@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.20.0

package/docs/RULES.md

@@ -12,16 +12,221 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `anthropic`
 - `authorization`
 - `aws`
+- `betterleaks/abuseipdb-api-key.1`
+- `betterleaks/aikido-ci-token`
+- `betterleaks/aikido-client-secret`
+- `betterleaks/airtable-oauth-token`
+- `betterleaks/aiven-auth-token`
+- `betterleaks/alibaba-sts-access-key-secret`
+- `betterleaks/amplitude-secret-key`
+- `betterleaks/apify-api-token`
+- `betterleaks/apollo-api-key.1`
+- `betterleaks/asaas-api-token`
+- `betterleaks/assemblyai-api-key`
+- `betterleaks/auth0-client-secret.1`
+- `betterleaks/azure-app-configuration-connection-string`
+- `betterleaks/azure-servicebus-connection-string`
+- `betterleaks/azure-storage-account-key`
+- `betterleaks/bitbucket-data-center-token`
+- `betterleaks/bitly-access-token`
+- `betterleaks/bitrise-access-token`
+- `betterleaks/box-api-access-token`
+- `betterleaks/brave-search-api-key`
+- `betterleaks/browserstack-access-key.1`
+- `betterleaks/buildkite-service-token`
+- `betterleaks/buildkite-user-access-token`
+- `betterleaks/canadian-digital-service-notify-api-key`
+- `betterleaks/canva-client-secret`
+- `betterleaks/cartesia-api-key.1`
+- `betterleaks/cerebras-api-key`
+- `betterleaks/checkout-secret-key`
+- `betterleaks/circleci-personal-token`
+- `betterleaks/circleci-project-token`
+- `betterleaks/civo-api-key`
+- `betterleaks/clerk-secret-key`
+- `betterleaks/clickup-personal-api-token`
+- `betterleaks/cloudflare-api-key.2`
+- `betterleaks/cloudinary-api-secret`
+- `betterleaks/cloudsmith-api-key`
+- `betterleaks/cockroachlabs-cloud-api-key`
+- `betterleaks/configcat-sdk-key`
+- `betterleaks/configcat-sdk-key-extended`
+- `betterleaks/couchbase-capella-api-key`
+- `betterleaks/coveralls-personal-api-token`
+- `betterleaks/crates-io-api-key`
+- `betterleaks/cursor-api-key`
+- `betterleaks/databento-api-key`
+- `betterleaks/datadog-api-key`
+- `betterleaks/datadog-application-key`
+- `betterleaks/datagov-api-key`
+- `betterleaks/datastax-astra-application-token`
+- `betterleaks/deepgram-api-key`
+- `betterleaks/deepseek-api-key`
+- `betterleaks/deno-account-token`
+- `betterleaks/devcycle-client-sdk-key`
+- `betterleaks/devcycle-mobile-sdk-key`
+- `betterleaks/devcycle-server-sdk-key`
+- `betterleaks/devin-personal-api-key`
+- `betterleaks/devin-service-api-key`
+- `betterleaks/devin-service-user-token`
+- `betterleaks/disqus-api-key`
+- `betterleaks/docker-swarm-join-token`
+- `betterleaks/docker-swarm-unlock-key`
+- `betterleaks/dockerhub-organization-access-token`
+- `betterleaks/dockerhub-personal-access-token`
+- `betterleaks/ebay-client-secret`
+- `betterleaks/elastic-cloud-api-key`
+- `betterleaks/elevenlabs-api-key`
+- `betterleaks/endorlabs-api-key`
+- `betterleaks/endorlabs-api-secret`
+- `betterleaks/etsy-open-api-key`
+- `betterleaks/exoscale-api-key`
+- `betterleaks/fal-api-key.1`
+- `betterleaks/figma-personal-access-header-token`
+- `betterleaks/figma-personal-access-token`
+- `betterleaks/fullstory-api-key`
+- `betterleaks/gcp-application-default-credentials`
+- `betterleaks/gcp-gemini-api`
