@link-foundation/sensitive-data-sanitizer 0.19.3 → 0.21.0

package/src/prose-words.js

@@ -0,0 +1,120 @@
+import { isNameForm } from './russian-names.js';
+import { compiledVocabulary, defaultVocabulary } from './vocabulary.js';
+
+// Words that are capitalized by position or politeness in prose but identify
+// nobody. `properNames: 'capitalized'` leaves them readable. Any word that is
+// also a given name form (`Вера`, `Любовь`, `Will`) is removed from the lists,
+// so a list entry can never keep a name.
+const fold = (word) => word.toLowerCase().replaceAll('ё', 'е');
+const words = (list) =>
+  new Set(
+    list
+      .split(/\s+/u)
+      .filter(Boolean)
+      .map(fold)
+      .filter((word) => !isNameForm(word))
+  );
+
+// Pronouns are capitalized anywhere in polite Russian (`благодарим Вас`).
+const pronouns = words(`
+  я меня мне мной мы нас нам нами ты тебя тебе тобой вы вас вам вами
+  ваш ваша ваше вашего вашей вашему вашим ваши ваших
+  наш наша наше нашего нашей нашему нашим наши наших
+  мой моя мое моего моей моему моим мои моих
+  твой твоя твое твои он она оно они его ее ему ей им ими их них нее него
+  i me my mine we us our you your he him his she her they them their
+`);
+// Role and label words stay beside the name they introduce
+// (`Кандидат Петров Иван Сергеевич` -> `Кандидат Person-1`).
+const cues = words(`
+  кандидат кандидатка кандидата кандидату соискатель соискательница соискателя
+  сотрудник сотрудница сотрудника клиент клиентка клиента пациент пациентка
+  пациента абонент абонента заявитель заявительница заявителя студент
+  студентка гражданин гражданка господин госпожа коллега коллеги менеджер
+  директор руководитель инженер аналитик разработчик специалист водитель врач
+  candidate employee client customer patient applicant student citizen
+  colleague manager director engineer developer analyst
+`);
+// Greetings and function words are left alone only at the start of a
+// sentence, where capitalization says nothing about a name.
+const sentenceWords = words(`
+  здравствуйте здравствуй привет приветствую добрый доброе доброго добрая
+  уважаемый уважаемая уважаемые дорогой дорогая дорогие спасибо благодарю
+  благодарим пожалуйста извините простите скажите подскажите прошу просьба
+  это этот эта эти тот та те то там тут здесь где когда как что кто чем
+  почему зачем если но и а или да нет не ни в во на по с со к ко у о об от до
+  из за для при без про после перед также тоже еще уже вот так все весь вся
+  каждый сейчас сегодня вчера завтра потом затем далее итак кроме однако
+  поэтому хотя возможно конечно хорошо ладно ок буду будет был была были было
+  есть могу можно нужно надо готов готова готовы имею хочу работаю живу
+  учусь зовут звать занимаюсь звоню пишу
+  нёс перенёс принёс вёз привёз мог смог помог умер рос вырос лёг шёл пришёл
+  ушёл перешёл нашёл
+  hello hi hey dear thanks thank please regards sincerely best the this that
+  these those a an it is are was were in on at for from to with and but or if
+  when where what who why how yes no not also
+`);
+// Past tense (`Работал`, `Звонила`, `Переехали`), first person present
+// (`Работаю`, `Занимаюсь`) and third person present. A bare masculine `-л` form is also a surname shape
+// (`Шагал`), so it is kept only before a lowercase word.
+const pastTense = /^[а-яе]{2,}[аеиоуыя]л(?:а|о|и|ся|ась|ось|ись)$/u;
+const masculinePast = /^[а-яе]{3,}[аеиуыя]л$/u;
+const firstPerson = /^[а-яе]{3,}[аеуя]ю(?:сь)?$/u;
+// Third person present (`Рекомендует`, `Работает`, `Говорит`, `Учатся`).
