@link-foundation/sensitive-data-sanitizer 0.19.2 → 0.20.0

package/src/rule-catalog.js

@@ -4,16 +4,221 @@ export const builtInRules = Object.freeze([
   'anthropic',
   'authorization',
   'aws',
+  'betterleaks/abuseipdb-api-key.1',
+  'betterleaks/aikido-ci-token',
+  'betterleaks/aikido-client-secret',
+  'betterleaks/airtable-oauth-token',
+  'betterleaks/aiven-auth-token',
+  'betterleaks/alibaba-sts-access-key-secret',
+  'betterleaks/amplitude-secret-key',
+  'betterleaks/apify-api-token',
+  'betterleaks/apollo-api-key.1',
+  'betterleaks/asaas-api-token',
+  'betterleaks/assemblyai-api-key',
+  'betterleaks/auth0-client-secret.1',
+  'betterleaks/azure-app-configuration-connection-string',
+  'betterleaks/azure-servicebus-connection-string',
+  'betterleaks/azure-storage-account-key',
+  'betterleaks/bitbucket-data-center-token',
+  'betterleaks/bitly-access-token',
+  'betterleaks/bitrise-access-token',
+  'betterleaks/box-api-access-token',
+  'betterleaks/brave-search-api-key',
+  'betterleaks/browserstack-access-key.1',
+  'betterleaks/buildkite-service-token',
+  'betterleaks/buildkite-user-access-token',
+  'betterleaks/canadian-digital-service-notify-api-key',
+  'betterleaks/canva-client-secret',
+  'betterleaks/cartesia-api-key.1',
+  'betterleaks/cerebras-api-key',
+  'betterleaks/checkout-secret-key',
+  'betterleaks/circleci-personal-token',
+  'betterleaks/circleci-project-token',
+  'betterleaks/civo-api-key',
+  'betterleaks/clerk-secret-key',
+  'betterleaks/clickup-personal-api-token',
+  'betterleaks/cloudflare-api-key.2',
+  'betterleaks/cloudinary-api-secret',
+  'betterleaks/cloudsmith-api-key',
+  'betterleaks/cockroachlabs-cloud-api-key',
+  'betterleaks/configcat-sdk-key',
+  'betterleaks/configcat-sdk-key-extended',
+  'betterleaks/couchbase-capella-api-key',
+  'betterleaks/coveralls-personal-api-token',
+  'betterleaks/crates-io-api-key',
+  'betterleaks/cursor-api-key',
+  'betterleaks/databento-api-key',
+  'betterleaks/datadog-api-key',
+  'betterleaks/datadog-application-key',
+  'betterleaks/datagov-api-key',
+  'betterleaks/datastax-astra-application-token',
+  'betterleaks/deepgram-api-key',
+  'betterleaks/deepseek-api-key',
+  'betterleaks/deno-account-token',
+  'betterleaks/devcycle-client-sdk-key',
+  'betterleaks/devcycle-mobile-sdk-key',
+  'betterleaks/devcycle-server-sdk-key',
+  'betterleaks/devin-personal-api-key',
+  'betterleaks/devin-service-api-key',
+  'betterleaks/devin-service-user-token',
+  'betterleaks/disqus-api-key',
+  'betterleaks/docker-swarm-join-token',
+  'betterleaks/docker-swarm-unlock-key',
+  'betterleaks/dockerhub-organization-access-token',
+  'betterleaks/dockerhub-personal-access-token',
+  'betterleaks/ebay-client-secret',
+  'betterleaks/elastic-cloud-api-key',
+  'betterleaks/elevenlabs-api-key',
+  'betterleaks/endorlabs-api-key',
+  'betterleaks/endorlabs-api-secret',
+  'betterleaks/etsy-open-api-key',
+  'betterleaks/exoscale-api-key',
+  'betterleaks/fal-api-key.1',
+  'betterleaks/figma-personal-access-header-token',
+  'betterleaks/figma-personal-access-token',
+  'betterleaks/fullstory-api-key',