+- `betterleaks/gcp-service-account`
+- `betterleaks/gitea-access-token`
+- `betterleaks/gitlab-incoming-mail-address-token`
+- `betterleaks/gitlab-pat-routable-versioned`
+- `betterleaks/greptile-api-key`
+- `betterleaks/groq-api-key`
+- `betterleaks/gumroad-access-token`
+- `betterleaks/highnote-secret-live-key`
+- `betterleaks/honeycomb-api-key`
+- `betterleaks/hunter-api-key.1`
+- `betterleaks/ibm-cloud-user-api-key`
+- `betterleaks/influxdb-api-token`
+- `betterleaks/infomaniak-api-token`
+- `betterleaks/instantly-api-key.1`
+- `betterleaks/ionic-personal-access-token`
+- `betterleaks/jumpcloud-api-key`
+- `betterleaks/kagi-api-key`
+- `betterleaks/kimi-api-key`
+- `betterleaks/klaviyo-api-key`
+- `betterleaks/langchain-langsmith-personal-access-token`
+- `betterleaks/langchain-langsmith-service-key`
+- `betterleaks/langfuse-secret-key.1`
+- `betterleaks/lark-app-secret`
+- `betterleaks/lichess-personal-access-token`
+- `betterleaks/lighton-paradigm-api-key`
+- `betterleaks/llama-cloud-api-key.1`
+- `betterleaks/mailersend-api-token`
+- `betterleaks/mem0-api-key.1`
+- `betterleaks/mercury-production-api-token`
+- `betterleaks/mergify-application-key`
+- `betterleaks/midtrans-production-server-client-key`
+- `betterleaks/minimax-api-key`
+- `betterleaks/miro-access-token`
+- `betterleaks/miro-client-secret`
+- `betterleaks/mistral-api-key`
+- `betterleaks/monday-api-token.1`
+- `betterleaks/mongodb-atlas-service-account-secret`
+- `betterleaks/mongodb-connection-string`
+- `betterleaks/mux-access-token-secret.1`
+- `betterleaks/neon-api-key`
+- `betterleaks/ngrok-api-key.1`
+- `betterleaks/nuget-api-key`
+- `betterleaks/nvidia-api-key`
+- `betterleaks/nylas-api-key.1`
+- `betterleaks/ollama-api-key`
+- `betterleaks/onesignal-rich-authentication-token`
+- `betterleaks/onfido-live-api-token-ca`
+- `betterleaks/onfido-live-api-token-eu`
+- `betterleaks/onfido-live-api-token-us`
+- `betterleaks/openrouter-api-key`
+- `betterleaks/openweather-api-key`
+- `betterleaks/opsgenie-api-key.1`
+- `betterleaks/ovh-application-secret`
+- `betterleaks/paddle-live-api-key`
+- `betterleaks/pagerduty-authorization-token.1`
+- `betterleaks/paypal-client-secret.1`
+- `betterleaks/persona-production-api-key`
+- `betterleaks/pinecone-api-key.1`
+- `betterleaks/pinecone-api-key.2`
+- `betterleaks/pinterest-access-token`
+- `betterleaks/plivo-auth-token`
+- `betterleaks/polar-oauth-access-token`
+- `betterleaks/polar-organization-access-token`
+- `betterleaks/polar-personal-access-token`
+- `betterleaks/polymarket-api-key`
+- `betterleaks/polymarket-private-key`
+- `betterleaks/posthog-personal-api-key`
+- `betterleaks/posthog-project-api-key`
+- `betterleaks/postmark-api-token.1`
+- `betterleaks/proof-full-access-api-key`
+- `betterleaks/rainforest-pay-production-api-key`
+- `betterleaks/ramp-client-secret`
+- `betterleaks/razorpay-key-secret.1`
+- `betterleaks/redirect-pizza-api-token.1`
+- `betterleaks/render-api-key`
+- `betterleaks/replicate-api-token`
+- `betterleaks/resend-api-key.1`
+- `betterleaks/retell-api-key.1`
+- `betterleaks/rootly-api-key.1`
+- `betterleaks/runpod-api-key.1`
+- `betterleaks/salesforce-access-token.1`