+const thirdPerson =
+  /^[а-яе]{2,}(?:[аеиоуюя]ет|[аеиоуюя]ют|ит|ят|[аеиуя]ется|[аеиуя]ются|ится|атся|ятся)$/u;
+
+function sentenceStart(text, start) {
+  let i = start - 1;
+  while (i >= 0 && /[ \t"'«„“(—–-]/u.test(text[i])) {
+    i--;
+  }
+  return i < 0 || /[.!?…\r\n:;]/u.test(text[i]);
+}
+function nextWordLowercase(text, end) {
+  return /^[ \t]+\p{Ll}/u.test(text.slice(end, end + 4));
+}
+function vocabularyCues(options) {
+  const lists = compiledVocabulary(options?.vocabulary)?.lists;
+  return lists ? [...lists.roles, ...lists.personalLabels] : [];
+}
+const defaultCues = new Set(
+  [...defaultVocabulary.roles, ...defaultVocabulary.personalLabels].map(fold)
+);
+
+// True when a word of the cue lists, including the configured `roles` and
+// `personalLabels` vocabulary, is not part of a name.
+export function isProseCue(word, options) {
+  const lower = fold(word);
+  return (
+    (cues.has(lower) ||
+      defaultCues.has(lower) ||
+      vocabularyCues(options).includes(lower)) &&
+    !isNameForm(word)
+  );
+}
+// True for a pronoun or cue word, which identify nobody wherever they stand.
+export function isCommonProseWord(word, options) {
+  return pronouns.has(fold(word)) || isProseCue(word, options);
+}
+// Decides whether a capitalized prose token is an ordinary word of the
+// sentence and not a name.
+export function keepsProseWord(text, value, start, end, options) {
+  if (!/^\p{L}+$/u.test(value) || isNameForm(value)) {
+    return false;
+  }
+  if (isCommonProseWord(value, options)) {
+    return true;
+  }
+  if (!sentenceStart(text, start)) {
+    return false;
+  }
+  const lower = fold(value);
+  return (
+    sentenceWords.has(lower) ||
+    pastTense.test(lower) ||
+    firstPerson.test(lower) ||
+    thirdPerson.test(lower) ||
+    (masculinePast.test(lower) && nextWordLowercase(text, end))
+  );
+}

package/src/record-worker.js

@@ -1,4 +1,5 @@
 import { parentPort, workerData } from 'node:worker_threads';
+import './personal-features.js';
 import { createSanitizer, prepareStreamEngine } from './engines.js';
 import { compileKnown } from './compiled-known.js';
 

package/src/rule-catalog.js

@@ -4,16 +4,221 @@ export const builtInRules = Object.freeze([
   'anthropic',
   'authorization',
   'aws',
+  'betterleaks/abuseipdb-api-key.1',
+  'betterleaks/aikido-ci-token',
+  'betterleaks/aikido-client-secret',
+  'betterleaks/airtable-oauth-token',
+  'betterleaks/aiven-auth-token',
+  'betterleaks/alibaba-sts-access-key-secret',
+  'betterleaks/amplitude-secret-key',
+  'betterleaks/apify-api-token',
+  'betterleaks/apollo-api-key.1',
+  'betterleaks/asaas-api-token',
+  'betterleaks/assemblyai-api-key',
+  'betterleaks/auth0-client-secret.1',
+  'betterleaks/azure-app-configuration-connection-string',
+  'betterleaks/azure-servicebus-connection-string',
+  'betterleaks/azure-storage-account-key',
+  'betterleaks/bitbucket-data-center-token',
+  'betterleaks/bitly-access-token',
+  'betterleaks/bitrise-access-token',
+  'betterleaks/box-api-access-token',
+  'betterleaks/brave-search-api-key',
+  'betterleaks/browserstack-access-key.1',