+  'betterleaks/gcp-application-default-credentials',
+  'betterleaks/gcp-gemini-api',
+  'betterleaks/gcp-service-account',
+  'betterleaks/gitea-access-token',
+  'betterleaks/gitlab-incoming-mail-address-token',
+  'betterleaks/gitlab-pat-routable-versioned',
+  'betterleaks/greptile-api-key',
+  'betterleaks/groq-api-key',
+  'betterleaks/gumroad-access-token',
+  'betterleaks/highnote-secret-live-key',
+  'betterleaks/honeycomb-api-key',
+  'betterleaks/hunter-api-key.1',
+  'betterleaks/ibm-cloud-user-api-key',
+  'betterleaks/influxdb-api-token',
+  'betterleaks/infomaniak-api-token',
+  'betterleaks/instantly-api-key.1',
+  'betterleaks/ionic-personal-access-token',
+  'betterleaks/jumpcloud-api-key',
+  'betterleaks/kagi-api-key',
+  'betterleaks/kimi-api-key',
+  'betterleaks/klaviyo-api-key',
+  'betterleaks/langchain-langsmith-personal-access-token',
+  'betterleaks/langchain-langsmith-service-key',
+  'betterleaks/langfuse-secret-key.1',
+  'betterleaks/lark-app-secret',
+  'betterleaks/lichess-personal-access-token',
+  'betterleaks/lighton-paradigm-api-key',
+  'betterleaks/llama-cloud-api-key.1',
+  'betterleaks/mailersend-api-token',
+  'betterleaks/mem0-api-key.1',
+  'betterleaks/mercury-production-api-token',
+  'betterleaks/mergify-application-key',
+  'betterleaks/midtrans-production-server-client-key',
+  'betterleaks/minimax-api-key',
+  'betterleaks/miro-access-token',
+  'betterleaks/miro-client-secret',
+  'betterleaks/mistral-api-key',
+  'betterleaks/monday-api-token.1',
+  'betterleaks/mongodb-atlas-service-account-secret',
+  'betterleaks/mongodb-connection-string',
+  'betterleaks/mux-access-token-secret.1',
+  'betterleaks/neon-api-key',
+  'betterleaks/ngrok-api-key.1',
+  'betterleaks/nuget-api-key',
+  'betterleaks/nvidia-api-key',
+  'betterleaks/nylas-api-key.1',
+  'betterleaks/ollama-api-key',
+  'betterleaks/onesignal-rich-authentication-token',
+  'betterleaks/onfido-live-api-token-ca',
+  'betterleaks/onfido-live-api-token-eu',
+  'betterleaks/onfido-live-api-token-us',
+  'betterleaks/openrouter-api-key',
+  'betterleaks/openweather-api-key',
+  'betterleaks/opsgenie-api-key.1',
+  'betterleaks/ovh-application-secret',
+  'betterleaks/paddle-live-api-key',
+  'betterleaks/pagerduty-authorization-token.1',
+  'betterleaks/paypal-client-secret.1',
+  'betterleaks/persona-production-api-key',
+  'betterleaks/pinecone-api-key.1',
+  'betterleaks/pinecone-api-key.2',
+  'betterleaks/pinterest-access-token',
+  'betterleaks/plivo-auth-token',
+  'betterleaks/polar-oauth-access-token',
+  'betterleaks/polar-organization-access-token',
+  'betterleaks/polar-personal-access-token',
+  'betterleaks/polymarket-api-key',
+  'betterleaks/polymarket-private-key',
+  'betterleaks/posthog-personal-api-key',
+  'betterleaks/posthog-project-api-key',
+  'betterleaks/postmark-api-token.1',
+  'betterleaks/proof-full-access-api-key',
+  'betterleaks/rainforest-pay-production-api-key',
+  'betterleaks/ramp-client-secret',
+  'betterleaks/razorpay-key-secret.1',
+  'betterleaks/redirect-pizza-api-token.1',
+  'betterleaks/render-api-key',
+  'betterleaks/replicate-api-token',
+  'betterleaks/resend-api-key.1',
