Back to Home
Security Reference

Scope Patterns
Security Reference

Every secret in Waykee Secrets has a scope that defines where it can be used. Scopes are the first line of defense: even if an AI agent is compromised by prompt injection, the secret can only be sent to authorized destinations.

host:domain.com Hostname restriction Recommended
regex:pattern Regular expression Advanced
Defense in depth: Scopes work alongside anti-theft protection and output redaction. Even if an attacker crafts a clever URL, the exfiltration scanner catches encoding tricks, file redirections, and piped commands independently.
Patterns by Service

Recommended scope patterns

Copy-paste ready patterns for the most common services. Each one is designed to be secure by default.

GitHub

Scope patterns
simple host:github.com
simple host:api.github.com
regex ^(https?://)?(api\.)?github\.com(/|$)

Covers

  • Repos & API
  • GitHub Actions
  • Packages & Gists

Blocks

  • github.com.evil.com
  • githubfake.com
  • evil.com/github.com
Key detail: The (/|$) at the end is critical. Without it, a domain like github.com.evil.com would match.

Waykee API

Scope patterns
simple host:wk2.waykee.com
simple host:apiprod.waykee.com
simple host:apidev.waykee.com
regex ^(https?://)?((wk2|apiprod|apidev)\.waykee\.com|localhost:50[0-9]{2})(/|$)

Covers

  • API prod & dev
  • Web dashboard
  • Local dev (ports 5000-5099)

Blocks

  • waykee.com.evil.com
  • fake-waykee.com
  • evil.com/waykee.com

Azure (Tokens & Services)

Scope pattern
regex ^(https?://)?[a-z0-9-]+\.(azure\.com|azure\.net|windows\.net|microsoft\.com|microsoftonline\.com|core\.windows\.net|vault\.azure\.net|database\.windows\.net|blob\.core\.windows\.net)(/|$)

Covers

  • Azure Portal
  • Azure AD / Entra ID
  • Blob Storage
  • SQL Database
  • Key Vault
  • App Services
  • Azure DevOps

Blocks

  • azure.com.evil.com
  • fake-azure.net
  • windows.net.attacker.com
Why so many domains? Azure uses many different domain suffixes across its services (azure.com, windows.net, microsoftonline.com, etc.). This single regex pattern covers them all safely.

Google Cloud

Scope pattern
regex ^(https?://)?[a-z0-9-]+\.(googleapis\.com|google\.com|googleusercontent\.com|gstatic\.com|cloud\.google\.com|appspot\.com|run\.app|cloudfunctions\.net)(/|$)

Covers

  • Google Cloud APIs
  • Cloud Storage
  • Cloud Run
  • Cloud Functions
  • Firebase
  • BigQuery

Blocks

  • googleapis.com.evil.com
  • google.com.attacker.com
  • fake-google.com
Deep Dive

Anatomy of a safe regex pattern

Every part of the pattern serves a security purpose. Here is what each piece does and why it matters.

^(https?://)?(api\.)?github\.com(/|$)
Anchor Protocol Domain Escaped dots Boundary
^

Start anchor

Anchors the match to the beginning of the string. Without it, an attacker could prepend anything: evil.com/redirect?to=github.com would pass.

(https?://)?

Optional protocol

Matches both http:// and https://, or no protocol at all. The ? makes the entire group optional so bare hostnames also match.

\.

Escaped dots

In regex, a plain . matches any character. Escaping it with \. ensures it only matches a literal dot. Without escaping, githubXcom would match.

(/|$)

Boundary guard

Only allows a path separator / or end of string $ after the domain. This prevents subdomain hijacking: github.com.evil.com is blocked because .evil.com is neither / nor end-of-string.

.*

Never use .* at the end

Adding .* at the end of a pattern defeats the boundary guard. It would allow anything after the domain, including attacker-controlled suffixes. Always end with (/|$) instead.

Watch Out

Common mistakes

These patterns look right but have security holes. Here is what to avoid and what to use instead.

github.com
No anchor: evil.com/github.com would pass
.*github.*
Too broad: github.evil.com would pass
^(https?://)?github\.com
No boundary: github.com.evil.com would pass
^(https?://)?github\.com(/|$)
Correct: anchored at start, escaped dots, boundary at end. Only github.com and its paths match.
host:github.com
Even simpler: use the host: prefix for exact hostname matching. No regex needed.
Quick Reference

Scope patterns at a glance

A fast lookup table for all recommended scope patterns.

Service Simple Scope Regex Scope What it Protects
GitHub host:github.com
host:api.github.com
^(https?://)?(api\.)?github\.com(/|$) Personal access tokens, OAuth tokens, SSH keys, deploy keys, GitHub App credentials
Waykee API host:wk2.waykee.com
host:apiprod.waykee.com
host:apidev.waykee.com
^(https?://)?((wk2|apiprod|apidev)\.waykee\.com|localhost:50[0-9]{2})(/|$) API keys, session tokens, webhook secrets, dev credentials
Azure Use regex (multiple domains) ^(https?://)?[a-z0-9-]+\.(azure\.com|azure\.net|windows\.net|microsoft\.com|microsoftonline\.com|...)(/|$) Service principals, connection strings, SAS tokens, Managed Identity tokens, Key Vault secrets
Google Cloud Use regex (multiple domains) ^(https?://)?[a-z0-9-]+\.(googleapis\.com|google\.com|googleusercontent\.com|...)(/|$) Service account keys, OAuth tokens, API keys, Firebase credentials
Download & Install

Install Waykee Secrets

Install in 30 seconds. One command per platform. Your activation key ensures only you can use the bash proxy.

Activation Key
Enter your activation key to unlock the bash proxy. Without a valid key, the daemon will not start.
Get your key from the Waykee Dashboard → Secrets → Activation Keys.
Without an activation key, the bash proxy will install but won't connect. Enter your key above.

macOS

Apple Silicon & Intel — Terminal / iTerm2
1

Run in Terminal

$ curl -fsSL https://waykeesecrets.dev.powerera.com/install.sh | bash
Downloads the binary, sets up launchd auto-start, and configures shell integration.
2

Reload your shell

$ source ~/.zshrc
3

Verify

$ waykee-secrets status

Linux

x86_64 — Bash / Zsh
1

Run in terminal

$ curl -fsSL https://waykeesecrets.dev.powerera.com/install.sh | bash
Downloads the binary, sets up systemd user service, and configures shell integration.
2

Reload your shell

$ source ~/.bashrc
3

Verify

$ waykee-secrets status

Windows

x64 — PowerShell 5.1+
1

Run in PowerShell

PS> iwr -useb https://waykeesecrets.dev.powerera.com/install.ps1 | iex
Downloads the .exe, adds to PATH, sets up Task Scheduler auto-start. No admin required.
2

Open a new PowerShell window

# Close and reopen PowerShell to pick up PATH changes
3

Verify

PS> waykee-secrets status