+  'betterleaks/buildkite-service-token',
+  'betterleaks/buildkite-user-access-token',
+  'betterleaks/canadian-digital-service-notify-api-key',
+  'betterleaks/canva-client-secret',
+  'betterleaks/cartesia-api-key.1',
+  'betterleaks/cerebras-api-key',
+  'betterleaks/checkout-secret-key',
+  'betterleaks/circleci-personal-token',
+  'betterleaks/circleci-project-token',
+  'betterleaks/civo-api-key',
+  'betterleaks/clerk-secret-key',
+  'betterleaks/clickup-personal-api-token',
+  'betterleaks/cloudflare-api-key.2',
+  'betterleaks/cloudinary-api-secret',
+  'betterleaks/cloudsmith-api-key',
+  'betterleaks/cockroachlabs-cloud-api-key',
+  'betterleaks/configcat-sdk-key',
+  'betterleaks/configcat-sdk-key-extended',
+  'betterleaks/couchbase-capella-api-key',
+  'betterleaks/coveralls-personal-api-token',
+  'betterleaks/crates-io-api-key',
+  'betterleaks/cursor-api-key',
+  'betterleaks/databento-api-key',
+  'betterleaks/datadog-api-key',
+  'betterleaks/datadog-application-key',
+  'betterleaks/datagov-api-key',
+  'betterleaks/datastax-astra-application-token',
+  'betterleaks/deepgram-api-key',
+  'betterleaks/deepseek-api-key',
+  'betterleaks/deno-account-token',
+  'betterleaks/devcycle-client-sdk-key',
+  'betterleaks/devcycle-mobile-sdk-key',
+  'betterleaks/devcycle-server-sdk-key',
+  'betterleaks/devin-personal-api-key',
+  'betterleaks/devin-service-api-key',
+  'betterleaks/devin-service-user-token',
+  'betterleaks/disqus-api-key',
+  'betterleaks/docker-swarm-join-token',
+  'betterleaks/docker-swarm-unlock-key',
+  'betterleaks/dockerhub-organization-access-token',
+  'betterleaks/dockerhub-personal-access-token',
+  'betterleaks/ebay-client-secret',
+  'betterleaks/elastic-cloud-api-key',
+  'betterleaks/elevenlabs-api-key',
+  'betterleaks/endorlabs-api-key',
+  'betterleaks/endorlabs-api-secret',
+  'betterleaks/etsy-open-api-key',
+  'betterleaks/exoscale-api-key',
+  'betterleaks/fal-api-key.1',
+  'betterleaks/figma-personal-access-header-token',
+  'betterleaks/figma-personal-access-token',
+  'betterleaks/fullstory-api-key',
+  'betterleaks/gcp-application-default-credentials',
+  'betterleaks/gcp-gemini-api',
+  'betterleaks/gcp-service-account',
+  'betterleaks/gitea-access-token',
+  'betterleaks/gitlab-incoming-mail-address-token',
+  'betterleaks/gitlab-pat-routable-versioned',
+  'betterleaks/greptile-api-key',
+  'betterleaks/groq-api-key',
+  'betterleaks/gumroad-access-token',
+  'betterleaks/highnote-secret-live-key',
+  'betterleaks/honeycomb-api-key',
+  'betterleaks/hunter-api-key.1',
+  'betterleaks/ibm-cloud-user-api-key',
+  'betterleaks/influxdb-api-token',
+  'betterleaks/infomaniak-api-token',
+  'betterleaks/instantly-api-key.1',
+  'betterleaks/ionic-personal-access-token',
+  'betterleaks/jumpcloud-api-key',
+  'betterleaks/kagi-api-key',
+  'betterleaks/kimi-api-key',
+  'betterleaks/klaviyo-api-key',
+  'betterleaks/langchain-langsmith-personal-access-token',
+  'betterleaks/langchain-langsmith-service-key',
+  'betterleaks/langfuse-secret-key.1',
+  'betterleaks/lark-app-secret',
+  'betterleaks/lichess-personal-access-token',