+  'betterleaks/retell-api-key.1',
+  'betterleaks/rootly-api-key.1',
+  'betterleaks/runpod-api-key.1',
+  'betterleaks/salesforce-access-token.1',
+  'betterleaks/samsara-api-token.1',
+  'betterleaks/scaleway-secret-key',
+  'betterleaks/scalr-api-access-token.1',
+  'betterleaks/segment-public-api-token.1',
+  'betterleaks/slack-session-cookie',
+  'betterleaks/slack-session-token',
+  'betterleaks/snowflake-programmatic-access-token.1',
+  'betterleaks/sslmate-api-key.1',
+  'betterleaks/stability-ai-api-key',
+  'betterleaks/supabase-management-token',
+  'betterleaks/supabase-project-api-key',
+  'betterleaks/tableau-personal-access-token.1',
+  'betterleaks/tailscale-api-key.1',
+  'betterleaks/telnyx-api-v2-key.1',
+  'betterleaks/temporal-cloud-api-key.1',
+  'betterleaks/thunderstore-api-token.1',
+  'betterleaks/togetherai-api-key',
+  'betterleaks/unkey-root-key.1',
+  'betterleaks/upcloud-api-token',
+  'betterleaks/upstage-api-key',
+  'betterleaks/upstash-redis-rest-token.1',
+  'betterleaks/val-town-api-token.1',
+  'betterleaks/vercel-ai-gateway-key',
+  'betterleaks/vercel-api-token',
+  'betterleaks/vercel-app-access-token',
+  'betterleaks/vercel-app-refresh-token',
+  'betterleaks/vercel-integration-token',
+  'betterleaks/vercel-personal-access-token',
+  'betterleaks/virustotal-api-key.1',
+  'betterleaks/voyageai-api-key',
+  'betterleaks/vultr-api-key.1',
+  'betterleaks/wakatime-api-key.1',
+  'betterleaks/wakatime-api-key.2',
+  'betterleaks/weatherstack-api-key.1',
+  'betterleaks/weights-and-biases-api-key',
+  'betterleaks/weights-and-biases-api-key-v1',
+  'betterleaks/wiz-client-secret.1',
+  'betterleaks/woocommerce-consumer-secret.1',
+  'betterleaks/workato-developer-api-token.1',
+  'betterleaks/workos-production-api-key.1',
+  'betterleaks/xai-api-key',
+  'betterleaks/xendit-production-api-key.1',
+  'betterleaks/zai-api-key',
+  'betterleaks/zoho-client-secret.1',
+  'betterleaks/zoho-oauth-token.1',
+  'betterleaks/zoho-zapi-key.1',
+  'betterleaks/zuplo-consumer-api-key.1',
   'birth-context',
   'birth-year',
   'booking-context',
   'booking-filename',
+  'card-context',
   'catalog/aws',
   'catalog/azure',
   'catalog/google',
   'cli-password',
   'context',
   'cookie',
+  'credential-pair',
   'databricks',
   'detect-secrets',
   'digitalocean',
@@ -307,6 +512,7 @@ export const builtInRules = Object.freeze([
   'google',
   'grafana',
   'home-path',
+  'honorific-name',
   'huggingface',
   'iban-checksum',
   'identity-number',
@@ -321,8 +527,10 @@ export const builtInRules = Object.freeze([
   'location-gazetteer',
   'location-label',
   'location-residence',
+  'login-call',
   'luhn',
   'mac',
+  'mail-display-name',
   'mailchimp',
   'messenger-handle',
   'messenger-label',
@@ -334,6 +542,7 @@ export const builtInRules = Object.freeze([
   'name-initials',
   'name-title',
   'name-variant',
+  'named-value',
   'national-format',
   'national-phone',
   'ner/offline',
@@ -357,10 +566,13 @@ export const builtInRules = Object.freeze([
   'passport-format',
   'passport-issuer',
   'passport-series',
+  'password-hash',
   'personal-profile-url',
