@link-foundation/sensitive-data-sanitizer 0.19.2 → 0.20.0

package/src/sarif.js

@@ -0,0 +1,127 @@
+// SARIF 2.1.0 export for code-scanning dashboards (GitHub, GitLab, Azure
+// DevOps), matching the reporting formats of Gitleaks/Betterleaks, TruffleHog,
+// detect-secrets and Kingfisher. Only metadata is emitted: rule, type,
+// category, confidence and location. Matched values are never included.
+const schema = 'https://json.schemastore.org/sarif-2.1.0.json';
+const levels = { credential: 'error', personal: 'warning' };
+
+function artifactUri(path) {
+  if (path === '-' || path === undefined) {
+    return 'stdin';
+  }
+  return encodeURI(String(path).replaceAll('\\', '/'));
+}
+
+function region(finding) {
+  const result = {
+    charOffset: finding.start,
+    charLength: finding.end - finding.start,
+  };
+  if (Number.isSafeInteger(finding.line)) {
+    result.startLine = finding.line;
+  }
+  if (Number.isSafeInteger(finding.column)) {
+    result.startColumn = finding.column;
+  }
+  return result;
+}
+
+function sarifResult(finding, uri, ruleIndex) {
+  return {
+    ruleId: finding.rule,
+    ruleIndex,
+    level: levels[finding.category] ?? 'note',
+    message: {
+      text: `${finding.type} ${finding.category === 'credential' ? 'credential' : 'personal data'} detected`,
+    },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri },
+          region: region(finding),
+        },
+      },
+    ],
+    properties: {
+      type: finding.type,
+      category: finding.category,
+      confidence: finding.confidence,
+    },
+  };
+}
+
+/**
+ * Converts scan results to a SARIF 2.1.0 log. Accepts the CLI scan report
+ * (`{complete, results: [{path, findings}], skipped}`), an array of
+ * `{path, findings}` entries, or a findings array for one artifact. Values
+ * are never copied into the log; paths should already be sanitized.
+ */
+function entriesOf(report, path) {
+  if (!Array.isArray(report)) {
+    return report?.results ?? [];
+  }
+  return report.every((item) => Array.isArray(item?.findings))
+    ? report
+    : [{ path, findings: report }];
+}
+
+export function toSarif(report, { version, path = '-' } = {}) {
+  const entries = entriesOf(report, path);
+  const rules = [],
+    indexes = new Map(),
+    results = [];
+  for (const entry of entries) {
+    const uri = artifactUri(entry.path);
+    for (const finding of entry.findings) {
+      if (!indexes.has(finding.rule)) {
+        indexes.set(finding.rule, rules.length);
+        rules.push({
+          id: finding.rule,
+          name: finding.rule,
+          shortDescription: { text: `${finding.type} (${finding.category})` },
+          defaultConfiguration: {
+            level: levels[finding.category] ?? 'note',
+          },
+          properties: { tags: [finding.category, finding.type] },
+        });
+      }
+      results.push(sarifResult(finding, uri, indexes.get(finding.rule)));
+    }
+  }
+  const skipped = report?.skipped ?? [];
+  return {
+    $schema: schema,
+    version: '2.1.0',
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: 'sensitive-data-sanitizer',
+            informationUri:
+              'https://github.com/link-foundation/sensitive-data-sanitizer',
+            ...(version ? { version } : {}),
+            rules,
+          },
+        },
+        invocations: [
+          {
+            executionSuccessful: report?.complete ?? true,
+            toolExecutionNotifications: skipped.map((item) => ({
+              level: 'warning',
+              message: { text: `Skipped: ${item.reason}` },
+              locations: [
+                {
+                  physicalLocation: {
+                    artifactLocation: { uri: artifactUri(item.path) },
+                  },
+                },
+              ],
+            })),
+          },
+        ],
+        columnKind: 'utf16CodeUnits',
+        results,
+      },
+    ],
+  };
+}

