@coo-quack/sensitive-canary 0.7.0 → 0.8.0

package/dist/lib/default-config.json

@@ -0,0 +1,570 @@
+{
+  "contextWindow": 3,
+  "rules": [
+    {
+      "id": "aws-access-key",
+      "description": "AWS Access Key ID",
+      "regex": "\\b(A3T[A-Z0-9]|AKIA|ABIA|ACCA|APKA|ASCA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\\b",
+      "category": "secret",
+      "validate": "aws-key"
+    },
+    {
+      "id": "gcp-api-key",
+      "description": "Google Cloud API Key",
+      "regex": "AIza[0-9A-Za-z_-]{35}",
+      "category": "secret"
+    },
+    {
+      "id": "private-key",
+      "description": "PEM Private Key",
+      "regex": "-----BEGIN ((RSA|EC|DSA|PGP|OPENSSH|ENCRYPTED|SSH2 ENCRYPTED) )?PRIVATE KEY",
+      "category": "secret"
+    },
+    {
+      "id": "github-pat",
+      "description": "GitHub Personal Access Token",
+      "regex": "gh[pousr]_[A-Za-z0-9]{36,255}",
+      "category": "secret"
+    },
+    {
+      "id": "github-fine-grained",
+      "description": "GitHub Fine-Grained Token",
+      "regex": "github_pat_[A-Za-z0-9_]{82}",
+      "category": "secret"
+    },
+    {
+      "id": "gitlab-pat",
+      "description": "GitLab Personal Access Token",
+      "regex": "(?:gl(?:pat|dt|rt|cbt|imt|agent|oas|ptt|soat|ffct|ft)-[A-Za-z0-9_=-]{20,}|GR1348941[A-Za-z0-9_-]{20})",
+      "category": "secret"
+    },
+    {
+      "id": "npm-token",
+      "description": "npm Access Token",
+      "regex": "npm_[A-Za-z0-9]{36}",
+      "category": "secret"
+    },
+    {
+      "id": "slack-token",
+      "description": "Slack Token",
+      "regex": "(?:xox[abeprs]|xapp|xwfp)-[0-9a-zA-Z-]{10,72}",
+      "category": "secret"
+    },
+    {
+      "id": "slack-webhook",
+      "description": "Slack Webhook URL",
+      "regex": "https:\\/\\/hooks\\.slack\\.com\\/services\\/T[A-Za-z0-9_]{8,10}\\/B[A-Za-z0-9_]{8,12}\\/[A-Za-z0-9_]{23,24}",
+      "category": "secret"
+    },
+    {
+      "id": "discord-webhook",
+      "description": "Discord Webhook URL",
+      "regex": "https:\\/\\/discord(?:app)?\\.com\\/api\\/webhooks\\/[0-9]{17,20}\\/[A-Za-z0-9_-]{68}",
+      "category": "secret"
+    },
+    {
+      "id": "telegram-bot-token",
+      "description": "Telegram Bot Token",
+      "regex": "\\b[0-9]{6,12}:AA[0-9A-Za-z_-]{30,128}\\b",
+      "category": "secret"
+    },
+    {
+      "id": "twilio-sid",
+      "description": "Twilio Account SID",
+      "regex": "(?<![A-Za-z0-9])(?:AC|SK)[0-9a-fA-F]{32}(?![A-Za-z0-9])",
+      "category": "secret"
+    },
+    {
+      "id": "sendgrid-key",
+      "description": "SendGrid API Key",
+      "regex": "SG\\.[A-Za-z0-9_-]{20,24}\\.[A-Za-z0-9_-]{39,50}",
+      "category": "secret"
+    },
+    {
+      "id": "mailgun-key",
+      "description": "Mailgun API Key",
+      "regex": "key-[0-9a-zA-Z]{32}",
+      "category": "secret"
+    },
+    {
+      "id": "mailchimp-key",
+      "description": "Mailchimp API Key",
+      "regex": "[0-9a-f]{32}-us[0-9]{1,2}",
+      "category": "secret"
+    },
+    {
+      "id": "stripe-secret-key",
+      "description": "Stripe Secret Key",
+      "regex": "(?:sk_(?:live|test|org))_[0-9a-zA-Z]{24}|whsec_[0-9a-zA-Z]{32,}",
+      "category": "secret"
+    },
+    {
+      "id": "stripe-restricted-key",
+      "description": "Stripe Restricted Key",
+      "regex": "rk_(live|test)_[0-9a-zA-Z]{24}",
+      "category": "secret"
+    },
+    {
+      "id": "openai-key",
+      "description": "OpenAI API Key (legacy)",