   'phone-context',
+  'po-box',
   'postal-address',
   'postal-code',
+  'postal-label',
   'presidio',
   'private-key',
   'profile-attribute',
@@ -370,12 +582,17 @@ export const builtInRules = Object.freeze([
   'pypi',
   'quoted-entropy',
   'residence-prose',
+  'salutation',
   'school-acronym-context',
   'secretlint',
+  'self-introduction',
   'sendgrid',
   'shopify',
+  'sign-off',
   'slack',
   'square',
+  'ssn-label',
+  'state-zip',
   'strict-age',
   'strict-attribute',
   'strict-date',
@@ -400,12 +617,216 @@ export const credentialRules = new Set([
   'anthropic',
   'authorization',
   'aws',
+  'betterleaks/abuseipdb-api-key.1',
+  'betterleaks/aikido-ci-token',
+  'betterleaks/aikido-client-secret',
+  'betterleaks/airtable-oauth-token',
+  'betterleaks/aiven-auth-token',
+  'betterleaks/alibaba-sts-access-key-secret',
+  'betterleaks/amplitude-secret-key',
+  'betterleaks/apify-api-token',
+  'betterleaks/apollo-api-key.1',
+  'betterleaks/asaas-api-token',
+  'betterleaks/assemblyai-api-key',
+  'betterleaks/auth0-client-secret.1',
+  'betterleaks/azure-app-configuration-connection-string',
+  'betterleaks/azure-servicebus-connection-string',
+  'betterleaks/azure-storage-account-key',
+  'betterleaks/bitbucket-data-center-token',
+  'betterleaks/bitly-access-token',
+  'betterleaks/bitrise-access-token',
+  'betterleaks/box-api-access-token',
+  'betterleaks/brave-search-api-key',
+  'betterleaks/browserstack-access-key.1',
+  'betterleaks/buildkite-service-token',
+  'betterleaks/buildkite-user-access-token',
+  'betterleaks/canadian-digital-service-notify-api-key',
+  'betterleaks/canva-client-secret',
+  'betterleaks/cartesia-api-key.1',
+  'betterleaks/cerebras-api-key',
+  'betterleaks/checkout-secret-key',
+  'betterleaks/circleci-personal-token',
+  'betterleaks/circleci-project-token',
+  'betterleaks/civo-api-key',
+  'betterleaks/clerk-secret-key',
+  'betterleaks/clickup-personal-api-token',
+  'betterleaks/cloudflare-api-key.2',
+  'betterleaks/cloudinary-api-secret',
+  'betterleaks/cloudsmith-api-key',
+  'betterleaks/cockroachlabs-cloud-api-key',
+  'betterleaks/configcat-sdk-key',
+  'betterleaks/configcat-sdk-key-extended',
+  'betterleaks/couchbase-capella-api-key',
+  'betterleaks/coveralls-personal-api-token',
+  'betterleaks/crates-io-api-key',
+  'betterleaks/cursor-api-key',
+  'betterleaks/databento-api-key',
+  'betterleaks/datadog-api-key',
+  'betterleaks/datadog-application-key',
+  'betterleaks/datagov-api-key',
+  'betterleaks/datastax-astra-application-token',
+  'betterleaks/deepgram-api-key',
+  'betterleaks/deepseek-api-key',
+  'betterleaks/deno-account-token',
+  'betterleaks/devcycle-client-sdk-key',
+  'betterleaks/devcycle-mobile-sdk-key',
+  'betterleaks/devcycle-server-sdk-key',
+  'betterleaks/devin-personal-api-key',
+  'betterleaks/devin-service-api-key',
+  'betterleaks/devin-service-user-token',
+  'betterleaks/disqus-api-key',
+  'betterleaks/docker-swarm-join-token',
+  'betterleaks/docker-swarm-unlock-key',
+  'betterleaks/dockerhub-organization-access-token',
+  'betterleaks/dockerhub-personal-access-token',
+  'betterleaks/ebay-client-secret',