+  'betterleaks/lighton-paradigm-api-key',
+  'betterleaks/llama-cloud-api-key.1',
+  'betterleaks/mailersend-api-token',
+  'betterleaks/mem0-api-key.1',
+  'betterleaks/mercury-production-api-token',
+  'betterleaks/mergify-application-key',
+  'betterleaks/midtrans-production-server-client-key',
+  'betterleaks/minimax-api-key',
+  'betterleaks/miro-access-token',
+  'betterleaks/miro-client-secret',
+  'betterleaks/mistral-api-key',
+  'betterleaks/monday-api-token.1',
+  'betterleaks/mongodb-atlas-service-account-secret',
+  'betterleaks/mongodb-connection-string',
+  'betterleaks/mux-access-token-secret.1',
+  'betterleaks/neon-api-key',
+  'betterleaks/ngrok-api-key.1',
+  'betterleaks/nuget-api-key',
+  'betterleaks/nvidia-api-key',
+  'betterleaks/nylas-api-key.1',
+  'betterleaks/ollama-api-key',
+  'betterleaks/onesignal-rich-authentication-token',
+  'betterleaks/onfido-live-api-token-ca',
+  'betterleaks/onfido-live-api-token-eu',
+  'betterleaks/onfido-live-api-token-us',
+  'betterleaks/openrouter-api-key',
+  'betterleaks/openweather-api-key',
+  'betterleaks/opsgenie-api-key.1',
+  'betterleaks/ovh-application-secret',
+  'betterleaks/paddle-live-api-key',
+  'betterleaks/pagerduty-authorization-token.1',
+  'betterleaks/paypal-client-secret.1',
+  'betterleaks/persona-production-api-key',
+  'betterleaks/pinecone-api-key.1',
+  'betterleaks/pinecone-api-key.2',
+  'betterleaks/pinterest-access-token',
+  'betterleaks/plivo-auth-token',
+  'betterleaks/polar-oauth-access-token',
+  'betterleaks/polar-organization-access-token',
+  'betterleaks/polar-personal-access-token',
+  'betterleaks/polymarket-api-key',
+  'betterleaks/polymarket-private-key',
+  'betterleaks/posthog-personal-api-key',
+  'betterleaks/posthog-project-api-key',
+  'betterleaks/postmark-api-token.1',
+  'betterleaks/proof-full-access-api-key',
+  'betterleaks/rainforest-pay-production-api-key',
+  'betterleaks/ramp-client-secret',
+  'betterleaks/razorpay-key-secret.1',
+  'betterleaks/redirect-pizza-api-token.1',
+  'betterleaks/render-api-key',
+  'betterleaks/replicate-api-token',
+  'betterleaks/resend-api-key.1',
+  'betterleaks/retell-api-key.1',
+  'betterleaks/rootly-api-key.1',
+  'betterleaks/runpod-api-key.1',
+  'betterleaks/salesforce-access-token.1',
+  'betterleaks/samsara-api-token.1',
+  'betterleaks/scaleway-secret-key',
+  'betterleaks/scalr-api-access-token.1',
+  'betterleaks/segment-public-api-token.1',
+  'betterleaks/slack-session-cookie',
+  'betterleaks/slack-session-token',
+  'betterleaks/snowflake-programmatic-access-token.1',
+  'betterleaks/sslmate-api-key.1',
+  'betterleaks/stability-ai-api-key',
+  'betterleaks/supabase-management-token',
+  'betterleaks/supabase-project-api-key',
+  'betterleaks/tableau-personal-access-token.1',
+  'betterleaks/tailscale-api-key.1',
+  'betterleaks/telnyx-api-v2-key.1',
+  'betterleaks/temporal-cloud-api-key.1',
+  'betterleaks/thunderstore-api-token.1',
+  'betterleaks/togetherai-api-key',
+  'betterleaks/unkey-root-key.1',
+  'betterleaks/upcloud-api-token',
+  'betterleaks/upstage-api-key',