+      "regex": "sk-(?!proj-|ant-)[A-Za-z0-9]{48}",
+      "category": "secret"
+    },
+    {
+      "id": "openai-project-key",
+      "description": "OpenAI Project API Key",
+      "regex": "sk-proj-[A-Za-z0-9_-]{40,}",
+      "category": "secret",
+      "entropyThreshold": 3.5
+    },
+    {
+      "id": "anthropic-key",
+      "description": "Anthropic API Key",
+      "regex": "sk-ant-[A-Za-z0-9_-]{95,}",
+      "category": "secret"
+    },
+    {
+      "id": "replicate-token",
+      "description": "Replicate API Token",
+      "regex": "r8_[0-9A-Za-z_-]{37}",
+      "category": "secret"
+    },
+    {
+      "id": "huggingface-token",
+      "description": "Hugging Face Access Token",
+      "regex": "(?:hf_[a-zA-Z0-9]{34}|api_org_[a-zA-Z0-9]{34})",
+      "category": "secret"
+    },
+    {
+      "id": "groq-key",
+      "description": "Groq API Key",
+      "regex": "gsk_[A-Za-z0-9]{52}",
+      "category": "secret"
+    },
+    {
+      "id": "openrouter-key",
+      "description": "OpenRouter API Key",
+      "regex": "sk-or-v1-[0-9a-f]{64}",
+      "category": "secret"
+    },
+    {
+      "id": "xai-key",
+      "description": "xAI (Grok) API Key",
+      "regex": "xai-[0-9A-Za-z_]{80}",
+      "category": "secret"
+    },
+    {
+      "id": "perplexity-key",
+      "description": "Perplexity API Key",
+      "regex": "pplx-[a-zA-Z0-9]{48}",
+      "category": "secret"
+    },
+    {
+      "id": "digitalocean-pat",
+      "description": "DigitalOcean Personal Access Token",
+      "regex": "do[opr]_v1_[a-f0-9]{64}",
+      "category": "secret"
+    },
+    {
+      "id": "square-access-token",
+      "description": "Square Access Token",
+      "regex": "(?<![A-Za-z0-9+/])(?:EAAA[a-zA-Z0-9\\-_+=]{60,1024}|sq0(?:atp|csp)-[A-Za-z0-9_-]{22,128})(?![A-Za-z0-9+/=_-])",
+      "category": "secret"
+    },
+    {
+      "id": "mapbox-token",
+      "description": "Mapbox Token",
+      "regex": "(?<![A-Za-z0-9_-])(?:pk|sk|tk)\\.eyJ[A-Za-z0-9_-]{10,1024}\\.[A-Za-z0-9_-]{10,1024}",
+      "category": "secret"
+    },
+    {
+      "id": "sentry-user-token",
+      "description": "Sentry User Auth Token",
+      "regex": "sntryu_[a-f0-9]{64}",
+      "category": "secret"
+    },
+    {
+      "id": "sentry-org-token",
+      "description": "Sentry Organization Auth Token",
+      "regex": "(?<![A-Za-z0-9_-])sntrys_[A-Za-z0-9+/=]{10,1024}_[A-Za-z0-9]{43}",
+      "category": "secret"
+    },
+    {
+      "id": "atlassian-token",
+      "description": "Atlassian API Token",
+      "regex": "ATATT3[A-Za-z0-9_\\-=]{180,}",
+      "category": "secret"
+    },
+    {
+      "id": "linear-key",
+      "description": "Linear API Key",
+      "regex": "lin_api_[a-zA-Z0-9]{40}",
+      "category": "secret"
+    },
+    {
+      "id": "postman-key",
+      "description": "Postman API Key",
+      "regex": "PMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}",
+      "category": "secret"
+    },
+    {
+      "id": "supabase-key",
+      "description": "Supabase Personal Access Token",
+      "regex": "sbp_[a-z0-9]{40}",
+      "category": "secret"
+    },
+    {
+      "id": "jwt",
+      "description": "JSON Web Token (JWT)",
+      "regex": "(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{10,4096}\\.eyJ[A-Za-z0-9_-]{10,4096}\\.[A-Za-z0-9_-]{10,4096}",
+      "category": "secret"
+    },
+    {
+      "id": "generic-secret",
+      "description": "Generic API Key / Secret",