+- `betterleaks/samsara-api-token.1`
+- `betterleaks/scaleway-secret-key`
+- `betterleaks/scalr-api-access-token.1`
+- `betterleaks/segment-public-api-token.1`
+- `betterleaks/slack-session-cookie`
+- `betterleaks/slack-session-token`
+- `betterleaks/snowflake-programmatic-access-token.1`
+- `betterleaks/sslmate-api-key.1`
+- `betterleaks/stability-ai-api-key`
+- `betterleaks/supabase-management-token`
+- `betterleaks/supabase-project-api-key`
+- `betterleaks/tableau-personal-access-token.1`
+- `betterleaks/tailscale-api-key.1`
+- `betterleaks/telnyx-api-v2-key.1`
+- `betterleaks/temporal-cloud-api-key.1`
+- `betterleaks/thunderstore-api-token.1`
+- `betterleaks/togetherai-api-key`
+- `betterleaks/unkey-root-key.1`
+- `betterleaks/upcloud-api-token`
+- `betterleaks/upstage-api-key`
+- `betterleaks/upstash-redis-rest-token.1`
+- `betterleaks/val-town-api-token.1`
+- `betterleaks/vercel-ai-gateway-key`
+- `betterleaks/vercel-api-token`
+- `betterleaks/vercel-app-access-token`
+- `betterleaks/vercel-app-refresh-token`
+- `betterleaks/vercel-integration-token`
+- `betterleaks/vercel-personal-access-token`
+- `betterleaks/virustotal-api-key.1`
+- `betterleaks/voyageai-api-key`
+- `betterleaks/vultr-api-key.1`
+- `betterleaks/wakatime-api-key.1`
+- `betterleaks/wakatime-api-key.2`
+- `betterleaks/weatherstack-api-key.1`
+- `betterleaks/weights-and-biases-api-key`
+- `betterleaks/weights-and-biases-api-key-v1`
+- `betterleaks/wiz-client-secret.1`
+- `betterleaks/woocommerce-consumer-secret.1`
+- `betterleaks/workato-developer-api-token.1`
+- `betterleaks/workos-production-api-key.1`
+- `betterleaks/xai-api-key`
+- `betterleaks/xendit-production-api-key.1`
+- `betterleaks/zai-api-key`
+- `betterleaks/zoho-client-secret.1`
+- `betterleaks/zoho-oauth-token.1`
+- `betterleaks/zoho-zapi-key.1`
+- `betterleaks/zuplo-consumer-api-key.1`
 - `birth-context`
 - `birth-year`
 - `booking-context`
 - `booking-filename`
+- `card-context`
 - `catalog/aws`
 - `catalog/azure`
 - `catalog/google`
 - `cli-password`
 - `context`
 - `cookie`
+- `credential-pair`
 - `databricks`
 - `detect-secrets`
 - `digitalocean`
@@ -315,6 +520,7 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `google`
 - `grafana`
 - `home-path`
+- `honorific-name`
 - `huggingface`
 - `iban-checksum`
 - `identity-number`
@@ -329,8 +535,10 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `location-gazetteer`
 - `location-label`
 - `location-residence`
+- `login-call`
 - `luhn`
 - `mac`
+- `mail-display-name`
 - `mailchimp`
 - `messenger-handle`
 - `messenger-label`
@@ -342,6 +550,7 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `name-initials`
 - `name-title`
 - `name-variant`
+- `named-value`
 - `national-format`
 - `national-phone`
 - `ner/offline`
@@ -365,10 +574,13 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `passport-format`
 - `passport-issuer`
 - `passport-series`
+- `password-hash`
 - `personal-profile-url`
 - `phone-context`
+- `po-box`
 - `postal-address`
 - `postal-code`
+- `postal-label`
 - `presidio`
 - `private-key`
 - `profile-attribute`
@@ -378,12 +590,17 @@ Regenerate with `node experiments/issue-118/generate-rule-catalog.mjs`.
