# SPDX-License-Identifier: AGPL-3.0-only
# A request for a file that is only interesting to someone who should
# not have it: version-control metadata, environment files, private
# keys, shell history, credentials. Whatever the answer was — a 200 here
# is worse than a 404, not better — so the status is not part of it.
#
# The prefilter is `/.`, a dot immediately after a slash, which is rare
# in ordinary traffic. The one common exception is /.well-known, which
# the alternation simply does not list.
# .DS_Store is not here: WebDAV clients ask for it as a matter of course
# (it left the list on 2026-08-22, with the −1 parser that cancelled it).
parser: http-secret-probe
log: http
prefilter: "/."
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/\.(?:env|git|svn|hg|bzr|aws|ssh|docker|vscode|npmrc|netrc|htpasswd|htaccess|bash_history|sh_history|mysql_history|s3cfg|msmtprc|config|cvs|subversion|passwd|pwd|rhosts|profile|bashrc|travis\.yml|gitlab-ci)\b[^ "?]*)(?:\?[^ "]*)? [^"]*" (?P<status>\d{3}) '
time_field: time
time_format: nginx