+      "regex": "(api[_-]?key|secret[_-]?key|access[_-]?token|api[_-]?secret)\\s*[:=]\\s*['\"]?([A-Za-z0-9\\-_.]{20,})",
+      "category": "secret",
+      "flags": "gi",
+      "secretGroup": 2,
+      "entropyThreshold": 3.5
+    },
+    {
+      "id": "env-assignment",
+      "description": ".env style secret assignment",
+      "regex": "(?:(?:^|\\n)[ \\t-]{0,64}[\"']?[A-Za-z0-9_]{0,64}(?:SECRET|PASSWORD|PASSWD|(?<![A-Za-z])PASS(?![A-Za-z])|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Za-z0-9_]{0,64}[\"']?[ \\t]*:|\\b[A-Za-z0-9_]{0,64}(?:SECRET|PASSWORD|PASSWD|(?<![A-Za-z])PASS(?![A-Za-z])|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Za-z0-9_]{0,64}[ \\t]*=)[ \\t]*[\"']?(?!\\$)(?=([^\\s\"'\\[\\]{}();,<>]{8,4096}))\\1(?:(?=$|[\\s\"';,)\\]}])|(?=[^\\s\"'\\[\\]{}();,<>]))",
+      "flags": "gi",
+      "category": "secret",
+      "secretGroup": 1,
+      "entropyThreshold": 3
+    },
+    {
+      "id": "connection-string",
+      "description": "Database Connection String with credentials",
+      "regex": "(mongodb(?:\\+srv)?|mysql|postgres|postgresql|redis):\\/\\/[^:\\s]{1,1024}:[^@\\s]{1,1024}@",
+      "category": "secret"
+    },
+    {
+      "id": "pii-email",
+      "description": "Email Address",
+      "regex": "(?<!\\b(?:ssh|scp|rsync|sftp)\\b(?:[ \\t]+[^\\s@,;()]+){0,2}[ \\t]+)\\b(?!(?:git|hg|svn)@)[A-Za-z0-9._%+-]{1,64}@(?![0-9]+\\.)(?!example\\.(?:com|net|org|edu)\\b)(?![A-Za-z0-9.-]{0,255}\\.(?:test|invalid|localhost|local|example)\\b)(?:[A-Za-z0-9-]+\\.)+(?!(?:png|jpg|jpeg|gif|webp|svg|ico|bmp|tiff|tif|css|json|html|htm|xml|yaml|yml|lock|woff|ttf|otf|eot|webm|wav|flac|pdf|tgz|bz|xz)(?![A-Za-z]))[A-Za-z]{2,}(?![A-Za-z0-9.-])(?!:\\S)",
+      "category": "pii"
+    },
+    {
+      "id": "pii-credit-card",
+      "description": "Credit Card Number",
+      "regex": "\\b(?:4[0-9]{3}(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|4[0-9]{3}(?:[\\s-]?[0-9]{4}){3}|4[0-9]{3}(?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{1}|5[1-5][0-9]{2}(?:[\\s-]?[0-9]{4}){3}|2(?:22[1-9]|2[3-9][0-9]|[3-6][0-9]{2}|7[01][0-9]|720)(?:[\\s-]?[0-9]{4}){3}|3[47][0-9]{2}(?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{3}|3[47][0-9]{2}[\\s-]?[0-9]{6}[\\s-]?[0-9]{5}|6(?:011|4[4-9][0-9]|5[0-9]{2})(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|6(?:011|4[4-9][0-9]|5[0-9]{2})(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{2}|6(?:011|4[4-9][0-9]|5[0-9]{2})(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{1}|6(?:011|4[4-9][0-9]|5[0-9]{2})(?:[\\s-]?[0-9]{4}){3}|35(?:2[89]|[3-8][0-9])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|35(?:2[89]|[3-8][0-9])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{2}|35(?:2[89]|[3-8][0-9])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{1}|35(?:2[89]|[3-8][0-9])(?:[\\s-]?[0-9]{4}){3}|3(?:0[0-5]|[689][0-9])[0-9](?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|3(?:0[0-5]|[689][0-9])[0-9](?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{2}|3(?:0[0-5]|[689][0-9])[0-9](?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{1}|3(?:0[0-5]|[689][0-9])[0-9](?:[\\s-]?[0-9]{4}){3}|3(?:0[0-5]|[689][0-9])[0-9](?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{2}|3(?:0[0-5]|[689][0-9])[0-9][\\s-]?[0-9]{6}[\\s-]?[0-9]{4}|(?:62|81)[0-9]{2}(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|(?:62|81)[0-9]{2}(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{2}|(?:62|81)[0-9]{2}(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{1}|(?:62|81)[0-9]{2}(?:[\\s-]?[0-9]{4}){3}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{3}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{2}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){3}[\\s-]?[0-9]{1}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){3}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{3}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{2}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){2}[\\s-]?[0-9]{1}|(?:5018|5020|5038|6304|6759|676[1-3])(?:[\\s-]?[0-9]{4}){2})\\b",