 - `pypi`
 - `quoted-entropy`
 - `residence-prose`
+- `salutation`
 - `school-acronym-context`
 - `secretlint`
+- `self-introduction`
 - `sendgrid`
 - `shopify`
+- `sign-off`
 - `slack`
 - `square`
+- `ssn-label`
+- `state-zip`
 - `strict-age`
 - `strict-attribute`
 - `strict-date`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-foundation/sensitive-data-sanitizer",
-  "version": "0.19.3",
+  "version": "0.20.0",
   "description": "Offline sensitive-text sanitization with credential, multilingual personal-data and scanner union detection",
   "type": "module",
   "main": "src/index.js",

package/src/allow-list.js

@@ -0,0 +1,93 @@
+import { failure } from './detection.js';
+
+// Caller-declared values are explicit private policy; an allow list must not
+// silently cancel them. Schema denials (JSON_VALUE) always win as well.
+const declaredRules = new Set([
+  'known-personal',
+  'confirmed-personal',
+  'known-secret',
+]);
+const anchored = new WeakMap();
+
+function fullMatcher(pattern) {
+  let compiled = anchored.get(pattern);
+  if (!compiled) {
+    compiled = new RegExp(
+      `^(?:${pattern.source})$`,
+      pattern.flags.replace(/[gy]/g, '')
+    );
+    anchored.set(pattern, compiled);
+  }
+  return compiled;
+}
+
+// Inline suppression comments understood by Gitleaks/Betterleaks
+// (gitleaks:allow), detect-secrets and ripsecrets (pragma: allowlist secret),
+// Kingfisher, TruffleHog and SonarQube. Honoured only with inlineAllow: true,
+// because anyone who writes to a log could otherwise suppress redaction.
+const sameLine =
+  /(?:gitleaks|betterleaks|kingfisher|trufflehog|sanitizer):(?:allow|ignore)\b|pragma:\s*allowlist(?:\s+secret)?\b(?!\s+nextline)|\bNOSONAR\b/i;
+const nextLine = /pragma:\s*allowlist\s+nextline(?:\s+secret)?\b/i;
+
+function lineAt(text, index) {
+  const start = text.lastIndexOf('\n', index - 1) + 1;
+  const end = text.indexOf('\n', index);
+  return { start, end: end < 0 ? text.length : end };
+}
+
+function inlineSuppressed(text, finding) {
+  const line = lineAt(text, finding.start);
+  if (sameLine.test(text.slice(line.start, line.end))) {
+    return true;
+  }
+  if (line.start === 0) {
+    return false;
+  }
+  const previous = lineAt(text, line.start - 1);
+  return nextLine.test(text.slice(previous.start, previous.end));
+}
+
+export function validateAllowList(options) {
+  if (
+    options.inlineAllow !== undefined &&
+    typeof options.inlineAllow !== 'boolean'
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+  const list = options.allowList;
+  if (list === undefined) {
+    return;
+  }
+  if (
+    !Array.isArray(list) ||
+    list.length > 10000 ||
+    !list.every(
+      (entry) =>
+        (typeof entry === 'string' && entry.length > 0) ||
+        entry instanceof RegExp
+    )
+  ) {
+    throw failure('ERR_CONFIG');
+  }
+}
+
+// Presidio allow_list, Google exclusion rules (MATCHING_TYPE_FULL_MATCH) and
+// DataFog allowlist_patterns: a listed string or pattern must cover the whole
+// detected value. Partial matches never shorten a finding.
+export function allowListed(text, finding, options) {
+  if (
+    !(options.allowList?.length || options.inlineAllow) ||
+    declaredRules.has(finding.rule) ||
+    finding.type === 'JSON_VALUE' ||
+    (finding.category === 'credential' && !options.allowCredentialDisable)
+  ) {
+    return false;
+  }
+  if (options.inlineAllow && inlineSuppressed(text, finding)) {
+    return true;
+  }
+  const value = text.slice(finding.start, finding.end);
+  return (options.allowList ?? []).some((entry) =>
+    typeof entry === 'string' ? entry === value : fullMatcher(entry).test(value)
+  );
+}

package/src/confidence.js

@@ -1,13 +1,18 @@
 // A valid check digit is common in arbitrary log numbers. Context decides
 // whether that evidence merits a replacement; inspect retains low scores.
