@link-foundation/sensitive-data-sanitizer 0.20.0 → 0.21.1

package/src/placeholders.js

@@ -1,10 +1,14 @@
 import { failure, REDACTED, escapePattern } from './detection.js';
-import { reservedPlaceholderTypes } from './placeholder-types.js';
+import {
+  namespacePattern,
+  placeholderTokens,
+  containsPlaceholder,
+  escapedPlaceholderTokens,
+} from './placeholder-types.js';
 import { samePersonal } from './personal-variants.js';
 import { isNameForm } from './russian-names.js';
 import { nameAliases } from './transliteration.js';
 import { createHash } from 'node:crypto';
-import { jsonStringLiterals } from './json-string-runs.js';
 import {
   createRestoreMap,
   validateRestoreMap,
@@ -35,8 +39,15 @@ const transforms = (options) =>
     ...Object.values(options.transformations ?? {}),
   ].filter((t) => t?.mode === 'placeholder');
 
+const existingModes = new Set(['error', 'keep']);
 export function validatePlaceholder(transform) {
   validatePlaceholderFormat(transform.format ?? transform.map?.format);
+  if (
+    transform.existing !== undefined &&
+    !existingModes.has(transform.existing)
+  ) {
+    throw failure('ERR_CONFIG');
+  }
   if (
     transform.credentials !== undefined &&
     typeof transform.credentials !== 'boolean'
@@ -67,12 +78,21 @@ export function initializePlaceholders(options) {
     selected.some(
       (t) =>
         (t.map !== undefined && t.map !== first.map) ||
-        (t.format !== undefined && t.format !== map.format)
+        (t.format !== undefined && t.format !== map.format) ||
+        (t.existing ?? 'error') !== (first.existing ?? 'error')
     )
   ) {
     throw failure('ERR_CONFIG');
   }
-  return { ...options, [placeholderState]: { map, keep: first.map !== false } };
+  return {
+    ...options,
+    [placeholderState]: {
+      map,
+      keep: first.map !== false,
+      existing: first.existing ?? 'error',
+      floors: new Map(),
+    },
+  };
 }
 export function placeholderKnown(options) {
   const map = options[placeholderState]?.map;
@@ -305,31 +325,112 @@ function addNamePatterns(person, patterns, bareForms) {
     }
   }
 }
+const placeholderType = (finding) => {
+  if (finding.category === 'credential') {
+    return 'CREDENTIAL';
+  }
+  const type =
+    finding.type === 'JSON_VALUE'
+      ? (finding.valueType ?? 'SENSITIVE')
+      : finding.type;
+  return type === 'DATE_OF_BIRTH' ? 'DATE' : type;
+};
+// Types beyond the reserved list that this call can turn into tokens.
+function callPattern(findings, options) {
+  const transform = transforms(options)[0];
+  const map = options[placeholderState]?.map;
+  return namespacePattern(
+    map?.format ?? transform?.format ?? transform?.map?.format,
+    [
+      ...findings.map(placeholderType),
+      ...(options.knownPersonal ?? []).map((e) => e.type),
+      ...(map?.entries ?? []).map((e) => e.type),
+    ]
+  );
+}
+const keepsExisting = (options) => transforms(options)[0]?.existing === 'keep';
+// Default tokens always contain a hyphen followed by a positive number.
+// Escapes may conceal either character, and custom formats need the full scan.
+function mayContainPlaceholder(text, options, escaped = false) {
+  const transform = transforms(options)[0];
+  const format =
+    options[placeholderState]?.map.format ??
+    transform?.format ??
+    transform?.map?.format ??
+    '{Type}-{n}';
+  return (
+    format !== '{Type}-{n}' ||
+    /-[1-9]/u.test(text) ||
+    (escaped && text.includes('\\'))
+  );
+}
+// With `existing: 'keep'` the tokens of an earlier pass stay as they are, so
+// findings made only of those tokens are not replaced again.
+export function keptPlaceholderSpans(text, findings, options) {
+  if (!keepsExisting(options) || !mayContainPlaceholder(text, options)) {
+    return [];
+  }
+  return placeholderTokens(text, callPattern(findings, options));
+}
+const significant = /[\p{L}\p{N}]/u;
+// A finding made only of kept tokens is kept, and one that starts or ends
+// inside a kept token is trimmed to the text beside it.
+function trimmedToLoose(finding, inside, loose) {
+  let { start, end } = finding;
+  if (inside(start)) {
+    while (start < end && !loose(start)) {
+      start = inside(start)?.end ?? start + 1;
+    }
+  }
+  if (inside(end - 1)) {
+    while (end > start && !loose(end - 1)) {
+      end = inside(end - 1)?.start ?? end - 1;
+    }
+  }
+  return start === finding.start && end === finding.end
+    ? finding
+    : { ...finding, start, end };
+}
+export function keptPlaceholderFinding(text, finding, tokens) {
+  const overlapping = tokens.filter(
+    (token) => token.start < finding.end && token.end > finding.start
+  );
+  if (finding.category !== 'personal' || !overlapping.length) {
+    return finding;
+  }
+  const inside = (i) =>
+    overlapping.find((token) => token.start <= i && token.end > i);
+  const loose = (i) => !inside(i) && significant.test(text[i]);
+  const { start, end } = finding;
+  if (!Array.from({ length: end - start }, (_, i) => start + i).some(loose)) {
+    return { ...finding, kept: 'fake' };
+  }
+  return finding.type === 'JSON_VALUE'
+    ? finding
+    : trimmedToLoose(finding, inside, loose);
+}
 export function preparePlaceholderText(text, findings, options) {
   const state = options[placeholderState];
   if (!state || !hasPlaceholders(options)) {
     return;
   }
-  const types = new Set([
-    ...reservedPlaceholderTypes(),
-    ...findings.map((f) =>
-      f.category === 'credential' ? 'CREDENTIAL' : f.type
-    ),
-    ...(options.knownPersonal ?? []).map((e) => e.type),
-    ...state.map.entries.map((e) => e.type),
-  ]);
-  const [before, after] = state.map.format.split('{n}');
-  const tokens = [...types].map(
-    (type) =>
-      `${escapePattern(
-        placeholderToken(type, 1, before)
-      )}[1-9][0-9]*${escapePattern(placeholderToken(type, 1, after))}`
-  );
-  const pattern = new RegExp(
-    `(?<![\\p{L}\\p{M}\\p{N}_])(?:${tokens.join('|')})(?![\\p{L}\\p{M}\\p{N}_])`,
-    'u'
-  );
-  if (namespaceCollision(text, pattern)) {
+  const pattern = mayContainPlaceholder(text, options, true)
+    ? callPattern(findings, options)
+    : undefined;
+  if (pattern && state.existing === 'keep') {
+    // New values are numbered after the highest kept number of their type.
+    for (const token of [
+      ...placeholderTokens(text, pattern),
+      ...escapedPlaceholderTokens(text, pattern),
+    ]) {
+      for (const type of token.types) {
+        state.floors.set(
+          type,
+          Math.max(state.floors.get(type) ?? 0, token.number)
+        );
+      }
+    }
+  } else if (pattern && namespaceCollision(text, pattern)) {
     throw failure('ERR_PLACEHOLDER_COLLISION');
   }
   state.people = [
@@ -345,20 +446,11 @@ export function preparePlaceholderText(text, findings, options) {
   ];
 }
 function namespaceCollision(text, pattern) {
-  if (pattern.test(text)) {
-    return true;
-  }
   // JSON escape spellings must not conceal existing tokens in keys or values.
-  for (const literal of jsonStringLiterals(text)) {
-    try {
-      if (pattern.test(JSON.parse(literal))) {
-        return true;
-      }
-    } catch {
-      // Ordinary free text may include strings that are not JSON literals.
-    }
-  }
-  return false;
+  return (
+    containsPlaceholder(text, pattern) ||
+    escapedPlaceholderTokens(text, pattern).length > 0
+  );
 }
 
