diff --git a/other/tokens/Tentative-leaks-checker.bcheck b/other/tokens/Tentative-leaks-checker.bcheck
index 5954e0f..4bbf1c8 100644
--- a/other/tokens/Tentative-leaks-checker.bcheck
+++ b/other/tokens/Tentative-leaks-checker.bcheck
@@ -695,7 +695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "access[_-]?key[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)access[_-]?key[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -703,7 +703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "access[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)access[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -711,7 +711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -719,7 +719,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "account[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)account[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -727,7 +727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "admin[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)admin[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -735,7 +735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "adzerk[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)adzerk[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -743,7 +743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?admin[_-]?key[_-]?1(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?admin[_-]?key[_-]?1(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -751,7 +751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?admin[_-]?key[_-]?2(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?admin[_-]?key[_-]?2(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -759,7 +759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?admin[_-]?key[_-]?mcm(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?admin[_-]?key[_-]?mcm(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -767,7 +767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -775,7 +775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?api[_-]?key[_-]?mcm(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?api[_-]?key[_-]?mcm(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -783,7 +783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?api[_-]?key[_-]?search(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?api[_-]?key[_-]?search(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -791,7 +791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?search[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?search[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -799,7 +799,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?search[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?search[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -807,7 +807,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "algolia[_-]?search[_-]?key[_-]?1(=| =|:| :)" then
+ if {latest.response} matches "(?i)algolia[_-]?search[_-]?key[_-]?1(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -815,7 +815,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "alias[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)alias[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -823,7 +823,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "alicloud[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)alicloud[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -831,7 +831,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "alicloud[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)alicloud[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -839,7 +839,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "amazon[_-]?bucket[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)amazon[_-]?bucket[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -847,7 +847,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "anaconda[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)anaconda[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -855,7 +855,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "android[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)android[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -863,7 +863,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aos[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aos[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -871,7 +871,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aos[_-]?sec(=| =|:| :)" then
+ if {latest.response} matches "(?i)aos[_-]?sec(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -879,7 +879,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -887,7 +887,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "api[_-]?key[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)api[_-]?key[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -895,7 +895,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "api[_-]?key[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)api[_-]?key[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -903,7 +903,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "api[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)api[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -911,7 +911,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "apiary[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)apiary[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -919,7 +919,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "apigw[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)apigw[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -927,7 +927,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "apikey[:](?:['\"]?[a-zA-Z0-9-_|]+['\"]?)" then
+ if {latest.response} matches "(?i)apikey[:](?:['\"]?[a-zA-Z0-9-_|]+['\"]?)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -935,7 +935,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "app[_-]?bucket[_-]?perm(=| =|:| :)" then
+ if {latest.response} matches "(?i)app[_-]?bucket[_-]?perm(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -943,7 +943,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "app[_-]?report[_-]?token[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)app[_-]?report[_-]?token[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -951,7 +951,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "app[_-]?secrete(=| =|:| :)" then
+ if {latest.response} matches "(?i)app[_-]?secrete(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -959,7 +959,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "app[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)app[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -967,7 +967,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "appclientsecret(=| =|:| :)" then
+ if {latest.response} matches "(?i)appclientsecret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -975,7 +975,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "apple[_-]?id[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)apple[_-]?id[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -983,7 +983,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "argos[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)argos[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -999,7 +999,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifactory[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifactory[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1007,7 +1007,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifacts[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifacts[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1015,7 +1015,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifacts[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifacts[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1023,7 +1023,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifacts[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifacts[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1031,7 +1031,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifacts[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifacts[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1039,7 +1039,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "artifacts[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)artifacts[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1047,7 +1047,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "assistant[_-]?iam[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)assistant[_-]?iam[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1055,7 +1055,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "auth0[_-]?api[_-]?clientsecret(=| =|:| :)" then
+ if {latest.response} matches "(?i)auth0[_-]?api[_-]?clientsecret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1063,7 +1063,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "auth0[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)auth0[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1071,7 +1071,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1079,7 +1079,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "author[_-]?email[_-]?addr(=| =|:| :)" then
+ if {latest.response} matches "(?i)author[_-]?email[_-]?addr(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1087,7 +1087,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "author[_-]?npm[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)author[_-]?npm[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1095,7 +1095,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?access(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?access(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1103,7 +1103,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1111,7 +1111,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1119,7 +1119,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?config[_-]?accesskeyid(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?config[_-]?accesskeyid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1127,7 +1127,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?config[_-]?secretaccesskey(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?config[_-]?secretaccesskey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1135,7 +1135,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1151,7 +1151,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1159,7 +1159,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1167,7 +1167,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1175,7 +1175,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?secrets(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?secrets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1183,7 +1183,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?ses[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?ses[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1191,7 +1191,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "aws[_-]?ses[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)aws[_-]?ses[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1199,7 +1199,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "awsaccesskeyid(=| =|:| :)" then
+ if {latest.response} matches "(?i)awsaccesskeyid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1207,7 +1207,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "awscn[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)awscn[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1215,7 +1215,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "awscn[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)awscn[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1223,7 +1223,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "awssecretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)awssecretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1231,7 +1231,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "b2[_-]?app[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)b2[_-]?app[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1239,7 +1239,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "b2[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)b2[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1247,7 +1247,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintray[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintray[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1255,7 +1255,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintray[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintray[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1263,7 +1263,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintray[_-]?gpg[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintray[_-]?gpg[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1271,7 +1271,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintray[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintray[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1279,7 +1279,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintray[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintray[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1287,7 +1287,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bintraykey(=| =|:| :)" then