+  'betterleaks/elastic-cloud-api-key',
+  'betterleaks/elevenlabs-api-key',
+  'betterleaks/endorlabs-api-key',
+  'betterleaks/endorlabs-api-secret',
+  'betterleaks/etsy-open-api-key',
+  'betterleaks/exoscale-api-key',
+  'betterleaks/fal-api-key.1',
+  'betterleaks/figma-personal-access-header-token',
+  'betterleaks/figma-personal-access-token',
+  'betterleaks/fullstory-api-key',
+  'betterleaks/gcp-application-default-credentials',
+  'betterleaks/gcp-gemini-api',
+  'betterleaks/gcp-service-account',
+  'betterleaks/gitea-access-token',
+  'betterleaks/gitlab-incoming-mail-address-token',
+  'betterleaks/gitlab-pat-routable-versioned',
+  'betterleaks/greptile-api-key',
+  'betterleaks/groq-api-key',
+  'betterleaks/gumroad-access-token',
+  'betterleaks/highnote-secret-live-key',
+  'betterleaks/honeycomb-api-key',
+  'betterleaks/hunter-api-key.1',
+  'betterleaks/ibm-cloud-user-api-key',
+  'betterleaks/influxdb-api-token',
+  'betterleaks/infomaniak-api-token',
+  'betterleaks/instantly-api-key.1',
+  'betterleaks/ionic-personal-access-token',
+  'betterleaks/jumpcloud-api-key',
+  'betterleaks/kagi-api-key',
+  'betterleaks/kimi-api-key',
+  'betterleaks/klaviyo-api-key',
+  'betterleaks/langchain-langsmith-personal-access-token',
+  'betterleaks/langchain-langsmith-service-key',
+  'betterleaks/langfuse-secret-key.1',
+  'betterleaks/lark-app-secret',
+  'betterleaks/lichess-personal-access-token',
+  'betterleaks/lighton-paradigm-api-key',
+  'betterleaks/llama-cloud-api-key.1',
+  'betterleaks/mailersend-api-token',
+  'betterleaks/mem0-api-key.1',
+  'betterleaks/mercury-production-api-token',
+  'betterleaks/mergify-application-key',
+  'betterleaks/midtrans-production-server-client-key',
+  'betterleaks/minimax-api-key',
+  'betterleaks/miro-access-token',
+  'betterleaks/miro-client-secret',
+  'betterleaks/mistral-api-key',
+  'betterleaks/monday-api-token.1',
+  'betterleaks/mongodb-atlas-service-account-secret',
+  'betterleaks/mongodb-connection-string',
+  'betterleaks/mux-access-token-secret.1',
+  'betterleaks/neon-api-key',
+  'betterleaks/ngrok-api-key.1',
+  'betterleaks/nuget-api-key',
+  'betterleaks/nvidia-api-key',
+  'betterleaks/nylas-api-key.1',
+  'betterleaks/ollama-api-key',
+  'betterleaks/onesignal-rich-authentication-token',
+  'betterleaks/onfido-live-api-token-ca',
+  'betterleaks/onfido-live-api-token-eu',
+  'betterleaks/onfido-live-api-token-us',
+  'betterleaks/openrouter-api-key',
+  'betterleaks/openweather-api-key',
+  'betterleaks/opsgenie-api-key.1',
+  'betterleaks/ovh-application-secret',
+  'betterleaks/paddle-live-api-key',
+  'betterleaks/pagerduty-authorization-token.1',
+  'betterleaks/paypal-client-secret.1',
+  'betterleaks/persona-production-api-key',
+  'betterleaks/pinecone-api-key.1',
+  'betterleaks/pinecone-api-key.2',
+  'betterleaks/pinterest-access-token',
+  'betterleaks/plivo-auth-token',
+  'betterleaks/polar-oauth-access-token',
+  'betterleaks/polar-organization-access-token',
+  'betterleaks/polar-personal-access-token',
+  'betterleaks/polymarket-api-key',
+  'betterleaks/polymarket-private-key',
+  'betterleaks/posthog-personal-api-key',
