" extractors: - type: regex name: secret_key_base part: body regex: - 'secret_key

# Rails Secrets Config Exposure Detection Module id: rails-secrets-yml-exposure info: name: Rails Secrets Config Exposure author: sif severity: high description: Detects an exposed Rails config/secrets.yml that leaks the secret key base tags: [rails, ruby, secrets, secret-key-base, exposure, recon] type: http http: method: GET paths: - "{{BaseURL}}/config/secrets.yml" matchers: - type: status status: - 200 - type: word part: body words: - "secret_key_base:" - type: word part: body negative: true condition: or words: - "" - "" extractors: - type: regex name: secret_key_base part: body regex: - 'secret_key_base:\s*["'']?([a-f0-9]{32,})' group: 1