules]]
 id = "freshbooks-access-token"
 description = "Discovered a Freshbooks Access Token, posing a risk to accounting software access and sensitive financial data exposure."