RubyGems Legacy API Key Endpoint Harvesting via CDN Cache Path Variants

Arnold Chan@slaz

•updated Sep 12, 2026•0•0•1

Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.