-export function threshold(options) {
-  return options.minConfidence ?? options.threshold ?? 0.5;
+export function threshold(options, type) {
+  return (
+    options.minConfidenceByType?.[type] ??
+    options.minConfidence ??
+    options.threshold ??
+    0.5
+  );
 }
 export function actionable(finding, options) {
   return (
     finding.kept !== 'fake' &&
     (finding.category === 'credential' ||
-      finding.confidence >= threshold(options))
+      finding.confidence >= threshold(options, finding.type))
   );
 }
 export function numericNoise(text, start) {
@@ -29,11 +34,10 @@ export function epochNumber(value) {
   );
 }
 export function cardEvidence(text, start, value) {
-  const identityContext =
-    /(?<![\p{L}\p{N}_])(?:card|visa|mastercard|amex|discover|jcb|unionpay|mir|diners|карта)(?![\p{L}\p{N}_])/iu.test(
-      text.slice(Math.max(0, start - 64), start + value.length + 32)
-    );
-  return identityContext || (!numericNoise(text, start) && !epochNumber(value));
+  return (
+    cardContext(text, start, value) ||
+    (!numericNoise(text, start) && !epochNumber(value))
+  );
 }
 export function cardNetwork(value) {
   const d = value.replace(/\D/g, ''),
@@ -60,6 +64,17 @@ function otherCard(d, n) {
       n <= 19) ||
     (/^62/.test(d) && n >= 16 && n <= 19) ||
     (/^220[0-4]/.test(d) && n >= 16 && n <= 19) ||
-    (/^3(?:0[0-5]|[68])/.test(d) && n === 14)
+    (/^3(?:0[0-5]|[68])/.test(d) && n === 14) ||
+    // Maestro and Dankort IINs listed by Presidio and the card networks.
+    (/^(?:50(?:1[89]|20|38)|5893|6304|6759|676[1-3])/.test(d) &&
+      n >= 12 &&
+      n <= 19)
   );
 }
+// UATP cards (prefix 1, 15 digits) collide with numeric IDs, so they need a
+// card word nearby.
+export const cardContext = (text, start, value) =>
+  /(?<![\p{L}\p{N}_])(?:card|visa|mastercard|amex|discover|jcb|unionpay|mir|diners|maestro|dankort|uatp|карта)(?![\p{L}\p{N}_])/iu.test(
+    text.slice(Math.max(0, start - 64), start + value.length + 32)
+  );
+export const uatpCard = (value) => /^1\d{14}$/.test(value.replace(/\D/g, ''));

package/src/context.js

@@ -50,7 +50,11 @@ const label = labels.credential
   .filter((word) => !['auth', 'authorization'].includes(word))
   .map(escapePattern)
   .join('|');
-const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
+// Glued service prefixes (`dbpass`, `rootpassword`, `bindpw`, `tlspassword`)
+// are fixed so that ordinary words ending in "pass" stay prose.
+const glued =
+  '(?:db|user|root|admin|smtp|mail|ftp|sftp|ssh|redis|ldap|bind|proxy|tls|ssl|keystore|truststore|store|master|sys|app|login|account|acct|wifi|wpa)(?:password|passwd|pass|pwd|pw|secret|token)';
+const key = `(?:[\\p{L}\\p{N}]+[_.-])*(?:auth|authorization|PGPASSWORD|${glued}|${label}|pass|pw)(?:[_.-][\\p{L}\\p{N}]+)*`;
 // A qualifier such as "for staging" stays on one logical line: it never
 // crosses an escaped line break, an escape sequence or an enclosing quote.
 // Verbs are whole words, so "request" does not end in the verb "est".
@@ -58,6 +62,15 @@ const credentialPrefix = new RegExp(
   `(?<![\\p{L}\\p{N}_])(?:\\\\*["'])?(${key})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?(?:[ \\t]+(?:от|для|к|for|de|du|del)[ \\t]+[^:=\\r\\n"\\\\]{1,64})?[ \\t]*([:=：]|(?<![\\p{L}\\p{N}_])(?:${verbs})(?![\\p{L}\\p{N}_]))[ \\t]*`,
   'giu'
 );
+// camelCase and PascalCase keys (`clientSecret`, `secretKey`, `dbPassword`,
+// `ApiSecret`) are case-sensitive: the credential word starts a new word, so
+// `tokenType`, `secretName` and `maxTokens` stay configuration metadata.