+  'betterleaks/upstash-redis-rest-token.1',
+  'betterleaks/val-town-api-token.1',
+  'betterleaks/vercel-ai-gateway-key',
+  'betterleaks/vercel-api-token',
+  'betterleaks/vercel-app-access-token',
+  'betterleaks/vercel-app-refresh-token',
+  'betterleaks/vercel-integration-token',
+  'betterleaks/vercel-personal-access-token',
+  'betterleaks/virustotal-api-key.1',
+  'betterleaks/voyageai-api-key',
+  'betterleaks/vultr-api-key.1',
+  'betterleaks/wakatime-api-key.1',
+  'betterleaks/wakatime-api-key.2',
+  'betterleaks/weatherstack-api-key.1',
+  'betterleaks/weights-and-biases-api-key',
+  'betterleaks/weights-and-biases-api-key-v1',
+  'betterleaks/wiz-client-secret.1',
+  'betterleaks/woocommerce-consumer-secret.1',
+  'betterleaks/workato-developer-api-token.1',
+  'betterleaks/workos-production-api-key.1',
+  'betterleaks/xai-api-key',
+  'betterleaks/xendit-production-api-key.1',
+  'betterleaks/zai-api-key',
+  'betterleaks/zoho-client-secret.1',
+  'betterleaks/zoho-oauth-token.1',
+  'betterleaks/zoho-zapi-key.1',
+  'betterleaks/zuplo-consumer-api-key.1',
   'birth-context',
   'birth-year',
   'booking-context',
   'booking-filename',
+  'card-context',
   'catalog/aws',
   'catalog/azure',
   'catalog/google',
   'cli-password',
   'context',
   'cookie',
+  'credential-pair',
   'databricks',
   'detect-secrets',
   'digitalocean',
@@ -307,6 +512,7 @@ export const builtInRules = Object.freeze([
   'google',
   'grafana',
   'home-path',
+  'honorific-name',
   'huggingface',
   'iban-checksum',
   'identity-number',
@@ -321,9 +527,12 @@ export const builtInRules = Object.freeze([
   'location-gazetteer',
   'location-label',
   'location-residence',
+  'login-call',
   'luhn',
   'mac',
+  'mail-display-name',
   'mailchimp',
+  'marker-token',
   'messenger-handle',
   'messenger-label',
   'mrz',
@@ -334,6 +543,7 @@ export const builtInRules = Object.freeze([
   'name-initials',
   'name-title',
   'name-variant',
+  'named-value',
   'national-format',
   'national-phone',
   'ner/offline',
@@ -357,10 +567,13 @@ export const builtInRules = Object.freeze([
   'passport-format',
   'passport-issuer',
   'passport-series',
+  'password-hash',
   'personal-profile-url',
   'phone-context',
+  'po-box',
   'postal-address',
   'postal-code',
+  'postal-label',
   'presidio',
   'private-key',
   'profile-attribute',
@@ -370,12 +583,17 @@ export const builtInRules = Object.freeze([
   'pypi',
   'quoted-entropy',
   'residence-prose',
+  'salutation',
   'school-acronym-context',
   'secretlint',
+  'self-introduction',
   'sendgrid',
   'shopify',
+  'sign-off',
   'slack',
   'square',
+  'ssn-label',
+  'state-zip',
   'strict-age',
   'strict-attribute',
   'strict-date',
@@ -400,12 +618,216 @@ export const credentialRules = new Set([
   'anthropic',
   'authorization',
   'aws',
+  'betterleaks/abuseipdb-api-key.1',
+  'betterleaks/aikido-ci-token',
+  'betterleaks/aikido-client-secret',
+  'betterleaks/airtable-oauth-token',
+  'betterleaks/aiven-auth-token',
+  'betterleaks/alibaba-sts-access-key-secret',
+  'betterleaks/amplitude-secret-key',