+      "category": "pii",
+      "validate": "luhn"
+    },
+    {
+      "id": "pii-ssn",
+      "description": "US Social Security Number",
+      "regex": "\\b(?!000|666|9\\d{2})\\d{3}[- ](?!00)\\d{2}[- ](?!0000)\\d{4}\\b",
+      "category": "pii"
+    },
+    {
+      "id": "pii-phone-us",
+      "description": "US Phone Number",
+      "regex": "\\b(\\+1[\\s.-]?)?\\(?\\d{3}\\)?[\\s.-]\\d{3}[\\s.-]\\d{4}\\b",
+      "category": "pii"
+    },
+    {
+      "id": "pii-phone-jp",
+      "description": "Japanese Phone Number",
+      "regex": "\\b0\\d{1,4}[\\s-]\\d{1,4}[\\s-]\\d{4}\\b",
+      "category": "pii",
+      "validate": "phone-jp"
+    },
+    {
+      "id": "pii-postal-jp",
+      "description": "Japanese Postal Code",
+      "regex": "\u3012\\d{3}[\\s-]\\d{4}",
+      "category": "pii"
+    },
+    {
+      "id": "pii-mynumber-jp",
+      "description": "Japanese Individual Number (My Number)",
+      "regex": "\\b\\d{12}\\b",
+      "category": "pii",
+      "validate": "mynumber-jp"
+    },
+    {
+      "id": "pii-nir-fr",
+      "description": "French NIR / Social Security Number",
+      "regex": "\\b[12]\\d{2}(?:0[1-9]|1[0-2]|20)(?:\\d{5}|2[AB]\\d{3})\\d{3}\\s?\\d{2}\\b",
+      "category": "pii",
+      "flags": "gi",
+      "validate": "nir-fr"
+    },
+    {
+      "id": "pii-codice-fiscale-it",
+      "description": "Italian Codice Fiscale",
+      "regex": "\\b[A-Z]{6}[0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]\\b",
+      "category": "pii",
+      "validate": "codice-fiscale-it"
+    },
+    {
+      "id": "pii-steuer-id-de",
+      "description": "German Steuer-Identifikationsnummer",
+      "regex": "\\b[1-9]\\d{10}\\b",
+      "category": "pii",
+      "validate": "steuer-id-de"
+    },
+    {
+      "id": "pii-dni-nie-es",
+      "description": "Spanish DNI / NIE",
+      "regex": "\\b(?:\\d{8}[A-Z]|[XYZ]\\d{7}[A-Z])\\b",
+      "category": "pii",
+      "validate": "dni-nie-es"
+    },
+    {
+      "id": "pii-phone-fr",
+      "description": "French Phone Number",
+      "regex": "\\b0[1-9](?:[\\s.-]?\\d{2}){4}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "t\u00e9l",
+        "tel",
+        "t\u00e9l\u00e9phone",
+        "telephone",
+        "phone",
+        "mobile",
+        "portable",
+        "fax"
+      ]
+    },
+    {
+      "id": "pii-phone-it",
+      "description": "Italian Phone Number",
+      "regex": "\\b(?:0\\d{8,9}|3\\d{8,9})\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": ["telefono", "tel", "cellulare", "mobile", "phone", "fax"]
+    },
+    {
+      "id": "pii-phone-de",
+      "description": "German Phone Number",
+      "regex": "\\b0[1-9]\\d{6,11}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": ["telefon", "tel", "handy", "mobil", "phone", "fax"]
+    },
+    {
+      "id": "pii-phone-es",
+      "description": "Spanish Phone Number",
+      "regex": "\\b[67]\\d{8}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "tel\u00e9fono",