+ if {latest.response} matches "(?i)bintraykey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1295,7 +1295,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1303,7 +1303,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?auth(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?auth(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1311,7 +1311,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1319,7 +1319,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?pass[_-]?prod(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?pass[_-]?prod(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1327,7 +1327,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1335,7 +1335,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?pwd(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?pwd(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1343,7 +1343,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bluemix[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)bluemix[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1351,7 +1351,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "brackets[_-]?repo[_-]?oauth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)brackets[_-]?repo[_-]?oauth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1359,7 +1359,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "browser[_-]?stack[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)browser[_-]?stack[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1367,7 +1367,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "browserstack[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)browserstack[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1375,7 +1375,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bucketeer[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)bucketeer[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1383,7 +1383,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bucketeer[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)bucketeer[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1391,7 +1391,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "built[_-]?branch[_-]?deploy[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)built[_-]?branch[_-]?deploy[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1399,7 +1399,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bundlesize[_-]?github[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)bundlesize[_-]?github[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1407,7 +1407,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bx[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)bx[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1415,7 +1415,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "bx[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)bx[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1423,7 +1423,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cache[_-]?s3[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cache[_-]?s3[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1431,7 +1431,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cargo[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)cargo[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1439,7 +1439,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cattle[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cattle[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1447,7 +1447,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cattle[_-]?agent[_-]?instance[_-]?auth(=| =|:| :)" then
+ if {latest.response} matches "(?i)cattle[_-]?agent[_-]?instance[_-]?auth(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1455,7 +1455,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cattle[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cattle[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1463,7 +1463,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "censys[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)censys[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1471,7 +1471,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "certificate[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)certificate[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1479,7 +1479,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cf[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)cf[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1487,7 +1487,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cheverny[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)cheverny[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1495,7 +1495,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ci[_-]?user[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ci[_-]?user[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1503,7 +1503,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "claimr[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)claimr[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1511,7 +1511,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "claimr[_-]?db(=| =|:| :)" then
+ if {latest.response} matches "(?i)claimr[_-]?db(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1519,7 +1519,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "claimr[_-]?superuser(=| =|:| :)" then
+ if {latest.response} matches "(?i)claimr[_-]?superuser(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1527,7 +1527,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "claimr[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)claimr[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1535,7 +1535,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cli[_-]?e2e[_-]?cma[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)cli[_-]?e2e[_-]?cma[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1543,7 +1543,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1551,7 +1551,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "clojars[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)clojars[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1559,7 +1559,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?archived[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?archived[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1567,7 +1567,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?audited[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?audited[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1575,7 +1575,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1583,7 +1583,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?instance(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?instance(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1591,7 +1591,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?order[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?order[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1599,7 +1599,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?parsed[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?parsed[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1607,7 +1607,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1615,7 +1615,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?processed[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?processed[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1623,7 +1623,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudant[_-]?service[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudant[_-]?service[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1631,7 +1631,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudflare[_-]?auth[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudflare[_-]?auth[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1639,7 +1639,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudflare[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudflare[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1647,7 +1647,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudinary[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudinary[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1655,7 +1655,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cloudinary[_-]?url[_-]?staging(=| =|:| :)" then
+ if {latest.response} matches "(?i)cloudinary[_-]?url[_-]?staging(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1663,7 +1663,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "clu[_-]?repo[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)clu[_-]?repo[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1671,7 +1671,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "clu[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)" then
+ if {latest.response} matches "(?i)clu[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1679,7 +1679,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cn[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)cn[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1687,7 +1687,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cn[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cn[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1695,7 +1695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cocoapods[_-]?trunk[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)cocoapods[_-]?trunk[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1703,7 +1703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cocoapods[_-]?trunk[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)cocoapods[_-]?trunk[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1711,7 +1711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "codacy[_-]?project[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)codacy[_-]?project[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1727,7 +1727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "codeclimate[_-]?repo[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)codeclimate[_-]?repo[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1735,7 +1735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "codecov[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)codecov[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1743,7 +1743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "coding[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)coding[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1751,7 +1751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "conekta[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)conekta[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1759,7 +1759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "consumerkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)consumerkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1767,7 +1767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1775,7 +1775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?cma[_-]?test[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?cma[_-]?test[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1783,7 +1783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?integration[_-]?management[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?integration[_-]?management[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1791,7 +1791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?php[_-]?management[_-]?test[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?php[_-]?management[_-]?test[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1799,7 +1799,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?test[_-]?org[_-]?cma[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?test[_-]?org[_-]?cma[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1807,7 +1807,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "contentful[_-]?v2[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)contentful[_-]?v2[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1815,7 +1815,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "conversation[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)conversation[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1823,7 +1823,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "conversation[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)conversation[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1831,7 +1831,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cos[_-]?secrets(=| =|:| :)" then
+ if {latest.response} matches "(?i)cos[_-]?secrets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1839,7 +1839,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "coveralls[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)coveralls[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1847,7 +1847,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "coveralls[_-]?repo[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)coveralls[_-]?repo[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1855,7 +1855,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "coveralls[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)coveralls[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1863,7 +1863,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "coverity[_-]?scan[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)coverity[_-]?scan[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1871,7 +1871,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "cypress[_-]?record[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)cypress[_-]?record[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1879,7 +1879,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "danger[_-]?github[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)danger[_-]?github[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1887,7 +1887,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "database[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)database[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1895,7 +1895,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "database[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)database[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1903,7 +1903,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "database[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)database[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1911,7 +1911,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "database[_-]?port(=| =|:| :)" then
+ if {latest.response} matches "(?i)database[_-]?port(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1919,7 +1919,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "database[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)database[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1927,7 +1927,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "datadog[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)datadog[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1935,7 +1935,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "datadog[_-]?app[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)datadog[_-]?app[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1943,7 +1943,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "db[_-]?connection(=| =|:| :)" then
+ if {latest.response} matches "(?i)db[_-]?connection(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1951,7 +1951,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "db[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)db[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1959,7 +1959,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "db[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)db[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1967,7 +1967,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "db[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)db[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1975,7 +1975,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "db[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)db[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1983,7 +1983,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ddg[_-]?test[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)ddg[_-]?test[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1991,7 +1991,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ddg[_-]?test[_-]?email[_-]?pw(=| =|:| :)" then