package/src/strict-attributes.js

@@ -0,0 +1,71 @@
+import { collectMatches } from './detection.js';
+
+const attributes =
+  /(?<![\p{L}\p{N}_])(?:женщин[аыуеой]{1,2}|мужчин[аыуеой]{1,2}|замужем|женат(?:а|ы)?|(?:один|одна|двое|трое|четверо|пятеро|\d{1,2})[ \t]+(?:детей|реб[её]нок|реб[её]нка)|русск(?:ая|ий|ого|ой|ие)|татар(?:ин|ка|ы)|православн(?:ый|ая|ого|ой)|мусульман(?:ин|ка)|инвалидност[ьи](?:[ \t]+\d[ \t]+группы)?|беременн(?:а|ая|ость)|судимость(?:[ \t]+погашена)?|член[ \t]+партии|woman|women|male|female|married|divorced|pregnant|pregnancy|disability|christian|muslim|jewish|orthodox|hispanic|criminal[ \t]+record|party[ \t]+member|(?:one|two|three|\d{1,2})[ \t]+children)(?![\p{L}\p{N}_])/giu;
+const additionalAttributes =
+  /(?<![\p{L}\p{N}_])(?:диабет(?:ом|а|у|е)?|ВИЧ(?:-положительн(?:ый|ая|ого|ой))?|болен|больна|больны|католик(?:ом|а|и)?|католичк(?:а|ой|и)|буддист(?:ка|кой|ом|а|ы)?|атеист(?:ка|кой|ом|а|ы)?|украин(?:ец|ка|цы|цем|кой)|белорус(?:ка|кой|ом|а|ы)?|несудим(?:а|ы)?|судим(?:а|ы)?|член[ \t]+политической[ \t]+партии|холост(?:а|ы)?|развед[её]н(?:а|ы)?|в[ \t]+разводе|diabetes|diabetic|HIV(?:[ \t-]+positive)?|cancer|buddhist|catholic|atheist|ukrainian|belarusian|previous[ \t]+conviction|member[ \t]+of[ \t]+(?:a[ \t]+)?(?:political[ \t]+)?party|unmarried|widowed)(?![\p{L}\p{N}_])/giu;
+
+// Bounded suffixes cover Russian cases, plurals and adjectival forms without
+// turning a stem into an unbounded substring search. Category cues below cover
+// unfamiliar diagnoses, nationalities and religions outside this lexicon.
+const categoryForms =
+  /(?<![\p{L}\p{N}_])(?:(?:диабет|католик|католич|буддист|атеист|белорус|православн|беременн|судим)[\p{L}]{0,8}|татар(?:ин(?:а|у|ом|е)?|к[аиуе]|кой|ы|ам|ами|ах)?|мусульман(?:ин(?:а|у|ом|е)?|к[аиуе]|кой|е|ам|ами|ах)?|украин(?:ец|ца|цу|цем|це|цы|цев|цам|цами|цах|к[аиуе]|кой)|инвалид(?:а|у|ом|е|ы|ов|ам|ами|ах|к[аиу]|кой)?|армян(?:ин|ина|ину|ином|ине|е|ам|ами|ах|ка|ки|ке|ку|кой)|евре(?:й|я|ю|ем|и|ев|ям|ями|ях|йк[аиуе]|йкой)|казах(?:а|у|ом|е|и|ов|ам|ами|ах|к[аиуе]|кой)?|христиан(?:ин|ина|ину|ином|ине|е|ам|ами|ах|к[аиуе]|кой)|иуде(?:й|я|ю|ем|и|ев|ям|ями|ях|йк[аиуе]|йкой)|ислам[\p{L}]{0,5}|эпилепси[\p{L}]{1,5}|астм[\p{L}]{1,5}|онкологи[\p{L}]{1,5}|туберкул[её]з[\p{L}]{0,5}|психиатр[\p{L}]{0,6}|депресси[\p{L}]{1,5}|гепатит[\p{L}]{0,5}|гомосексуал[\p{L}]{0,7}|лесбиян[\p{L}]{1,5}|ге(?:й|я|ю|ем|и|ев|ям|ями|ях)|нетрадиционн[\p{L}]{2,3}[ \t]+ориентаци[\p{L}]{1,3}|отбыва(?:л[аи]?|ет|ют|вш[\p{L}]{2,3})[ \t]+наказани[\p{L}]{1,3}|ВИЧ-инфицирован[\p{L}]{0,4}|epilepsy|asthma|tuberculosis|hepatitis|depression|gay|lesbian|homosexual|bisexual|armenian)(?![\p{L}\p{N}_])/giu;