+  'betterleaks/apify-api-token',
+  'betterleaks/apollo-api-key.1',
+  'betterleaks/asaas-api-token',
+  'betterleaks/assemblyai-api-key',
+  'betterleaks/auth0-client-secret.1',
+  'betterleaks/azure-app-configuration-connection-string',
+  'betterleaks/azure-servicebus-connection-string',
+  'betterleaks/azure-storage-account-key',
+  'betterleaks/bitbucket-data-center-token',
+  'betterleaks/bitly-access-token',
+  'betterleaks/bitrise-access-token',
+  'betterleaks/box-api-access-token',
+  'betterleaks/brave-search-api-key',
+  'betterleaks/browserstack-access-key.1',
+  'betterleaks/buildkite-service-token',
+  'betterleaks/buildkite-user-access-token',
+  'betterleaks/canadian-digital-service-notify-api-key',
+  'betterleaks/canva-client-secret',
+  'betterleaks/cartesia-api-key.1',
+  'betterleaks/cerebras-api-key',
+  'betterleaks/checkout-secret-key',
+  'betterleaks/circleci-personal-token',
+  'betterleaks/circleci-project-token',
+  'betterleaks/civo-api-key',
+  'betterleaks/clerk-secret-key',
+  'betterleaks/clickup-personal-api-token',
+  'betterleaks/cloudflare-api-key.2',
+  'betterleaks/cloudinary-api-secret',
+  'betterleaks/cloudsmith-api-key',
+  'betterleaks/cockroachlabs-cloud-api-key',
+  'betterleaks/configcat-sdk-key',
+  'betterleaks/configcat-sdk-key-extended',
+  'betterleaks/couchbase-capella-api-key',
+  'betterleaks/coveralls-personal-api-token',
+  'betterleaks/crates-io-api-key',
+  'betterleaks/cursor-api-key',
+  'betterleaks/databento-api-key',
+  'betterleaks/datadog-api-key',
+  'betterleaks/datadog-application-key',
+  'betterleaks/datagov-api-key',
+  'betterleaks/datastax-astra-application-token',
+  'betterleaks/deepgram-api-key',
+  'betterleaks/deepseek-api-key',
+  'betterleaks/deno-account-token',
+  'betterleaks/devcycle-client-sdk-key',
+  'betterleaks/devcycle-mobile-sdk-key',
+  'betterleaks/devcycle-server-sdk-key',
+  'betterleaks/devin-personal-api-key',
+  'betterleaks/devin-service-api-key',
+  'betterleaks/devin-service-user-token',
+  'betterleaks/disqus-api-key',
+  'betterleaks/docker-swarm-join-token',
+  'betterleaks/docker-swarm-unlock-key',
+  'betterleaks/dockerhub-organization-access-token',
+  'betterleaks/dockerhub-personal-access-token',
+  'betterleaks/ebay-client-secret',
+  'betterleaks/elastic-cloud-api-key',
+  'betterleaks/elevenlabs-api-key',
+  'betterleaks/endorlabs-api-key',
+  'betterleaks/endorlabs-api-secret',
+  'betterleaks/etsy-open-api-key',
+  'betterleaks/exoscale-api-key',
+  'betterleaks/fal-api-key.1',
+  'betterleaks/figma-personal-access-header-token',
+  'betterleaks/figma-personal-access-token',
+  'betterleaks/fullstory-api-key',
+  'betterleaks/gcp-application-default-credentials',
+  'betterleaks/gcp-gemini-api',
+  'betterleaks/gcp-service-account',
+  'betterleaks/gitea-access-token',
+  'betterleaks/gitlab-incoming-mail-address-token',
+  'betterleaks/gitlab-pat-routable-versioned',
+  'betterleaks/greptile-api-key',
+  'betterleaks/groq-api-key',
+  'betterleaks/gumroad-access-token',
+  'betterleaks/highnote-secret-live-key',
+  'betterleaks/honeycomb-api-key',