+ if {latest.response} matches "(?i)ddg[_-]?test[_-]?email[_-]?pw(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -1999,7 +1999,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ddgc[_-]?github[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ddgc[_-]?github[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2007,7 +2007,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "deploy[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)deploy[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2015,7 +2015,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "deploy[_-]?secure(=| =|:| :)" then
+ if {latest.response} matches "(?i)deploy[_-]?secure(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2023,7 +2023,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "deploy[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)deploy[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2031,7 +2031,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "deploy[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)deploy[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2039,7 +2039,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "dgpg[_-]?passphrase(=| =|:| :)" then
+ if {latest.response} matches "(?i)dgpg[_-]?passphrase(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2047,7 +2047,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "digitalocean[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)digitalocean[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2055,7 +2055,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "digitalocean[_-]?ssh[_-]?key[_-]?body(=| =|:| :)" then
+ if {latest.response} matches "(?i)digitalocean[_-]?ssh[_-]?key[_-]?body(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2063,7 +2063,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "digitalocean[_-]?ssh[_-]?key[_-]?ids(=| =|:| :)" then
+ if {latest.response} matches "(?i)digitalocean[_-]?ssh[_-]?key[_-]?ids(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2071,7 +2071,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "docker[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)docker[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2079,7 +2079,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "docker[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)docker[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2087,7 +2087,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "docker[_-]?postgres[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)docker[_-]?postgres[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2095,7 +2095,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "dockerhubpassword(=| =|:| :)" then
+ if {latest.response} matches "(?i)dockerhubpassword(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2103,7 +2103,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "dsonar[_-]?login(=| =|:| :)" then
+ if {latest.response} matches "(?i)dsonar[_-]?login(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2111,7 +2111,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "dsonar[_-]?projectkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)dsonar[_-]?projectkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2119,7 +2119,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "elastic[_-]?cloud[_-]?auth(=| =|:| :)" then
+ if {latest.response} matches "(?i)elastic[_-]?cloud[_-]?auth(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2127,7 +2127,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "elasticsearch[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)elasticsearch[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2135,7 +2135,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "encryption[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)encryption[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2143,7 +2143,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "end[_-]?user[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)end[_-]?user[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2151,7 +2151,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "env[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)env[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2159,7 +2159,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "env[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)env[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2167,7 +2167,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "env[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)env[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2175,7 +2175,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "env[_-]?sonatype[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)env[_-]?sonatype[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2183,7 +2183,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "eureka[_-]?awssecretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)eureka[_-]?awssecretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2191,7 +2191,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "exp[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)exp[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2207,7 +2207,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "file[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)file[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2215,7 +2215,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "firebase[_-]?project[_-]?develop(=| =|:| :)" then
+ if {latest.response} matches "(?i)firebase[_-]?project[_-]?develop(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2223,7 +2223,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "flask[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)flask[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2231,7 +2231,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "flickr[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)flickr[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2239,7 +2239,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "flickr[_-]?api[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)flickr[_-]?api[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2247,7 +2247,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "fossa[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)fossa[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2255,7 +2255,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ftp[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)ftp[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2263,7 +2263,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ftp[_-]?login(=| =|:| :)" then
+ if {latest.response} matches "(?i)ftp[_-]?login(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2271,7 +2271,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ftp[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)ftp[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2279,7 +2279,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ftp[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)ftp[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2287,7 +2287,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ftp[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)ftp[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2295,7 +2295,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gcloud[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)gcloud[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2303,7 +2303,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gcloud[_-]?project(=| =|:| :)" then
+ if {latest.response} matches "(?i)gcloud[_-]?project(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2311,7 +2311,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gcloud[_-]?service[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)gcloud[_-]?service[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2319,7 +2319,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gcr[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)gcr[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2327,7 +2327,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gcs[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)gcs[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2335,7 +2335,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2343,7 +2343,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?next[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?next[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2351,7 +2351,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2359,7 +2359,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?next[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2367,7 +2367,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2375,7 +2375,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?oauth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?oauth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2383,7 +2383,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?repo[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?repo[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2391,7 +2391,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2399,7 +2399,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gh[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)gh[_-]?unstable[_-]?oauth[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2407,7 +2407,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ghb[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ghb[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2415,7 +2415,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ghost[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ghost[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2423,7 +2423,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?author[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?author[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2431,7 +2431,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?author[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?author[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2439,7 +2439,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?committer[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?committer[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2447,7 +2447,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?committer[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?committer[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2455,7 +2455,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2463,7 +2463,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2471,7 +2471,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "git[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)git[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2479,7 +2479,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2495,7 +2495,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2503,7 +2503,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?auth(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?auth(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2511,7 +2511,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2519,7 +2519,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2527,7 +2527,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?deploy[_-]?hb[_-]?doc[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?deploy[_-]?hb[_-]?doc[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2535,7 +2535,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?deployment[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?deployment[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2543,7 +2543,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?hunter[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?hunter[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2551,7 +2551,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?hunter[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?hunter[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2559,7 +2559,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2567,7 +2567,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?oauth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?oauth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2575,7 +2575,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2583,7 +2583,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?pwd(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?pwd(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2591,7 +2591,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?release[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?release[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2599,7 +2599,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "github[_-]?repo(=| =|:| :)" then
+ if {latest.response} matches "(?i)github[_-]?repo(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2607,7 +2607,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gitlab[_-]?user[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)gitlab[_-]?user[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2615,7 +2615,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gogs[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)gogs[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2623,7 +2623,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "google[_-]?account[_-]?type(=| =|:| :)" then
+ if {latest.response} matches "(?i)google[_-]?account[_-]?type(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2631,7 +2631,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "google[_-]?client[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)google[_-]?client[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2647,7 +2647,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "google[_-]?private[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)google[_-]?private[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2663,7 +2663,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?key[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?key[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2671,7 +2671,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?keyname(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?keyname(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2679,7 +2679,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?ownertrust(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?ownertrust(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2687,7 +2687,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?passphrase(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?passphrase(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2695,7 +2695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?private[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?private[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2703,7 +2703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gpg[_-]?secret[_-]?keys(=| =|:| :)" then