+const categoryCue =
+  /(?<![\p{L}\p{N}_])(?:по[ \t]+национальности|национальность|этничность|вероисповедание|религия|диагноз|исповеду(?:ет|ют|ю|ешь)|боле(?:ет|ют|ю|ешь)|страда(?:ет|ют|ю|ешь)[ \t]+от|на[ \t]+уч[её]те[ \t]+у|diagnosed[ \t]+with|suffers[ \t]+from|nationality|ethnicity|religion|diagnosis)(?:["']?[ \t]*[:=][ \t]*|[ \t]+)["']?([\p{L}][\p{L}\p{M}-]{0,63})(?![\p{L}\p{M}\p{N}_])/giu;
+const ambiguous =
+  /(?<![\p{L}\p{N}_])(?:disabled|single|man|men|russian|asian)(?![\p{L}\p{N}_])/giu;
+
+function personalContext(text, match) {
+  const prefix = text.slice(Math.max(0, match.index - 128), match.index);
+  const suffix = text.slice(
+    match.index + match[0].length,
+    match.index + match[0].length + 64
+  );
+  // These continuations remain technical even after a pronoun ("it is a
+  // single-flight lock"). No document-wide cue can authorize another clause.
+  if (
+    /^(?:-flight\b|[ \t]+(?:page|pages|run|worker|thread|lock|region|endpoint|locale|module|feature|flag)\b)/iu.test(
+      suffix
+    )
+  ) {
+    return false;
+  }
+  return (
+    /(?<![\p{L}\p{N}_])(?:i|he|she|we|they|candidate|applicant|patient|person|employee)(?:[ \t]+(?:am|is|are|was|were|identifies[ \t]+as))?(?:[ \t]+(?:a|an))?[ \t]+$/iu.test(
+      prefix
+    ) ||
+    /(?<![\p{L}\p{N}_])(?:gender|sex|nationality|ethnicity|marital[ \t_-]*status|disability)(?:["'][ \t]*)?[ \t]*[:=][ \t]*["']?$/iu.test(
+      prefix
+    ) ||
+    /^[ \t]+(?:candidate|applicant|patient|person|people|employee)(?![\p{L}\p{N}_])/iu.test(
+      suffix
+    )
+  );
+}
+
+export function detectStrictAttributes(text, emit, options) {
+  let detected = 0,
+    suppressed = 0;
+  const details = {
+    type: 'PERSONAL_ATTRIBUTE',
+    rule: 'strict-attribute',
+    category: 'personal',
+    confidence: 0.9,
+  };
+  const report = (finding) => {
+    detected++;
+    emit(finding);
+  };
+  for (const pattern of [attributes, additionalAttributes, categoryForms]) {
+    collectMatches(text, pattern, report, details);
+  }
+  collectMatches(text, categoryCue, report, details, 1);
+  collectMatches(text, ambiguous, report, details, 0, (_value, match) => {
+    const accepted = personalContext(text, match);
+    if (!accepted) {
+      suppressed++;
+    }
+    return accepted;
+  });
+  options.debug?.({ event: 'strict-attributes', detected, suppressed });
+}