+        "telefono",
+        "tel",
+        "m\u00f3vil",
+        "movil",
+        "phone",
+        "fax"
+      ]
+    },
+    {
+      "id": "pii-postal-code",
+      "description": "Postal Code (US ZIP / EU / KR)",
+      "regex": "\\b\\d{5}(?:-\\d{4})?\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "zip",
+        "postal",
+        "postale",
+        "postcode",
+        "plz",
+        "postleitzahl",
+        "\uc6b0\ud3b8\ubc88\ud638",
+        "cap"
+      ],
+      "excludeContext": ["buffer", "bytes", "byte", "memory", "cache"]
+    },
+    {
+      "id": "pii-rrn-kr",
+      "description": "Korean Resident Registration Number",
+      "regex": "\\b\\d{6}[-\\s]?\\d{7}\\b",
+      "category": "pii",
+      "validate": "rrn-kr",
+      "requireContext": true,
+      "contextWords": [
+        "\uc8fc\ubbfc\ub4f1\ub85d\ubc88\ud638",
+        "\uc8fc\ubbfc\ubc88\ud638",
+        "rrn",
+        "resident",
+        "registration",
+        "\uc2e0\ubd84\uc99d",
+        "\uac1c\uc778\uc815\ubcf4"
+      ]
+    },
+    {
+      "id": "pii-brn-kr",
+      "description": "Korean Business Registration Number",
+      "regex": "\\b\\d{3}[-\\s]?\\d{2}[-\\s]?\\d{5}\\b",
+      "category": "pii",
+      "validate": "brn-kr",
+      "requireContext": true,
+      "contextWords": [
+        "\uc0ac\uc5c5\uc790\ub4f1\ub85d\ubc88\ud638",
+        "\uc0ac\uc5c5\uc790\ubc88\ud638",
+        "brn",
+        "business",
+        "registration",
+        "\ubc95\uc778",
+        "\uc138\uae08\uacc4\uc0b0\uc11c"
+      ]
+    },
+    {
+      "id": "pii-resident-id-cn",
+      "description": "Chinese Resident Identity Card",
+      "regex": "\\b\\d{17}[\\dXx]\\b",
+      "category": "pii",
+      "validate": "resident-id-cn"
+    },
+    {
+      "id": "pii-phone-kr",
+      "description": "Korean Phone Number",
+      "regex": "(?:\\+82[-\\s]?)?(?:01[016789]|0\\d{1,2})[-\\s]?\\d{3,4}[-\\s]?\\d{4}",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "\uc804\ud654",
+        "\ud578\ub4dc\ud3f0",
+        "\ud734\ub300",
+        "tel",
+        "phone",
+        "mobile",
+        "fax"
+      ]
+    },
+    {
+      "id": "pii-phone-cn",
+      "description": "Chinese Phone Number",
+      "regex": "(?:\\+86[-\\s]?)?(?:1[3-9]\\d{9}|0\\d{2,3}[-\\s]?\\d{7,8})",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "\u7535\u8bdd",
+        "\u624b\u673a",
+        "tel",
+        "phone",
+        "mobile",
+        "fax"
+      ]
+    },
+    {
+      "id": "pii-postal-cn",
+      "description": "Chinese Postal Code",
+      "regex": "\\b[1-9]\\d{5}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": [
+        "\u90ae\u7f16",
+        "\u90ae\u653f\u7f16\u7801",
+        "postal",
+        "postcode",
+        "zip"
+      ]
+    },
+    {
+      "id": "pii-ipv4-public",
+      "description": "Public IPv4 Address",
+      "regex": "\\b\\d{1,3}(?:\\.\\d{1,3}){3}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": ["ip", "ipv4"],
+      "validate": "public-ipv4"
+    },
+    {
+      "id": "pii-ipv6",
+      "description": "IPv6 Address",
+      "regex": "\\b[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{0,4}){2,7}\\b",
+      "category": "pii",
+      "requireContext": true,
+      "contextWords": ["ipv6", "ip"],
+      "validate": "public-ipv6"
+    },
+    {
+      "id": "openai-service-key",
+      "description": "OpenAI Service Account / Admin Key",