+  'betterleaks/posthog-project-api-key',
+  'betterleaks/postmark-api-token.1',
+  'betterleaks/proof-full-access-api-key',
+  'betterleaks/rainforest-pay-production-api-key',
+  'betterleaks/ramp-client-secret',
+  'betterleaks/razorpay-key-secret.1',
+  'betterleaks/redirect-pizza-api-token.1',
+  'betterleaks/render-api-key',
+  'betterleaks/replicate-api-token',
+  'betterleaks/resend-api-key.1',
+  'betterleaks/retell-api-key.1',
+  'betterleaks/rootly-api-key.1',
+  'betterleaks/runpod-api-key.1',
+  'betterleaks/salesforce-access-token.1',
+  'betterleaks/samsara-api-token.1',
+  'betterleaks/scaleway-secret-key',
+  'betterleaks/scalr-api-access-token.1',
+  'betterleaks/segment-public-api-token.1',
+  'betterleaks/slack-session-cookie',
+  'betterleaks/slack-session-token',
+  'betterleaks/snowflake-programmatic-access-token.1',
+  'betterleaks/sslmate-api-key.1',
+  'betterleaks/stability-ai-api-key',
+  'betterleaks/supabase-management-token',
+  'betterleaks/supabase-project-api-key',
+  'betterleaks/tableau-personal-access-token.1',
+  'betterleaks/tailscale-api-key.1',
+  'betterleaks/telnyx-api-v2-key.1',
+  'betterleaks/temporal-cloud-api-key.1',
+  'betterleaks/thunderstore-api-token.1',
+  'betterleaks/togetherai-api-key',
+  'betterleaks/unkey-root-key.1',
+  'betterleaks/upcloud-api-token',
+  'betterleaks/upstage-api-key',
+  'betterleaks/upstash-redis-rest-token.1',
+  'betterleaks/val-town-api-token.1',
+  'betterleaks/vercel-ai-gateway-key',
+  'betterleaks/vercel-api-token',
+  'betterleaks/vercel-app-access-token',
+  'betterleaks/vercel-app-refresh-token',
+  'betterleaks/vercel-integration-token',
+  'betterleaks/vercel-personal-access-token',
+  'betterleaks/virustotal-api-key.1',
+  'betterleaks/voyageai-api-key',
+  'betterleaks/vultr-api-key.1',
+  'betterleaks/wakatime-api-key.1',
+  'betterleaks/wakatime-api-key.2',
+  'betterleaks/weatherstack-api-key.1',
+  'betterleaks/weights-and-biases-api-key',
+  'betterleaks/weights-and-biases-api-key-v1',
+  'betterleaks/wiz-client-secret.1',
+  'betterleaks/woocommerce-consumer-secret.1',
+  'betterleaks/workato-developer-api-token.1',
+  'betterleaks/workos-production-api-key.1',
+  'betterleaks/xai-api-key',
+  'betterleaks/xendit-production-api-key.1',
+  'betterleaks/zai-api-key',
+  'betterleaks/zoho-client-secret.1',
+  'betterleaks/zoho-oauth-token.1',
+  'betterleaks/zoho-zapi-key.1',
+  'betterleaks/zuplo-consumer-api-key.1',
   'catalog/aws',
   'catalog/azure',
   'catalog/google',
   'cli-password',
   'context',
   'cookie',
+  'credential-pair',
   'databricks',
   'digitalocean',
   'discord',
@@ -645,12 +1066,15 @@ export const credentialRules = new Set([
   'jwt',
   'known-secret',
   'linear',
+  'login-call',
   'mailchimp',
+  'named-value',
   'netrc',
   'notion',
   'npm',
   'nuget',
   'openai',
+  'password-hash',
   'private-key',
   'putty-private-key',
   'pypi',

package/src/sanitizer.js

@@ -28,6 +28,9 @@ import {
 } from './transforms.js';
 import { fakeIdentityValue, isIdentityType } from './identity.js';
 import { rejectRestoreMap } from './restore-map.js';