package/src/strict.js

@@ -3,12 +3,9 @@ import { months } from './personal-context.js';
 import { isDocumentTechnology } from './document-experience.js';
 import { placeholderValues } from './placeholders.js';
 import { generatedValues } from './fake.js';
+import { detectStrictAttributes } from './strict-attributes.js';
 
 const boundary = '[\\p{L}\\p{N}_]';
-const attributes =
-  /(?<![\p{L}\p{N}_])(?:женщин[аыуеой]{1,2}|мужчин[аыуеой]{1,2}|замужем|женат(?:а|ы)?|(?:один|одна|двое|трое|четверо|пятеро|\d{1,2})[ \t]+(?:детей|реб[её]нок|реб[её]нка)|русск(?:ая|ий|ого|ой|ие)|татар(?:ин|ка|ы)|православн(?:ый|ая|ого|ой)|мусульман(?:ин|ка)|инвалидност[ьи](?:[ \t]+\d[ \t]+группы)?|беременн(?:а|ая|ость)|судимость(?:[ \t]+погашена)?|член[ \t]+партии|woman|women|man|men|male|female|married|divorced|pregnant|pregnancy|disabled|disability|christian|muslim|jewish|orthodox|russian|hispanic|asian|criminal[ \t]+record|party[ \t]+member|(?:one|two|three|\d{1,2})[ \t]+children)(?![\p{L}\p{N}_])/giu;
-const additionalAttributes =
-  /(?<![\p{L}\p{N}_])(?:диабет(?:ом|а|у|е)?|ВИЧ(?:-положительн(?:ый|ая|ого|ой))?|болен|больна|больны|католик(?:ом|а|и)?|католичк(?:а|ой|и)|буддист(?:ка|кой|ом|а|ы)?|атеист(?:ка|кой|ом|а|ы)?|украин(?:ец|ка|цы|цем|кой)|белорус(?:ка|кой|ом|а|ы)?|несудим(?:а|ы)?|судим(?:а|ы)?|член[ \t]+политической[ \t]+партии|холост(?:а|ы)?|развед[её]н(?:а|ы)?|в[ \t]+разводе|diabetes|diabetic|HIV(?:[ \t-]+positive)?|cancer|buddhist|catholic|atheist|ukrainian|belarusian|previous[ \t]+conviction|member[ \t]+of[ \t]+(?:a[ \t]+)?(?:political[ \t]+)?party|single|unmarried|widowed)(?![\p{L}\p{N}_])/giu;
 
 function isDuration(text, match, replacements) {
   // Keep cues on the same clause; an age on the next line is independent.
@@ -57,14 +54,7 @@ export function detectStrict(text, emit, options) {
   if (!options.strict) {
     return;
   }
-  for (const pattern of [attributes, additionalAttributes]) {
-    collectMatches(text, pattern, emit, {
-      type: 'PERSONAL_ATTRIBUTE',
-      rule: 'strict-attribute',
-      category: 'personal',
-      confidence: 0.9,
-    });
-  }
+  detectStrictAttributes(text, emit, options);
   const date = new RegExp(
     `(?<!${boundary})(?:\\d{4}-\\d{2}-\\d{2}|\\d{1,2}[./]\\d{1,2}[./]\\d{4}|\\d{1,2}[ \\t]+(?:${months})[ \\t]+\\d{4})(?!${boundary}|[Tt]\\d)`,
     'giu'

package/src/token-checksum.js

@@ -0,0 +1,49 @@
+// Offline structural check for prefixed tokens that end in a checksum.
+// GitHub (ghp_, gho_, ghu_, ghs_, ghr_) and npm (npm_) tokens append six
+// base62 characters: CRC32 (IEEE) of the characters after the first `_`.
+// A valid checksum raises confidence; an invalid one never removes a finding
+// because truncated or retyped tokens still need redaction.
+const BASE62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+const CHECKSUM_TOKEN = /^(?:gh[opsur]|npm)_([A-Za-z0-9]{30})([A-Za-z0-9]{6})$/;
+
+let table;
+function crcTable() {
+  table ??= Array.from({ length: 256 }, (_, n) => {
+    let c = n;
+    for (let k = 0; k < 8; k++) {
+      c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+    }
+    return c >>> 0;
+  });
+  return table;
+}
+
+export function crc32(text) {
+  let crc = 0xffffffff;
+  for (let i = 0; i < text.length; i++) {
+    crc = crcTable()[(crc ^ text.charCodeAt(i)) & 0xff] ^ (crc >>> 8);
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+export function base62(value, width = 6) {
+  let out = '';
+  for (let i = 0; i < width; i++) {
+    out = BASE62[value % 62] + out;
+    value = Math.floor(value / 62);
+  }
+  return out;
+}
+
+// Builds a checksum-valid token from a prefix (including `_`) and a
+// 30-character body, so tests and examples need no stored token literals.
+export function tokenWithChecksum(prefix, body) {
+  return `${prefix}${body}${base62(crc32(body))}`;
+}
+
+// true: checksum matches; false: format matches but checksum does not;
+// undefined: the value is not a checksummed token format.
+export function tokenChecksum(value) {
+  const match = CHECKSUM_TOKEN.exec(value);
+  return match ? base62(crc32(match[1])) === match[2] : undefined;
+}