+const camelKey =
+  '[\\p{L}][\\p{Ll}\\p{N}]*(?:\\p{Lu}[\\p{Ll}\\p{N}]*)*?(?:Secret|Password|Passwd|Passphrase|Pass|Pwd|Token|Credentials?|(?:Api|Private|Access|Secret|Signing|Encryption|Master|Client|App|Subscription|Account|Storage)Key)(?:Key|Value)?|(?:[Ss]ecret|[Pp]assword|[Pp]asswd|[Tt]oken|[Pp]rivate|[Aa]ccess|[Ss]igning|[Ee]ncryption)(?:Key|Value|Secret|Token)';
+const camelPrefix = new RegExp(
+  `(?<![\\p{L}\\p{N}_$])(?:\\\\*["'])?(${camelKey})(?![\\p{L}\\p{N}_])(?:\\\\*["'])?[ \\t]*([:=])[ \\t]*`,
+  'gu'
+);
 // Bare generic labels are common English nouns. After a verb they need a
 // value that looks generated; "the token is valid" is prose, not a secret.
 function generatedWord(text, range) {
@@ -359,30 +372,54 @@ function sourceReference(label, tail) {
   );
 }
 
+// A camelCase key is usually source code; an unquoted member chain, call or
+// type annotation after it (`config.clientSecret`, `apiToken: string;`) is
+// a reference, not the secret itself.
+function codeValue(text, start) {
+  return /^(?:[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*)+(?:\([^()\r\n]*\))?|[A-Za-z_$][\w$]*\([^()\r\n]*\)|(?:string|number|boolean|any|unknown|str|bytes|String|SecretStr|Optional\[str\])(?![\w$]))[ \t]*(?:[,;)}\]]|\r?\n|$)/u.test(
+    text.slice(start, start + 256)
+  );
+}
+
+// Picks how far a credential value runs: to the end of a query parameter, a
+// token, a line or a prose word.
+function credentialMode(text, match) {
+  const prefix = text.slice(Math.max(0, match.index - 512), match.index);
+  if (
+    /(?:https?:\/\/[^\s]*[?&]|^[?&])[^\s]*$/i.test(prefix) ||
+    /[?&]$/.test(prefix)
+  ) {
+    return 'query';
+  }
+  if (match[2] === '=' || /["']\s*[:：]/.test(match[0])) {
+    return 'token';
+  }
+  return /[:：]/.test(match[2]) ? 'line' : 'prose';
+}
+
+function credentialRange(text, match, camel) {
+  const start = match.index + match[0].length;
+  if (
+    sourceReference(match[1], text.slice(start)) ||
+    (camel && codeValue(text, start))
+  ) {
+    return undefined;
+  }
+  const mode = credentialMode(text, match);
+  const range = /^(?:proxy-)?authorization$/i.test(match[1])
+    ? authorizationRange(text, start)
+    : valueRange(text, start, mode);
+  return range && mode === 'prose' ? generatedWord(text, range) : range;
+}
+
 function detectCredentials(text, emit) {
   const details = { category: 'credential', type: 'SECRET', rule: 'context' };
-  for (const match of text.matchAll(credentialPrefix)) {
-    const start = match.index + match[0].length;
-    const prefix = text.slice(Math.max(0, match.index - 512), match.index);
-    const query =
-      /(?:https?:\/\/[^\s]*[?&]|^[?&])[^\s]*$/i.test(prefix) ||
-      /[?&]$/.test(prefix);
-    const mode = query
-      ? 'query'
-      : match[2] === '=' || /["']\s*[:：]/.test(match[0])
-        ? 'token'
-        : /[:：]/.test(match[2])
-          ? 'line'
-          : 'prose';
-    let range = /^(?:proxy-)?authorization$/i.test(match[1])
-      ? authorizationRange(text, start)
-      : valueRange(text, start, mode);
-    if (range && mode === 'prose') {
-      range = generatedWord(text, range);
-    }
-    if (sourceReference(match[1], text.slice(start))) {
-      continue;
-    }
+  const matches = [
+    ...[...text.matchAll(credentialPrefix)].map((match) => [match, false]),
+    ...[...text.matchAll(camelPrefix)].map((match) => [match, true]),
+  ];
+  for (const [match, camel] of matches) {
+    const range = credentialRange(text, match, camel);
     if (range) {
       emitValue(text, range.start, range.end, emit, details, match[1]);
     }
@@ -417,12 +454,19 @@ const personalPrefixes = Object.entries(labels)
     ];
   });
 
+// "passport number is 912803456": the number word and a following linking
+// verb belong to the label, never to the identity value.