+  'betterleaks/hunter-api-key.1',
+  'betterleaks/ibm-cloud-user-api-key',
+  'betterleaks/influxdb-api-token',
+  'betterleaks/infomaniak-api-token',
+  'betterleaks/instantly-api-key.1',
+  'betterleaks/ionic-personal-access-token',
+  'betterleaks/jumpcloud-api-key',
+  'betterleaks/kagi-api-key',
+  'betterleaks/kimi-api-key',
+  'betterleaks/klaviyo-api-key',
+  'betterleaks/langchain-langsmith-personal-access-token',
+  'betterleaks/langchain-langsmith-service-key',
+  'betterleaks/langfuse-secret-key.1',
+  'betterleaks/lark-app-secret',
+  'betterleaks/lichess-personal-access-token',
+  'betterleaks/lighton-paradigm-api-key',
+  'betterleaks/llama-cloud-api-key.1',
+  'betterleaks/mailersend-api-token',
+  'betterleaks/mem0-api-key.1',
+  'betterleaks/mercury-production-api-token',
+  'betterleaks/mergify-application-key',
+  'betterleaks/midtrans-production-server-client-key',
+  'betterleaks/minimax-api-key',
+  'betterleaks/miro-access-token',
+  'betterleaks/miro-client-secret',
+  'betterleaks/mistral-api-key',
+  'betterleaks/monday-api-token.1',
+  'betterleaks/mongodb-atlas-service-account-secret',
+  'betterleaks/mongodb-connection-string',
+  'betterleaks/mux-access-token-secret.1',
+  'betterleaks/neon-api-key',
+  'betterleaks/ngrok-api-key.1',
+  'betterleaks/nuget-api-key',
+  'betterleaks/nvidia-api-key',
+  'betterleaks/nylas-api-key.1',
+  'betterleaks/ollama-api-key',
+  'betterleaks/onesignal-rich-authentication-token',
+  'betterleaks/onfido-live-api-token-ca',
+  'betterleaks/onfido-live-api-token-eu',
+  'betterleaks/onfido-live-api-token-us',
+  'betterleaks/openrouter-api-key',
+  'betterleaks/openweather-api-key',
+  'betterleaks/opsgenie-api-key.1',
+  'betterleaks/ovh-application-secret',
+  'betterleaks/paddle-live-api-key',
+  'betterleaks/pagerduty-authorization-token.1',
+  'betterleaks/paypal-client-secret.1',
+  'betterleaks/persona-production-api-key',
+  'betterleaks/pinecone-api-key.1',
+  'betterleaks/pinecone-api-key.2',
+  'betterleaks/pinterest-access-token',
+  'betterleaks/plivo-auth-token',
+  'betterleaks/polar-oauth-access-token',
+  'betterleaks/polar-organization-access-token',
+  'betterleaks/polar-personal-access-token',
+  'betterleaks/polymarket-api-key',
+  'betterleaks/polymarket-private-key',
+  'betterleaks/posthog-personal-api-key',
+  'betterleaks/posthog-project-api-key',
+  'betterleaks/postmark-api-token.1',
+  'betterleaks/proof-full-access-api-key',
+  'betterleaks/rainforest-pay-production-api-key',
+  'betterleaks/ramp-client-secret',
+  'betterleaks/razorpay-key-secret.1',
+  'betterleaks/redirect-pizza-api-token.1',
+  'betterleaks/render-api-key',
+  'betterleaks/replicate-api-token',
+  'betterleaks/resend-api-key.1',
+  'betterleaks/retell-api-key.1',
+  'betterleaks/rootly-api-key.1',
+  'betterleaks/runpod-api-key.1',
+  'betterleaks/salesforce-access-token.1',
+  'betterleaks/samsara-api-token.1',
+  'betterleaks/scaleway-secret-key',
+  'betterleaks/scalr-api-access-token.1',
+  'betterleaks/segment-public-api-token.1',
+  'betterleaks/slack-session-cookie',
+  'betterleaks/slack-session-token',