+ if {latest.response} matches "(?i)gpg[_-]?secret[_-]?keys(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2711,7 +2711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gradle[_-]?publish[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)gradle[_-]?publish[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2719,7 +2719,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gradle[_-]?publish[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)gradle[_-]?publish[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2727,7 +2727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gradle[_-]?signing[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)gradle[_-]?signing[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2735,7 +2735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gradle[_-]?signing[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)gradle[_-]?signing[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2743,7 +2743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "gren[_-]?github[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)gren[_-]?github[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2751,7 +2751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "grgit[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)grgit[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2759,7 +2759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hab[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)hab[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2767,7 +2767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hab[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)hab[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2775,7 +2775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hb[_-]?codesign[_-]?gpg[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)hb[_-]?codesign[_-]?gpg[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2783,7 +2783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hb[_-]?codesign[_-]?key[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)hb[_-]?codesign[_-]?key[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2791,7 +2791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "heroku[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)heroku[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2807,7 +2807,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "heroku[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)heroku[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2815,7 +2815,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "heroku[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)heroku[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2831,7 +2831,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hockeyapp[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)hockeyapp[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2839,7 +2839,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "homebrew[_-]?github[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)homebrew[_-]?github[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2847,7 +2847,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "hub[_-]?dxia2[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)hub[_-]?dxia2[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2855,7 +2855,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ij[_-]?repo[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)ij[_-]?repo[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2863,7 +2863,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ij[_-]?repo[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)ij[_-]?repo[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2871,7 +2871,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "index[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)index[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2879,7 +2879,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "integration[_-]?test[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)integration[_-]?test[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2887,7 +2887,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "integration[_-]?test[_-]?appid(=| =|:| :)" then
+ if {latest.response} matches "(?i)integration[_-]?test[_-]?appid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2895,7 +2895,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "internal[_-]?secrets(=| =|:| :)" then
+ if {latest.response} matches "(?i)internal[_-]?secrets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2903,7 +2903,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ios[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ios[_-]?docs[_-]?deploy[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2911,7 +2911,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "itest[_-]?gh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)itest[_-]?gh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2919,7 +2919,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql: jdbc:mysql(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql: jdbc:mysql(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2927,7 +2927,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "jdbc[_-]?databaseurl(=| =|:| :)" then
+ if {latest.response} matches "(?i)jdbc[_-]?databaseurl(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2935,7 +2935,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "jdbc[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)jdbc[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2943,7 +2943,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "jwt[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)jwt[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2951,7 +2951,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kafka[_-]?admin[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)kafka[_-]?admin[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2959,7 +2959,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kafka[_-]?instance[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)kafka[_-]?instance[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2967,7 +2967,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kafka[_-]?rest[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)kafka[_-]?rest[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2975,7 +2975,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "keystore[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)keystore[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2983,7 +2983,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kovan[_-]?private[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)kovan[_-]?private[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2991,7 +2991,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kubecfg[_-]?s3[_-]?path(=| =|:| :)" then
+ if {latest.response} matches "(?i)kubecfg[_-]?s3[_-]?path(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -2999,7 +2999,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kubeconfig(=| =|:| :)" then
+ if {latest.response} matches "(?i)kubeconfig(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3007,7 +3007,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "kxoltsn3vogdop92m(=| =|:| :)" then
+ if {latest.response} matches "(?i)kxoltsn3vogdop92m(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3015,7 +3015,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "leanplum[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)leanplum[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3023,7 +3023,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lektor[_-]?deploy[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)lektor[_-]?deploy[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3031,7 +3031,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lektor[_-]?deploy[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)lektor[_-]?deploy[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3039,7 +3039,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lighthouse[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)lighthouse[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3047,7 +3047,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "linux[_-]?signing[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)linux[_-]?signing[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3055,7 +3055,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ll[_-]?publish[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)ll[_-]?publish[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3063,7 +3063,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ll[_-]?shared[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ll[_-]?shared[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3071,7 +3071,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "looker[_-]?test[_-]?runner[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)looker[_-]?test[_-]?runner[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3079,7 +3079,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lottie[_-]?happo[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)lottie[_-]?happo[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3087,7 +3087,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lottie[_-]?happo[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)lottie[_-]?happo[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3095,7 +3095,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lottie[_-]?s3[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)lottie[_-]?s3[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3103,7 +3103,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lottie[_-]?upload[_-]?cert[_-]?key[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)lottie[_-]?upload[_-]?cert[_-]?key[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3111,7 +3111,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "lottie[_-]?upload[_-]?cert[_-]?key[_-]?store[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)lottie[_-]?upload[_-]?cert[_-]?key[_-]?store[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3119,7 +3119,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "magento[_-]?auth[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)magento[_-]?auth[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3127,7 +3127,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "magento[_-]?auth[_-]?username (=| =|:| :)" then
+ if {latest.response} matches "(?i)magento[_-]?auth[_-]?username (=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3135,7 +3135,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "magento[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)magento[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3143,7 +3143,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mail[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)mail[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3151,7 +3151,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailchimp[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailchimp[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3159,7 +3159,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailchimp[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailchimp[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3167,7 +3167,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailer[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailer[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3183,7 +3183,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailgun[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailgun[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3191,7 +3191,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailgun[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailgun[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3199,7 +3199,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailgun[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailgun[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3207,7 +3207,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailgun[_-]?pub[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailgun[_-]?pub[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3215,7 +3215,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mailgun[_-]?pub[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mailgun[_-]?pub[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3223,7 +3223,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "manage[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)manage[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3231,7 +3231,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "manage[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)manage[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3239,7 +3239,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "management[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)management[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3247,7 +3247,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "managementapiaccesstoken(=| =|:| :)" then
+ if {latest.response} matches "(?i)managementapiaccesstoken(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3255,7 +3255,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mandrill[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mandrill[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3263,7 +3263,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "manifest[_-]?app[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)manifest[_-]?app[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3271,7 +3271,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "manifest[_-]?app[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)manifest[_-]?app[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3279,7 +3279,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mapbox[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)mapbox[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3287,7 +3287,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mapbox[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)mapbox[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3295,7 +3295,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mapbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)mapbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3303,7 +3303,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mapbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mapbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3311,7 +3311,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mapboxaccesstoken(=| =|:| :)" then