+const identitySuffix = new RegExp(
+  `^(?:(?:number|no\\.?|номер)[ \\t]*(?:[:=：]|(?:${verbs})(?![\\p{L}\\p{N}_]))?[ \\t]*|[№#][ \\t]*)`,
+  'iu'
+);
+
 function detectPersonalLabels(text, emit) {
   for (const [type, prefix] of personalPrefixes) {
     for (const match of text.matchAll(prefix)) {
       const identity = type === 'ID';
       const suffix = identity
-        ? (/^(?:(?:number|no\.?|номер)[ \t]*[:=：]?[ \t]*|[№#][ \t]*)/iu.exec(
+        ? (identitySuffix.exec(
             text.slice(match.index + match[0].length)
           )?.[0] ?? '')
         : '';
@@ -488,7 +532,7 @@ function detectCommandPasswords(text, emit) {
     }
     if (/(?:^|[\s/])curl(?:\s|$)/.test(command)) {
       for (const match of command.matchAll(
-        /(?:^|\s)(?:-u|--user)(?:[ \t]+|=)/g
+        /(?:^|\s)(?:-u|--user|-U|--proxy-user)(?:[ \t]+|=)/g
       )) {
         const range = valueRange(
           text,
@@ -502,10 +546,62 @@ function detectCommandPasswords(text, emit) {
   }
 }
 
+// Kubernetes/compose environment entries name the secret in one field and
+// carry it in the next: `{"name":"DB_PASSWORD","value":"hunter2"}` or
+// `- name: DB_PASSWORD` followed by `value: hunter2`.
+const namedValue = new RegExp(
+  `(["']?)name\\1[ \\t]*:[ \\t]*(["']?)(${key})\\2[ \\t]*,?[ \\t]*(?:\\r?\\n[ \\t]*)?(["']?)value\\4[ \\t]*:[ \\t]*`,
+  'giu'
+);
+// `smtp.login(user, "hunter2")`, `ftp.login('anna', 'pw')`: a literal second
+// argument of a login call is the password.
+const loginCall =
+  /(?<![\p{L}\p{N}_])(?:login|log_in|logIn|signin|sign_in|signIn|authenticate|auth_login|bind_s|simple_bind_s|connect_with_password)[ \t]*\([ \t]*[^,()\r\n]{1,64},[ \t]*(["'])([^"'\\\r\n]{4,128})\1[ \t]*[,)]/gu;
+// Modular crypt and Argon2 password hashes (`$2y$10$…`, `$apr1$…`, `$6$…`)
+// from htpasswd, shadow files and user tables crack offline.