+import { allowListed, validateAllowList } from './allow-list.js';
+import { templatedCredential } from './credentials.js';
+import { builtInRules } from './rule-catalog.js';
 import {
   initializePlaceholders,
   placeholderKnown,
@@ -99,6 +102,9 @@ const optionNames = new Set([
   'strict',
   'exactFields',
   'allowedFields',
+  'minConfidenceByType',
+  'allowList',
+  'inlineAllow',
 ]);
 
 export function applyProfile(options = {}) {
@@ -225,6 +231,7 @@ export function validateOptions(options = {}) {
     throw failure('ERR_CONFIG');
   }
   validateCollections(options);
+  validateAllowList(options);
   validateDetectors(options.detectors);
   validatePolicyControls(options);
   compiledVocabulary(options.vocabulary);
@@ -255,6 +262,22 @@ function validateConfidence(options) {
   ) {
     throw failure('ERR_CONFIG');
   }
+  const byType = options.minConfidenceByType;
+  if (
+    byType !== undefined &&
+    (!byType ||
+      typeof byType !== 'object' ||
+      Array.isArray(byType) ||
+      !Object.entries(byType).every(
+        ([type, value]) =>
+          validType(type) &&
+          typeof value === 'number' &&
+          value >= 0 &&
+          value <= 1
+      ))
+  ) {
+    throw failure('ERR_CONFIG');
+  }
 }
 
 function validatePolicy(options) {
@@ -518,12 +541,34 @@ function inspectText(text, options = {}) {
   return reviewFindings(text, findings, options);
 }
 
+// Allow-listed values and built-in credential matches whose value is only a
+// template or mask (`${PASSWORD}`, `<token>`, `****`) are not findings.
+function policyKept(text, finding, options) {
+  if (allowListed(text, finding, options)) {
+    return false;
+  }
+  if (builtInRule(finding) && templatedCredential(text, finding)) {
+    options.debug?.({ event: 'template-value', rule: finding.rule });
+    return false;
+  }
+  return true;
+}
+
+// Custom detectors keep their findings: they may flag placeholder shapes on
+// purpose, and the residual check must still see them.
+const builtInRuleIds = new Set(builtInRules);
+const builtInRule = (finding) =>
+  builtInRuleIds.has(finding.rule) ||
+  finding.rule === 'secretlint' ||
+  finding.rule.startsWith('gitleaks/');
+
 // Reapply policy to the native/required-engine union without rescanning text.
 export function reviewFindings(text, findings, options) {
   findings = placeholderNameFindings(text, findings, options);
   if (findings.length > (options.maxFindings ?? 100000)) {
     throw failure('ERR_LIMIT');
   }
+  findings = findings.filter((f) => policyKept(text, f, options));
   const unique = new Map();
   const exempt = findings.filter((f) =>
     allowed(text, f, options.publicEntities ?? [])
@@ -565,9 +610,9 @@ function coveredByPublic(finding, exempt) {
 }
 
 export function inspectFindingsOnly(text, findings, options) {
-  const all = [...findings, ...(options.findings ?? [])].map((f) =>
-    sanitizeFinding(f, text.length)
-  );
+  const all = [...findings, ...(options.findings ?? [])]
+    .map((f) => sanitizeFinding(f, text.length))
+    .filter((f) => policyKept(text, f, options));
   if (all.length > (options.maxFindings ?? 100000)) {
     throw failure('ERR_LIMIT');
   }