+ if {latest.response} matches "(?i)mapboxaccesstoken(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3319,7 +3319,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mg[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mg[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3327,7 +3327,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mh[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)mh[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3335,7 +3335,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mh[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)mh[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3343,7 +3343,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mile[_-]?zero[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)mile[_-]?zero[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3351,7 +3351,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "minio[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)minio[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3359,7 +3359,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "minio[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)minio[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3367,7 +3367,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "multi[_-]?bob[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)multi[_-]?bob[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3375,7 +3375,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "multi[_-]?connect[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)multi[_-]?connect[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3383,7 +3383,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "multi[_-]?disconnect[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)multi[_-]?disconnect[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3391,7 +3391,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "multi[_-]?workflow[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)multi[_-]?workflow[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3399,7 +3399,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "multi[_-]?workspace[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)multi[_-]?workspace[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3407,7 +3407,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "my[_-]?secret[_-]?env(=| =|:| :)" then
+ if {latest.response} matches "(?i)my[_-]?secret[_-]?env(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3415,7 +3415,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3423,7 +3423,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql[_-]?hostname(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql[_-]?hostname(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3431,7 +3431,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3439,7 +3439,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3447,7 +3447,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysql[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysql[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3455,7 +3455,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysqlmasteruser(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysqlmasteruser(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3463,7 +3463,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "mysqlsecret(=| =|:| :)" then
+ if {latest.response} matches "(?i)mysqlsecret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3471,7 +3471,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "nativeevents(=| =|:| :)" then
+ if {latest.response} matches "(?i)nativeevents(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3479,7 +3479,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "new[_-]?relic[_-]?beta[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)new[_-]?relic[_-]?beta[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3487,7 +3487,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "nexus[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)nexus[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3495,7 +3495,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "nexuspassword(=| =|:| :)" then
+ if {latest.response} matches "(?i)nexuspassword(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3503,7 +3503,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ngrok[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ngrok[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3511,7 +3511,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ngrok[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)ngrok[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3519,7 +3519,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "node[_-]?env(=| =|:| :)" then
+ if {latest.response} matches "(?i)node[_-]?env(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3527,7 +3527,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "node[_-]?pre[_-]?gyp[_-]?accesskeyid(=| =|:| :)" then
+ if {latest.response} matches "(?i)node[_-]?pre[_-]?gyp[_-]?accesskeyid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3535,7 +3535,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "node[_-]?pre[_-]?gyp[_-]?github[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)node[_-]?pre[_-]?gyp[_-]?github[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3543,7 +3543,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "node[_-]?pre[_-]?gyp[_-]?secretaccesskey(=| =|:| :)" then
+ if {latest.response} matches "(?i)node[_-]?pre[_-]?gyp[_-]?secretaccesskey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3551,7 +3551,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "non[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)non[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3559,7 +3559,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "now[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)now[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3567,7 +3567,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3575,7 +3575,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3583,7 +3583,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3591,7 +3591,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3599,7 +3599,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3607,7 +3607,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3615,7 +3615,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "npm[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)npm[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3631,7 +3631,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "nuget[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)nuget[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3639,7 +3639,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "numbers[_-]?service[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)numbers[_-]?service[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3647,7 +3647,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "oauth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)oauth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3655,7 +3655,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "object[_-]?storage[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)object[_-]?storage[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3663,7 +3663,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "object[_-]?storage[_-]?region[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)object[_-]?storage[_-]?region[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3671,7 +3671,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "object[_-]?store[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)object[_-]?store[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3679,7 +3679,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "object[_-]?store[_-]?creds(=| =|:| :)" then
+ if {latest.response} matches "(?i)object[_-]?store[_-]?creds(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3687,7 +3687,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "oc[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)oc[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3695,7 +3695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "octest[_-]?app[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)octest[_-]?app[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3703,7 +3703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "octest[_-]?app[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)octest[_-]?app[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3711,7 +3711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "octest[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)octest[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3719,7 +3719,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ofta[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ofta[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3727,7 +3727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ofta[_-]?region(=| =|:| :)" then
+ if {latest.response} matches "(?i)ofta[_-]?region(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3735,7 +3735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ofta[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)ofta[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3743,7 +3743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "okta[_-]?client[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)okta[_-]?client[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3751,7 +3751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "okta[_-]?oauth2[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)okta[_-]?oauth2[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3759,7 +3759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "okta[_-]?oauth2[_-]?clientsecret(=| =|:| :)" then
+ if {latest.response} matches "(?i)okta[_-]?oauth2[_-]?clientsecret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3767,7 +3767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "omise[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)omise[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3775,7 +3775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "omise[_-]?pkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)omise[_-]?pkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3783,7 +3783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "omise[_-]?pubkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)omise[_-]?pubkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3791,7 +3791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "omise[_-]?skey(=| =|:| :)" then
+ if {latest.response} matches "(?i)omise[_-]?skey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3799,7 +3799,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "onesignal[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)onesignal[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3807,7 +3807,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "onesignal[_-]?user[_-]?auth[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)onesignal[_-]?user[_-]?auth[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3815,7 +3815,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "open[_-]?whisk[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)open[_-]?whisk[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3823,7 +3823,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "openwhisk[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)openwhisk[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3831,7 +3831,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "os[_-]?auth[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)os[_-]?auth[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3839,7 +3839,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "os[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)os[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3847,7 +3847,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ossrh[_-]?jira[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)ossrh[_-]?jira[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3855,7 +3855,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ossrh[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)ossrh[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3863,7 +3863,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ossrh[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)ossrh[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3871,7 +3871,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ossrh[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)ossrh[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3879,7 +3879,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ossrh[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)ossrh[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3895,7 +3895,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "packagecloud[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)packagecloud[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3903,7 +3903,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pagerduty[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)pagerduty[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3911,7 +3911,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "parse[_-]?js[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)parse[_-]?js[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3919,7 +3919,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "passwordtravis(=| =|:| :)" then
+ if {latest.response} matches "(?i)passwordtravis(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3935,7 +3935,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "paypal[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)paypal[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3943,7 +3943,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "percy[_-]?project(=| =|:| :)" then
