Defining Global Custom Detection Rules
Security for Bitbucket allows for creation of custom scanning rules using regular expressions. The rules can only be created, enabled, or disabled by Bitbucket Administrators or anyone that's been granted explicit access.
Please make sure the rules you add aren’t too broad, as they can impact the performance of Bitbucket.
To create a rule, go to Administration → Security for Bitbucket Server → Security Validation Rules → Custom Rules. Alternatively, you may reach the configuration by clicking the gear icon on any dashboard:
In the Project- and Repository-level Dashboards, if you are not a Bitbucket admin nor a recipient of explicit access, the gear icon will not appear.
This will take you to the Security for Bitbucket Settings page. The custom rules area appears near the bottom as shown:
Global custom rules in the Security For Bitbucket settings
Our application uses the built-in JDK java regex library (Java 8), which you can compare to other regex engines here.
If a secret on a single line matches more than one rule (built-in, custom, or a per-repository rule), only the first match will be reported.
Example Rules
Bitcoin Address
^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$ Youtube Links
<a\s+(?:[^>]*)href=\"((?:https|http):\/\/\w{0,3}.youtube+\.\w{2,3}\/watch\?v=[\w-]{11})">(?:.*?)<\/a>