+const passwordHash =
+  /(?<![\p{L}\p{N}_$])\$(?:2[abxy]?\$\d{2}\$[./A-Za-z0-9]{53}|apr1\$[./A-Za-z0-9]{1,8}\$[./A-Za-z0-9]{22}|1\$[./A-Za-z0-9]{1,8}\$[./A-Za-z0-9]{22}|[56]\$(?:rounds=\d{1,9}\$)?[./A-Za-z0-9]{1,16}\$[./A-Za-z0-9]{43,86}|y\$[./A-Za-z0-9]+\$[./A-Za-z0-9]{1,64}\$[./A-Za-z0-9]{43}|argon2(?:id|i|d)\$v=\d+\$m=\d+,t=\d+,p=\d+\$[A-Za-z0-9+/]{11,}\$[A-Za-z0-9+/]{16,})(?![./A-Za-z0-9$])/gu;
+function detectCredentialForms(text, emit) {
+  const details = { category: 'credential', type: 'SECRET' };
+  if (/name/i.test(text)) {
+    for (const match of text.matchAll(namedValue)) {
+      const range = valueRange(text, match.index + match[0].length);
+      if (range) {
+        emitValue(
+          text,
+          range.start,
+          range.end,
+          emit,
+          { ...details, rule: 'named-value' },
+          match[3]
+        );
+      }
+    }
+  }
+  for (const match of text.matchAll(loginCall)) {
+    const start = match.index + match[0].lastIndexOf(match[2]);
+    emitValue(text, start, start + match[2].length, emit, {
+      ...details,
+      rule: 'login-call',
+      confidence: 0.85,
+    });
+  }
+  if (text.includes('$')) {
+    for (const match of text.matchAll(passwordHash)) {
+      emitValue(text, match.index, match.index + match[0].length, emit, {
+        ...details,
+        rule: 'password-hash',
+        confidence: 0.95,
+      });
+    }
+  }
+}
+
 export function detectContext(text, emit, credentialsOnly = false) {
   if (credentialHint.test(text)) {
     detectCredentials(text, emit);
   }
+  detectCredentialForms(text, emit);
   if (!credentialsOnly) {
     detectPersonalLabels(text, emit);
   }

package/src/credentials.js

@@ -7,6 +7,50 @@ export function credentialPlaceholder(value) {
     ) || referencePrefix(value)?.[0] === value
   );
 }
+// One template or mask token: ${NAME}, $${NAME}, $NAME, $1, <name>, [NAME],
+// ****, XXXX or an ellipsis. Values made only of these (optionally split by
+// a user:password colon) carry no credential material.
+const templateToken =
+  /^(?:\$?\$\{[A-Za-z_][\w.-]*\}|\$[A-Za-z_]\w*|\$\d|<[^<>\r\n]{1,64}>|\[[A-Z][A-Z0-9_ ]{0,63}\]|\*{3,}|[xX]{4,}|\.{3}|…)$/;
+const unquote = (part) => part.replace(/^["']|["']$/g, '');
+
+function templatedValue(value) {
+  const body = value.replace(/^(?:token|Bearer|Basic)\s+/i, '');
+  const colon = body.indexOf(':');
+  const parts = (
+    colon < 0 ? [body] : [body.slice(0, colon), body.slice(colon + 1)]
+  ).map((part) => unquote(part.trim()));
+  return (
+    parts.some(Boolean) &&
+    parts.every((part) => !part || templateToken.test(part))
+  );
+}
+
+// Detectors stop at whitespace or brackets, so `<API token>` or `[PASSWORD]`
+// can arrive truncated; complete them from the following text first.
+export function templatedCredential(text, finding) {
+  if (finding.category !== 'credential' || finding.rule === 'known-secret') {
+    return false;
+  }
+  let value = text.slice(finding.start, finding.end);
+  const closer =
+    value.lastIndexOf('<') > value.lastIndexOf('>')
+      ? '>'
+      : value.lastIndexOf('[') > value.lastIndexOf(']')
+        ? ']'
+        : '';
+  if (closer) {
+    const rest = text.slice(finding.end, finding.end + 64);
+    const index = rest.indexOf(closer);
+    if (index < 0 || /[\r\n]/.test(rest.slice(0, index))) {
+      return false;
+    }
+    value += rest.slice(0, index + 1);
+  }
+  // A template glued to literal characters (`<x>abc`, `[A]x9`) is not one.
+  const after = text[finding.start + value.length] ?? '';
+  return !/[\w$%+/=.-]/.test(after) && templatedValue(value);
+}
 // Only variable references and the documented gh lookup are exempt. Arbitrary
 // shell commands and Actions expressions can contain literal credentials.
 export function referencePrefix(value) {