+ if {latest.response} matches "(?i)percy[_-]?project(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3951,7 +3951,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "percy[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)percy[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3959,7 +3959,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "personal[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)personal[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3967,7 +3967,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "personal[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)personal[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3975,7 +3975,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pg[_-]?database(=| =|:| :)" then
+ if {latest.response} matches "(?i)pg[_-]?database(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3983,7 +3983,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pg[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)pg[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3991,7 +3991,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "places[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)places[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -3999,7 +3999,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "places[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)places[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4007,7 +4007,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "plotly[_-]?apikey(=| =|:| :)" then
+ if {latest.response} matches "(?i)plotly[_-]?apikey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4015,7 +4015,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "plugin[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)plugin[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4023,7 +4023,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "postgres[_-]?env[_-]?postgres[_-]?db(=| =|:| :)" then
+ if {latest.response} matches "(?i)postgres[_-]?env[_-]?postgres[_-]?db(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4031,7 +4031,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "postgres[_-]?env[_-]?postgres[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)postgres[_-]?env[_-]?postgres[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4039,7 +4039,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "postgresql[_-]?db(=| =|:| :)" then
+ if {latest.response} matches "(?i)postgresql[_-]?db(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4047,7 +4047,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "postgresql[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)postgresql[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4055,7 +4055,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "prebuild[_-]?auth(=| =|:| :)" then
+ if {latest.response} matches "(?i)prebuild[_-]?auth(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4063,7 +4063,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "preferred[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)preferred[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4071,7 +4071,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pring[_-]?mail[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)pring[_-]?mail[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4087,7 +4087,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "private[_-]?signing[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)private[_-]?signing[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4095,7 +4095,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "prod[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)prod[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4103,7 +4103,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "prod[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)prod[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4111,7 +4111,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "prod[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)prod[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4119,7 +4119,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "project[_-]?config(=| =|:| :)" then
+ if {latest.response} matches "(?i)project[_-]?config(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4127,7 +4127,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "publish[_-]?access(=| =|:| :)" then
+ if {latest.response} matches "(?i)publish[_-]?access(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4135,7 +4135,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "publish[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)publish[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4143,7 +4143,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "publish[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)publish[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4151,7 +4151,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pushover[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)pushover[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4159,7 +4159,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "pypi[_-]?passowrd(=| =|:| :)" then
+ if {latest.response} matches "(?i)pypi[_-]?passowrd(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4167,7 +4167,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "qiita[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)qiita[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4175,7 +4175,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "quip[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)quip[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4183,7 +4183,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "randrmusicapiaccesstoken(=| =|:| :)" then
+ if {latest.response} matches "(?i)randrmusicapiaccesstoken(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4191,7 +4191,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "redis[_-]?stunnel[_-]?urls(=| =|:| :)" then
+ if {latest.response} matches "(?i)redis[_-]?stunnel[_-]?urls(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4199,7 +4199,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "refresh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)refresh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4207,7 +4207,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "registry[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)registry[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4215,7 +4215,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "registry[_-]?secure(=| =|:| :)" then
+ if {latest.response} matches "(?i)registry[_-]?secure(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4223,7 +4223,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "release[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)release[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4231,7 +4231,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "reporting[_-]?webdav[_-]?pwd(=| =|:| :)" then
+ if {latest.response} matches "(?i)reporting[_-]?webdav[_-]?pwd(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4239,7 +4239,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "reporting[_-]?webdav[_-]?url(=| =|:| :)" then
+ if {latest.response} matches "(?i)reporting[_-]?webdav[_-]?url(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4247,7 +4247,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "repotoken(=| =|:| :)" then
+ if {latest.response} matches "(?i)repotoken(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4255,7 +4255,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "rest[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)rest[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4263,7 +4263,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "rinkeby[_-]?private[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)rinkeby[_-]?private[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4271,7 +4271,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ropsten[_-]?private[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ropsten[_-]?private[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4279,7 +4279,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "route53[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)route53[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4287,7 +4287,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "rtd[_-]?key[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)rtd[_-]?key[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4295,7 +4295,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "rtd[_-]?store[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)rtd[_-]?store[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4303,7 +4303,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4311,7 +4311,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4319,7 +4319,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?bucket[_-]?name[_-]?app[_-]?logs(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?bucket[_-]?name[_-]?app[_-]?logs(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4327,7 +4327,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?bucket[_-]?name[_-]?assets(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?bucket[_-]?name[_-]?assets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4335,7 +4335,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?external[_-]?3[_-]?amazonaws[_-]?com(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?external[_-]?3[_-]?amazonaws[_-]?com(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4343,7 +4343,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4351,7 +4351,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?key[_-]?app[_-]?logs(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?key[_-]?app[_-]?logs(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4359,7 +4359,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?key[_-]?assets(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?key[_-]?assets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4367,7 +4367,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?secret[_-]?app[_-]?logs(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?secret[_-]?app[_-]?logs(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4375,7 +4375,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?secret[_-]?assets(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?secret[_-]?assets(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4383,7 +4383,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4391,7 +4391,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "s3[_-]?user[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)s3[_-]?user[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4399,7 +4399,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sacloud[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)sacloud[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4407,7 +4407,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sacloud[_-]?access[_-]?token[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)sacloud[_-]?access[_-]?token[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4415,7 +4415,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sacloud[_-]?api(=| =|:| :)" then
+ if {latest.response} matches "(?i)sacloud[_-]?api(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4423,7 +4423,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "salesforce[_-]?bulk[_-]?test[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)salesforce[_-]?bulk[_-]?test[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4431,7 +4431,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "salesforce[_-]?bulk[_-]?test[_-]?security[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)salesforce[_-]?bulk[_-]?test[_-]?security[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4439,7 +4439,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sandbox[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)sandbox[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4447,7 +4447,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sandbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)sandbox[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4455,7 +4455,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sandbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sandbox[_-]?aws[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4463,7 +4463,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sauce[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sauce[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4479,7 +4479,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "scrutinizer[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)scrutinizer[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4487,7 +4487,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sdr[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)sdr[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4495,7 +4495,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?0(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?0(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4503,7 +4503,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?1(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?1(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4511,7 +4511,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?10(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?10(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4519,7 +4519,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?11(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?11(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4527,7 +4527,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?2(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?2(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4535,7 +4535,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?3(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?3(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4543,7 +4543,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?4(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?4(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4551,7 +4551,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?5(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?5(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4559,7 +4559,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?6(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?6(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4567,7 +4567,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?7(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?7(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4575,7 +4575,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?8(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?8(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4583,7 +4583,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?9(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?9(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4591,7 +4591,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secret[_-]?key[_-]?base(=| =|:| :)" then