+      "regex": "sk-(?:svcacct|admin)-[A-Za-z0-9_-]{20,}",
+      "category": "secret"
+    },
+    {
+      "id": "azure-storage-key",
+      "description": "Azure Storage Account Key",
+      "regex": "AccountKey=[A-Za-z0-9+/]{86}==",
+      "category": "secret"
+    },
+    {
+      "id": "flyio-token",
+      "description": "Fly.io API Token",
+      "regex": "(?:fo1_[A-Za-z0-9_-]{43}|fm1[ar]_[A-Za-z0-9+/_-]{40,}={0,3}|fm2_[A-Za-z0-9+/_-]{40,}={0,3})",
+      "category": "secret"
+    },
+    {
+      "id": "databricks-token",
+      "description": "Databricks Personal Access Token",
+      "regex": "\\bdapi[0-9a-f]{32}\\b",
+      "category": "secret"
+    },
+    {
+      "id": "vault-token",
+      "description": "HashiCorp Vault Token",
+      "regex": "\\bhv[sb]\\.[A-Za-z0-9_-]{24,}",
+      "category": "secret"
+    },
+    {
+      "id": "shopify-token",
+      "description": "Shopify Access Token",
+      "regex": "\\bshp(?:at|ss|ca|pa)_[0-9a-fA-F]{32}\\b",
+      "category": "secret"
+    },
+    {
+      "id": "doppler-token",
+      "description": "Doppler Token",
+      "regex": "\\bdp\\.(?:pt|st|ct|sa|scim)\\.[A-Za-z0-9]{40,}",
+      "category": "secret"
+    },
+    {
+      "id": "grafana-token",
+      "description": "Grafana Cloud / Service Account Token",
+      "regex": "\\bgl(?:c|sa)_[A-Za-z0-9+/=_-]{32,}",
+      "category": "secret"
+    },
+    {
+      "id": "notion-token",
+      "description": "Notion Integration Token",
+      "regex": "\\b(?:ntn_[A-Za-z0-9]{40,}|secret_[A-Za-z0-9]{43})",
+      "category": "secret"
+    },
+    {
+      "id": "azure-sas-key",
+      "description": "Azure Shared Access Key (Service Bus, Event Hubs, IoT Hub)",
+      "regex": "SharedAccessKey=[A-Za-z0-9+/]{22,86}={0,2}",
+      "category": "secret"
+    },
+    {
+      "id": "google-oauth-secret",
+      "description": "Google OAuth Client Secret",
+      "regex": "\\bGOCSPX-[A-Za-z0-9_-]{20,}",
+      "category": "secret"
+    },
+    {
+      "id": "private-key-base64",
+      "description": "PEM Private Key, base64-encoded",
+      "regex": "(?:LS0tLS1CRUdJTi|0tLS0tQkVHSU4g|tLS0tLUJFR0lOI)[A-Za-z0-9+/=]{40,}",
+      "category": "secret"
+    },
+    {
+      "id": "url-basic-auth",
+      "description": "Credentials embedded in an http(s) URL",
+      "regex": "\\bhttps?://[A-Za-z0-9._~%+-]{1,64}:[^@/\\s\\\"'`<>]{3,256}@[A-Za-z0-9.-]+",
+      "category": "secret"
+    }
+  ]
+}

package/dist/lib/encoding.js

@@ -0,0 +1,123 @@
+// How a file's bytes are read as text.
+//
+// A file is not labelled with its encoding, so these decide. The decisions are
+// deliberately loose and the caller reads the bytes both ways when the verdict
+// is a guess: the alternative is a wrong guess that decodes a credential into
+// characters no rule matches, which is the whole scan switched off for that
+// file.
+import fs from "node:fs";
+export function detectUtf16(raw) {
+    if (raw.length < 4)
+        return null;
+    // Swapping is done on a copy: `raw` is a view into the shared read buffer.
+    const swapped = () => Buffer.from(raw)
+        .subarray(0, raw.length & ~1)
+        .swap16();
+    if (raw[0] === 0xff && raw[1] === 0xfe)
+        return { bytes: raw, fromBom: true };
+    if (raw[0] === 0xfe && raw[1] === 0xff)
+        return { bytes: swapped(), fromBom: true };
+    // Far enough in to reach a newline or a space. Five hundred pairs of Japanese
+    // carry no zero byte at all, and that prefix decided the whole file.