package/src/transforms.js

@@ -5,6 +5,7 @@ import { encodedValue, encodeRun, decodedRuns } from './encoded.js';
 import { isIdentityType } from './identity.js';
 import { validatePlaceholder, placeholderReplacement } from './placeholders.js';
 import { projectText } from './projection.js';
+import { encryptValue } from './encrypt.js';
 
 const modes = new Set([
   'redact',
@@ -16,6 +17,7 @@ const modes = new Set([
   'date-shift',
   'bucket',
   'placeholder',
+  'encrypt',
 ]);
 export function validateTransforms(options) {
   if (
@@ -86,16 +88,10 @@ function validateTransform(transform) {
       Number.isSafeInteger(transform.days) &&
       Math.abs(transform.days) <= 365000,
     bucket: () => positiveInteger(transform.size),
-    mask: () =>
-      [transform.keepStart ?? 0, transform.keepEnd ?? 0].every(
-        (value) => Number.isSafeInteger(value) && value >= 0
-      ) &&
-      (transform.minLength === undefined ||
-        positiveInteger(transform.minLength)) &&
-      (transform.marker === undefined ||
-        (typeof transform.marker === 'string' &&
-          transform.marker.length > 0 &&
-          transform.marker.length <= 64)),
+    mask: () => validMask(transform),
+    encrypt: () =>
+      typeof transform.key === 'string' &&
+      Buffer.byteLength(transform.key) >= 16,
   };
   if (checks[transform.mode] && !checks[transform.mode]()) {
     throw failure('ERR_CONFIG');
@@ -141,16 +137,112 @@ function shiftedDate(value, days) {
     ? REDACTED
     : date.toISOString().slice(0, 10);
 }
+// Google charactersToIgnore/commonCharactersToIgnore and Presidio-style
+// character classes that a mask may leave visible.
+const maskClasses = {
+  digits: /\p{Nd}/u,
+  upper: /\p{Lu}/u,
+  lower: /\p{Ll}/u,
+  punctuation: /[\p{P}\p{S}]/u,
+  whitespace: /\s/u,
+};
+const maskTuning = ['char', 'ignore', 'ignoreClasses', 'count', 'fromEnd'];
+const unset = (value, test) => value === undefined || test(value);
+const maskChecks = [
+  (t) =>
+    [t.keepStart ?? 0, t.keepEnd ?? 0].every(
+      (value) => Number.isSafeInteger(value) && value >= 0
+    ),
+  (t) => unset(t.minLength, positiveInteger),
+  (t) =>
+    unset(
+      t.marker,
+      (marker) =>
+        !maskTuning.some((key) => t[key] !== undefined) &&
+        typeof marker === 'string' &&
+        marker.length > 0 &&
+        marker.length <= 64
+    ),
+  (t) =>
+    unset(
+      t.char,
+      (char) => typeof char === 'string' && Array.from(char).length === 1
+    ),
+  (t) =>
+    unset(
+      t.ignore,
+      (ignore) =>
+        typeof ignore === 'string' && ignore.length > 0 && ignore.length <= 256
+    ),
+  (t) =>
+    unset(
+      t.ignoreClasses,
+      (names) =>
+        Array.isArray(names) &&
+        names.every((name) => Object.hasOwn(maskClasses, name))
+    ),
+  (t) => unset(t.count, positiveInteger),
+  (t) => unset(t.fromEnd, (value) => typeof value === 'boolean'),
+];
+function validMask(transform) {
+  return maskChecks.every((check) => check(transform));
+}
+// Indexes of the characters a mask replaces, after ignored characters, the
+// direction and the count limit are applied.
+function maskPositions(chars, start, end, transform) {
+  const ignored = (char) =>
+    Boolean(transform.ignore?.includes(char)) ||
+    (transform.ignoreClasses ?? []).some((name) =>
+      maskClasses[name].test(char)
+    );
+  const positions = [];