+ if {latest.response} matches "(?i)secret[_-]?key[_-]?base(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4599,7 +4599,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secretaccesskey(=| =|:| :)" then
+ if {latest.response} matches "(?i)secretaccesskey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4607,7 +4607,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "secretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)secretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4615,7 +4615,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "segment[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)segment[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4623,7 +4623,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "selion[_-]?log[_-]?level[_-]?dev(=| =|:| :)" then
+ if {latest.response} matches "(?i)selion[_-]?log[_-]?level[_-]?dev(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4631,7 +4631,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "selion[_-]?selenium[_-]?host(=| =|:| :)" then
+ if {latest.response} matches "(?i)selion[_-]?selenium[_-]?host(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4639,7 +4639,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4647,7 +4647,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4655,7 +4655,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4663,7 +4663,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4671,7 +4671,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4679,7 +4679,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendgrid[_-]?username(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendgrid[_-]?username(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4687,7 +4687,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sendwithus[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sendwithus[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4695,7 +4695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sentry[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)sentry[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4703,7 +4703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sentry[_-]?default[_-]?org(=| =|:| :)" then
+ if {latest.response} matches "(?i)sentry[_-]?default[_-]?org(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4711,7 +4711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sentry[_-]?endpoint(=| =|:| :)" then
+ if {latest.response} matches "(?i)sentry[_-]?endpoint(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4719,7 +4719,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sentry[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sentry[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4727,7 +4727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "service[_-]?account[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)service[_-]?account[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4735,7 +4735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ses[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ses[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4743,7 +4743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ses[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)ses[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4751,7 +4751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "setdstaccesskey(=| =|:| :)" then
+ if {latest.response} matches "(?i)setdstaccesskey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4759,7 +4759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "setdstsecretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)setdstsecretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4767,7 +4767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "setsecretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)setsecretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4775,7 +4775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "signing[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)signing[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4783,7 +4783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "signing[_-]?key[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)signing[_-]?key[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4791,7 +4791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "signing[_-]?key[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)signing[_-]?key[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4799,7 +4799,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "signing[_-]?key[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)signing[_-]?key[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4815,7 +4815,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "slash[_-]?developer[_-]?space(=| =|:| :)" then
+ if {latest.response} matches "(?i)slash[_-]?developer[_-]?space(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4823,7 +4823,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "slash[_-]?developer[_-]?space[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)slash[_-]?developer[_-]?space[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4831,7 +4831,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "slate[_-]?user[_-]?email(=| =|:| :)" then
+ if {latest.response} matches "(?i)slate[_-]?user[_-]?email(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4839,7 +4839,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "snoowrap[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)snoowrap[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4847,7 +4847,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "snoowrap[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)snoowrap[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4855,7 +4855,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "snoowrap[_-]?refresh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)snoowrap[_-]?refresh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4863,7 +4863,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "snyk[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)snyk[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4871,7 +4871,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "snyk[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)snyk[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4879,7 +4879,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "socrata[_-]?app[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)socrata[_-]?app[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4887,7 +4887,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "socrata[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)socrata[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4895,7 +4895,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonar[_-]?organization[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonar[_-]?organization[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4903,7 +4903,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonar[_-]?project[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonar[_-]?project[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4911,7 +4911,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonar[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonar[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4927,7 +4927,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?gpg[_-]?key[_-]?name(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?gpg[_-]?key[_-]?name(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4935,7 +4935,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?gpg[_-]?passphrase(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?gpg[_-]?passphrase(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4943,7 +4943,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?nexus[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?nexus[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4951,7 +4951,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4959,7 +4959,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4967,7 +4967,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?token[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?token[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4975,7 +4975,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatype[_-]?token[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatype[_-]?token[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4983,7 +4983,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sonatypepassword(=| =|:| :)" then
+ if {latest.response} matches "(?i)sonatypepassword(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4991,7 +4991,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "soundcloud[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)soundcloud[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -4999,7 +4999,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "soundcloud[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)soundcloud[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5007,7 +5007,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "spaces[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)spaces[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5015,7 +5015,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "spaces[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)spaces[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5023,7 +5023,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "spotify[_-]?api[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)spotify[_-]?api[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5031,7 +5031,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "spotify[_-]?api[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)spotify[_-]?api[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5039,7 +5039,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "spring[_-]?mail[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)spring[_-]?mail[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5047,7 +5047,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sqsaccesskey(=| =|:| :)" then
+ if {latest.response} matches "(?i)sqsaccesskey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5055,7 +5055,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sqssecretkey(=| =|:| :)" then
+ if {latest.response} matches "(?i)sqssecretkey(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5071,7 +5071,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "square[_-]?reader[_-]?sdk[_-]?repository[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)square[_-]?reader[_-]?sdk[_-]?repository[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5079,7 +5079,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "srcclr[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)srcclr[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5095,7 +5095,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "sshpass(=| =|:| :)" then
+ if {latest.response} matches "(?i)sshpass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5103,7 +5103,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "ssmtp[_-]?config(=| =|:| :)" then
+ if {latest.response} matches "(?i)ssmtp[_-]?config(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5111,7 +5111,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "staging[_-]?base[_-]?url[_-]?runscope(=| =|:| :)" then
+ if {latest.response} matches "(?i)staging[_-]?base[_-]?url[_-]?runscope(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5119,7 +5119,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "star[_-]?test[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)star[_-]?test[_-]?aws[_-]?access[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5127,7 +5127,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "star[_-]?test[_-]?bucket(=| =|:| :)" then
+ if {latest.response} matches "(?i)star[_-]?test[_-]?bucket(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5135,7 +5135,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "star[_-]?test[_-]?location(=| =|:| :)" then
+ if {latest.response} matches "(?i)star[_-]?test[_-]?location(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5143,7 +5143,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "star[_-]?test[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)star[_-]?test[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5151,7 +5151,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "starship[_-]?account[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)starship[_-]?account[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5159,7 +5159,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "starship[_-]?auth[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)starship[_-]?auth[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5167,7 +5167,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "stormpath[_-]?api[_-]?key[_-]?id(=| =|:| :)" then
+ if {latest.response} matches "(?i)stormpath[_-]?api[_-]?key[_-]?id(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5175,7 +5175,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "stormpath[_-]?api[_-]?key[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)stormpath[_-]?api[_-]?key[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5183,7 +5183,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "strip[_-]?publishable[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)strip[_-]?publishable[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5191,7 +5191,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "strip[_-]?secret[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)strip[_-]?secret[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5199,7 +5199,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "stripe[_-]?private(=| =|:| :)" then
+ if {latest.response} matches "(?i)stripe[_-]?private(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5207,7 +5207,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "stripe[_-]?public(=| =|:| :)" then
+ if {latest.response} matches "(?i)stripe[_-]?public(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5231,7 +5231,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "surge[_-]?login(=| =|:| :)" then