+  'betterleaks/snowflake-programmatic-access-token.1',
+  'betterleaks/sslmate-api-key.1',
+  'betterleaks/stability-ai-api-key',
+  'betterleaks/supabase-management-token',
+  'betterleaks/supabase-project-api-key',
+  'betterleaks/tableau-personal-access-token.1',
+  'betterleaks/tailscale-api-key.1',
+  'betterleaks/telnyx-api-v2-key.1',
+  'betterleaks/temporal-cloud-api-key.1',
+  'betterleaks/thunderstore-api-token.1',
+  'betterleaks/togetherai-api-key',
+  'betterleaks/unkey-root-key.1',
+  'betterleaks/upcloud-api-token',
+  'betterleaks/upstage-api-key',
+  'betterleaks/upstash-redis-rest-token.1',
+  'betterleaks/val-town-api-token.1',
+  'betterleaks/vercel-ai-gateway-key',
+  'betterleaks/vercel-api-token',
+  'betterleaks/vercel-app-access-token',
+  'betterleaks/vercel-app-refresh-token',
+  'betterleaks/vercel-integration-token',
+  'betterleaks/vercel-personal-access-token',
+  'betterleaks/virustotal-api-key.1',
+  'betterleaks/voyageai-api-key',
+  'betterleaks/vultr-api-key.1',
+  'betterleaks/wakatime-api-key.1',
+  'betterleaks/wakatime-api-key.2',
+  'betterleaks/weatherstack-api-key.1',
+  'betterleaks/weights-and-biases-api-key',
+  'betterleaks/weights-and-biases-api-key-v1',
+  'betterleaks/wiz-client-secret.1',
+  'betterleaks/woocommerce-consumer-secret.1',
+  'betterleaks/workato-developer-api-token.1',
+  'betterleaks/workos-production-api-key.1',
+  'betterleaks/xai-api-key',
+  'betterleaks/xendit-production-api-key.1',
+  'betterleaks/zai-api-key',
+  'betterleaks/zoho-client-secret.1',
+  'betterleaks/zoho-oauth-token.1',
+  'betterleaks/zoho-zapi-key.1',
+  'betterleaks/zuplo-consumer-api-key.1',
   'catalog/aws',
   'catalog/azure',
   'catalog/google',
   'cli-password',
   'context',
   'cookie',
+  'credential-pair',
   'databricks',
   'digitalocean',
   'discord',
@@ -645,12 +1067,16 @@ export const credentialRules = new Set([
   'jwt',
   'known-secret',
   'linear',
+  'login-call',
   'mailchimp',
+  'marker-token',
+  'named-value',
   'netrc',
   'notion',
   'npm',
   'nuget',
   'openai',
+  'password-hash',
   'private-key',
   'putty-private-key',
   'pypi',

package/src/rules.js

@@ -50,6 +50,14 @@ export const serviceRules = [
     /[MN][A-Za-z0-9_-]{23}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{20}[A-Za-z0-9_-]*/g,
   ],
   ['huggingface', /hf_[A-Za-z0-9]{20}[A-Za-z0-9]*/g],
+  // All-caps CI/test credentials (`SYNTHETIC_TOKEN_ALPHA_123456`) carry only
+  // a semantic marker. A digit separates them from constant names
+  // (`KNOWN_LOCAL_TOKEN_ENV_VARS`); a key (`NAME_TOKEN_2=`) or a reference
+  // (`$NAME_TOKEN_2`, `secrets.NAME_TOKEN_2`) is a name, not a value.
+  [
+    'marker-token',
+    /(?<![A-Za-z0-9_$.{%-])(?=[A-Z_-]{0,200}\d)(?:[A-Z0-9]{1,32}[_-]){1,8}(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API[_-]?KEY)(?:[_-][A-Z0-9]{1,32}){1,8}(?![A-Za-z0-9_$-])(?![ \t]*(?:[:=]|\}))/g,
+  ],
   ['shopify', /shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g],
   ['databricks', /dapi[a-fA-F0-9]{32}/g],
   ['square', /sq0(?:atp|csp)-[A-Za-z0-9_-]{20}[A-Za-z0-9_-]*/g],