Every secret in Waykee Secrets has a scope that defines where it can be used. Scopes are the first line of defense: even if an AI agent is compromised by prompt injection, the secret can only be sent to authorized destinations.
host:domain.com
Hostname restriction
Recommended
regex:pattern
Regular expression
Advanced
Copy-paste ready patterns for the most common services. Each one is designed to be secure by default.
(/|$) at the end is critical. Without it, a domain like github.com.evil.com would match.
Every part of the pattern serves a security purpose. Here is what each piece does and why it matters.
Anchors the match to the beginning of the string. Without it, an attacker could prepend anything: evil.com/redirect?to=github.com would pass.
Matches both http:// and https://, or no protocol at all. The ? makes the entire group optional so bare hostnames also match.
In regex, a plain . matches any character. Escaping it with \. ensures it only matches a literal dot. Without escaping, githubXcom would match.
Only allows a path separator / or end of string $ after the domain. This prevents subdomain hijacking: github.com.evil.com is blocked because .evil.com is neither / nor end-of-string.
Adding .* at the end of a pattern defeats the boundary guard. It would allow anything after the domain, including attacker-controlled suffixes. Always end with (/|$) instead.
These patterns look right but have security holes. Here is what to avoid and what to use instead.
evil.com/github.com would passgithub.evil.com would passgithub.com.evil.com would passgithub.com and its paths match.host: prefix for exact hostname matching. No regex needed.A fast lookup table for all recommended scope patterns.
| Service | Simple Scope | Regex Scope | What it Protects |
|---|---|---|---|
| GitHub |
host:github.comhost:api.github.com
|
^(https?://)?(api\.)?github\.com(/|$) |
Personal access tokens, OAuth tokens, SSH keys, deploy keys, GitHub App credentials |
| Waykee API |
host:wk2.waykee.comhost:apiprod.waykee.comhost:apidev.waykee.com
|
^(https?://)?((wk2|apiprod|apidev)\.waykee\.com|localhost:50[0-9]{2})(/|$) |
API keys, session tokens, webhook secrets, dev credentials |
| Azure | Use regex (multiple domains) | ^(https?://)?[a-z0-9-]+\.(azure\.com|azure\.net|windows\.net|microsoft\.com|microsoftonline\.com|...)(/|$) |
Service principals, connection strings, SAS tokens, Managed Identity tokens, Key Vault secrets |
| Google Cloud | Use regex (multiple domains) | ^(https?://)?[a-z0-9-]+\.(googleapis\.com|google\.com|googleusercontent\.com|...)(/|$) |
Service account keys, OAuth tokens, API keys, Firebase credentials |
Install in 30 seconds. One command per platform. Your activation key ensures only you can use the bash proxy.