+ if {latest.response} matches "(?i)surge[_-]?login(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5239,7 +5239,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "surge[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)surge[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5247,7 +5247,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "svn[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)svn[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5255,7 +5255,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "tesco[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)tesco[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5263,7 +5263,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "test[_-]?github[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)test[_-]?github[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5271,7 +5271,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "test[_-]?test(=| =|:| :)" then
+ if {latest.response} matches "(?i)test[_-]?test(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5279,7 +5279,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "tester[_-]?keys[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)tester[_-]?keys[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5287,7 +5287,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "thera[_-]?oss[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)thera[_-]?oss[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5295,7 +5295,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "token[_-]?core[_-]?java(=| =|:| :)" then
+ if {latest.response} matches "(?i)token[_-]?core[_-]?java(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5303,7 +5303,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?access[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?access[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5311,7 +5311,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?api[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?api[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5319,7 +5319,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?branch(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?branch(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5327,7 +5327,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?com[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?com[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5335,7 +5335,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?e2e[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?e2e[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5343,7 +5343,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?gh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?gh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5351,7 +5351,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "travis[_-]?pull[_-]?request(=| =|:| :)" then
+ if {latest.response} matches "(?i)travis[_-]?pull[_-]?request(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5359,7 +5359,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "trex[_-]?client[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)trex[_-]?client[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5367,7 +5367,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "trex[_-]?okta[_-]?client[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)trex[_-]?okta[_-]?client[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5375,7 +5375,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "twilio[_-]?configuration[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)twilio[_-]?configuration[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5383,7 +5383,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "twilio[_-]?sid(=| =|:| :)" then
+ if {latest.response} matches "(?i)twilio[_-]?sid(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5391,7 +5391,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "twine[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)twine[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5399,7 +5399,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "unity[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)unity[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5407,7 +5407,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "unity[_-]?serial(=| =|:| :)" then
+ if {latest.response} matches "(?i)unity[_-]?serial(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5415,7 +5415,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "urban[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)urban[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5423,7 +5423,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "urban[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)urban[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5431,7 +5431,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "us[_-]?east[_-]?1[_-]?elb[_-]?amazonaws[_-]?com(=| =|:| :)" then
+ if {latest.response} matches "(?i)us[_-]?east[_-]?1[_-]?elb[_-]?amazonaws[_-]?com(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5439,7 +5439,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "user[_-]?assets[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)user[_-]?assets[_-]?secret[_-]?access[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5447,7 +5447,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "usertravis(=| =|:| :)" then
+ if {latest.response} matches "(?i)usertravis(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5455,7 +5455,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "v[_-]?sfdc[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)v[_-]?sfdc[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5463,7 +5463,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "v[_-]?sfdc[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)v[_-]?sfdc[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5471,7 +5471,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "vip[_-]?github[_-]?build[_-]?repo[_-]?deploy[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)vip[_-]?github[_-]?build[_-]?repo[_-]?deploy[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5479,7 +5479,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "vip[_-]?github[_-]?deploy[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)vip[_-]?github[_-]?deploy[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5487,7 +5487,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "vip[_-]?github[_-]?deploy[_-]?key[_-]?pass(=| =|:| :)" then
+ if {latest.response} matches "(?i)vip[_-]?github[_-]?deploy[_-]?key[_-]?pass(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5495,7 +5495,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "visual[_-]?recognition[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)visual[_-]?recognition[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5503,7 +5503,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "vscetoken(=| =|:| :)" then
+ if {latest.response} matches "(?i)vscetoken(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5511,7 +5511,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wakatime[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)wakatime[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5519,7 +5519,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "watson[_-]?conversation[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)watson[_-]?conversation[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5527,7 +5527,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "watson[_-]?device[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)watson[_-]?device[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5535,7 +5535,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "watson[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)watson[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5543,7 +5543,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?basic[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?basic[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5551,7 +5551,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?basic[_-]?password[_-]?2(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?basic[_-]?password[_-]?2(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5559,7 +5559,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?basic[_-]?password[_-]?3(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?basic[_-]?password[_-]?3(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5567,7 +5567,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?basic[_-]?password[_-]?4(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?basic[_-]?password[_-]?4(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5575,7 +5575,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?basic[_-]?password[_-]?5(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?basic[_-]?password[_-]?5(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5583,7 +5583,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?fb[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?fb[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5591,7 +5591,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?fb[_-]?password[_-]?2(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?fb[_-]?password[_-]?2(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5599,7 +5599,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?fb[_-]?password[_-]?3(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?fb[_-]?password[_-]?3(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5607,7 +5607,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "widget[_-]?test[_-]?server(=| =|:| :)" then
+ if {latest.response} matches "(?i)widget[_-]?test[_-]?server(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5615,7 +5615,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wincert[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)wincert[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5623,7 +5623,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wordpress[_-]?db[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)wordpress[_-]?db[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5631,7 +5631,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wordpress[_-]?db[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)wordpress[_-]?db[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5639,7 +5639,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpjm[_-]?phpunit[_-]?google[_-]?geocode[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpjm[_-]?phpunit[_-]?google[_-]?geocode[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5647,7 +5647,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wporg[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)wporg[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5655,7 +5655,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?db[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?db[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5663,7 +5663,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?db[_-]?user(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?db[_-]?user(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5671,7 +5671,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?prepare[_-]?dir(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?prepare[_-]?dir(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5679,7 +5679,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?report[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?report[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5687,7 +5687,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?ssh[_-]?connect(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?ssh[_-]?connect(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5695,7 +5695,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "wpt[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)" then
+ if {latest.response} matches "(?i)wpt[_-]?ssh[_-]?private[_-]?key[_-]?base64(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5703,7 +5703,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "www[_-]?googleapis[_-]?com(=| =|:| :)" then
+ if {latest.response} matches "(?i)www[_-]?googleapis[_-]?com(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5711,7 +5711,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yangshun[_-]?gh[_-]?password(=| =|:| :)" then
+ if {latest.response} matches "(?i)yangshun[_-]?gh[_-]?password(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5719,7 +5719,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yangshun[_-]?gh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)yangshun[_-]?gh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5727,7 +5727,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?account[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?account[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5735,7 +5735,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?account[_-]?refresh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?account[_-]?refresh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5743,7 +5743,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5751,7 +5751,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5759,7 +5759,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?partner[_-]?client[_-]?secret(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?partner[_-]?client[_-]?secret(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5767,7 +5767,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?partner[_-]?refresh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?partner[_-]?refresh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5775,7 +5775,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "yt[_-]?server[_-]?api[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)yt[_-]?server[_-]?api[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5783,7 +5783,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "zendesk[_-]?travis[_-]?github(=| =|:| :)" then
+ if {latest.response} matches "(?i)zendesk[_-]?travis[_-]?github(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5791,7 +5791,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "zensonatypepassword(=| =|:| :)" then
+ if {latest.response} matches "(?i)zensonatypepassword(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5799,7 +5799,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "zhuliang[_-]?gh[_-]?token(=| =|:| :)" then
+ if {latest.response} matches "(?i)zhuliang[_-]?gh[_-]?token(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative
@@ -5807,7 +5807,7 @@ given response then
         remediation: "Review and remove unnecessary exposure of secrets."
  end if
 
- if {latest.response} matches "zopim[_-]?account[_-]?key(=| =|:| :)" then
+ if {latest.response} matches "(?i)zopim[_-]?account[_-]?key(=| =|:| :)" then
       report issue and continue:
         severity: medium
         confidence: tentative