+    const pairs = Math.min(raw.length >> 1, 8192);
+    let evenNuls = 0;
+    let oddNuls = 0;
+    for (let i = 0; i < pairs; i++) {
+        if (raw[i * 2] === 0)
+            evenNuls++;
+        if (raw[i * 2 + 1] === 0)
+            oddNuls++;
+    }
+    // Several, not one: a single stray NUL is not an encoding.
+    const MINIMUM_NULS = 8;
+    if (Math.max(evenNuls, oddNuls) < MINIMUM_NULS)
+        return null;
+    // How much the minority side holds is not asked. Characters in the U+xx00
+    // rows put a NUL on that side, and Japanese is full of them — `一` is U+4E00,
+    // and a full-width space is U+3000 — so any threshold tight enough to exclude
+    // a binary also excludes an ordinary Japanese document. The counts cannot
+    // separate those two cases, so the question is left to `readsAsText`, and
+    // being wrong costs only a pass: the caller reads the bytes both ways
+    // whenever the verdict did not come from a byte-order mark.
+    //
+    // Which side leads picks the order the two byte orders are tried in, not
+    // whether they are tried.
+    const orderings = oddNuls >= evenNuls ? [raw, swapped()] : [swapped(), raw];
+    for (const candidate of orderings) {
+        if (readsAsText(candidate))
+            return { bytes: candidate, fromBom: false };
+    }
+    return null;
+}
+// Whether the runs of text between the NUL bytes read as something someone
+// wrote. A `.env` written by a tool that terminates its values, and a log with
+// a stray zero in it, both pass; a JPEG's compressed bytes do not.
+export function readsAsUtf8Text(raw) {
+    const sample = utf8Runs(raw.subarray(0, 4096));
+    if (sample.length === 0)
+        return false;
+    let bad = 0;
+    for (const ch of sample) {
+        const code = ch.codePointAt(0) ?? 0;
+        const isControl = (code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d) ||
+            code === 0x7f;
+        if (isControl || code === 0xfffd)
+            bad++;
+    }
+    return bad / sample.length < 0.05;
+}
+// Every run of text between the NUL bytes, joined by newlines so that no rule
+// matches across two unrelated runs.
+export function utf8Runs(raw) {
+    const text = raw.toString("utf8");
+    return text.indexOf("\0") === -1 ? text : text.split("\0").join("\n");
+}
+// Whether these bytes decoded as UTF-16 look like something someone wrote. A
+// binary file can have its NULs on one side by chance; text decoded from the
+// wrong encoding is mostly control characters and replacement characters, and
+// this is what separates the two.
+export function readsAsText(le) {
+    const sample = le.subarray(0, 4096).toString("utf16le");
+    if (sample.length === 0)
+        return false;
+    let bad = 0;
+    for (const ch of sample) {
+        const code = ch.codePointAt(0) ?? 0;
+        const isControl = (code < 0x20 && code !== 0x09 && code !== 0x0a && code !== 0x0d) ||
+            code === 0x7f;
+        if (isControl || code === 0xfffd || (code >= 0xe000 && code <= 0xf8ff))
+            bad++;
+    }
+    return bad / sample.length < 0.05;
+}
+// Whether the first few kilobytes hold a NUL byte that UTF-16 does not explain.
+// UTF-16 text is half NUL by construction, and a `.env` written by PowerShell is
+// the file a sweep least wants to skip.
+const BINARY_SNIFF_BYTES = 4096;
+export function looksBinary(filePath) {
+    let fd;
+    try {
+        fd = fs.openSync(filePath, "r");
+        const head = Buffer.alloc(BINARY_SNIFF_BYTES);
+        const read = fs.readSync(fd, head, 0, head.length, 0);
+        const bytes = head.subarray(0, read);
+        if (!bytes.includes(0))
+            return false;
+        // Neither reading, rather than the UTF-16 verdict alone. That verdict is
+        // deliberately loose — the file scan covers a wrong guess by reading the
+        // bytes both ways — and a sweep has no such second chance, so it asks the
+        // question the answer is wanted for: does anything here read as text?
+        const utf16 = detectUtf16(bytes);
+        if (utf16 !== null && readsAsText(utf16.bytes))
+            return false;
+        return !readsAsUtf8Text(bytes);
+    }
+    catch {
+        // Unreadable. Nothing to sweep, and the named-file path still guards it.
+        return true;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}