+  for (let i = start; i < chars.length - end; i++) {
+    if (!ignored(chars[i])) {
+      positions.push(i);
+    }
+  }
+  if (transform.fromEnd) {
+    positions.reverse();
+  }
+  return transform.count === undefined
+    ? positions
+    : positions.slice(0, transform.count);
+}
 function masked(value, finding, transform) {
   const chars = Array.from(value),
     start = transform.keepStart ?? 0,
     end = transform.keepEnd ?? 0;
-  return chars.length <
-    (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
+  if (
+    chars.length <
+      (transform.minLength ?? (isIdentityType(finding.type) ? 5 : 0)) ||
     start + end >= chars.length
-    ? REDACTED
-    : `${chars.slice(0, start).join('')}${transform.marker ?? '*'.repeat(chars.length - start - end)}${end ? chars.slice(-end).join('') : ''}`;
+  ) {
+    return REDACTED;
+  }
+  if (transform.marker !== undefined) {
+    return `${chars.slice(0, start).join('')}${transform.marker}${end ? chars.slice(-end).join('') : ''}`;
+  }
+  const positions = maskPositions(chars, start, end, transform);
+  if (!positions.length) {
+    return REDACTED;
+  }
+  for (const i of positions) {
+    chars[i] = transform.char ?? '*';
+  }
+  return chars.join('');
 }
+// Modes that apply to personal data only; credentials are always redacted.
+const personalModes = {
+  mask: masked,
+  encrypt: (value, finding, transform) =>
+    encryptValue(value, finding.type, transform.key),
+  pseudonym: (value, finding, transform) =>
+    `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`,
+  'format-preserving': (value, finding, transform) =>
+    formatPseudonym(value, finding.type, transform.key),
+  'date-shift': (value, finding, transform) =>
+    shiftedDate(value, transform.days),
+};
 function transformed(value, finding, transform, options) {
   if (typeof transform === 'function') {
     const result = transform(Object.freeze({ ...finding, value }));
@@ -175,17 +267,8 @@ function transformed(value, finding, transform, options) {
   if (finding.category === 'credential') {
     return REDACTED;
   }
-  if (transform.mode === 'mask') {
-    return masked(value, finding, transform);
-  }
-  if (transform.mode === 'pseudonym') {
-    return `[PSEUDONYM_${keyed(value, finding.type, transform.key).toString('hex').slice(0, 24)}]`;
-  }
-  if (transform.mode === 'format-preserving') {
-    return formatPseudonym(value, finding.type, transform.key);
-  }
-  if (transform.mode === 'date-shift') {
-    return shiftedDate(value, transform.days);
+  if (Object.hasOwn(personalModes, transform.mode)) {
+    return personalModes[transform.mode](value, finding, transform);
   }
   const number = Number(value);
   if (!Number.isSafeInteger(number)) {

package/src/vendor/betterleaks/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/src/vendor/betterleaks/provenance.json

@@ -0,0 +1,11 @@
+{
+  "version": "v1.10.0",
+  "source": "https://raw.githubusercontent.com/betterleaks/betterleaks/v1.10.0/config/betterleaks.toml",
+  "sha256": "3489c5044d3a6e5abfd17a381e9de188b6f4fdee49f7f44bae89e2f8932464fa",
+  "rules": 203,
+  "files": 6,
+  "partialFilters": [
+    "box-api-access-token"
+  ],
+  "policy": "Only rule ids absent from the vendored Gitleaks set; original RE2 patterns; entropy and secret-only matchesAny/containsAny filters; no tokenRatio, nearby-line evidence, validation or skipReport components."
+}