 export function canonicalPerson(value, people) {
@@ -381,7 +473,18 @@ export function canonicalPerson(value, people) {
       person,
     ])
   );
-  return distinct.size === 1 ? [...distinct.values()][0] : value;
+  if (distinct.size === 1) {
+    return [...distinct.values()][0];
+  }
+  // `Иванов Иван` and `Иванов Иван Петрович` are one mention in two lengths:
+  // the unique name that holds the words of every other match is the person.
+  const words = (person) =>
+    new Set((person.match(/\p{L}+/gu) ?? []).map((w) => w.toLowerCase()));
+  const fullest = [...distinct.values()].filter((person) => {
+    const own = words(person);
+    return matches.every((other) => [...words(other)].every((w) => own.has(w)));
+  });
+  return fullest.length === 1 ? fullest[0] : value;
 }
 function canonicalKnown(value, type, options, state) {
   const known = (options.knownPersonal ?? []).filter(
@@ -427,12 +530,7 @@ export function placeholderReplacement(value, finding, transform, options) {
     throw failure('ERR_CONFIG');
   }
   const { map } = state;
-  const type =
-    finding.category === 'credential'
-      ? 'CREDENTIAL'
-      : finding.type === 'DATE_OF_BIRTH'
-        ? 'DATE'
-        : finding.type;
+  const type = placeholderType(finding);
   const canonical = canonicalKnown(value, type, options, state);
   const candidates = map.entries.filter(
     (entry) => entry.type === type && related(canonical, entry)
@@ -451,7 +549,7 @@ export function placeholderReplacement(value, finding, transform, options) {
       1 +
       map.entries.reduce(
         (n, e) => (e.type === type ? Math.max(n, e.number) : n),
-        0
+        state.floors?.get(type) ?? 0
       );
     const token = placeholderToken(type, number, map.format);
     if (
@@ -543,5 +641,6 @@ export function discardPlaceholderState(options) {
     state.map.entries.length = 0;
     state.map.documents.length = 0;
     state.people = [];
+    state.floors?.clear();
   }
 }

package/src/projection.js

@@ -1,6 +1,7 @@
 // Map a detection view back to the original UTF-16 offsets. Normalization
 // never writes to the original text, and offsets remain valid after emoji.
 import { failure } from './detection.js';
+import { htmlTag, inlineTags } from './html-tags.js';
 
 // Unicode Nd zero codepoints. NFKC already maps mathematical/fullwidth digits;
 // other numeral systems need explicit conversion with original-source spans.
@@ -25,14 +26,6 @@ function asciiDigits(value) {
 // carry meaning inside a token, so they are removed from the detection view.
 const invisible =
   /^[\0\u00ad\u061c\u180e\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]$/u;
-// HTML formatting tags split tokens (`SECRET_</span><span>REST`). Inline tags
-// are dropped and block tags become line breaks. Only presentation attributes
-// are allowed, so other attribute values (URLs, data-*) stay in the view.
-const inlineTags =
-  'abbr|b|cite|code|del|em|font|i|ins|kbd|mark|q|s|samp|small|span|strong|sub|sup|tt|u|var';
-const blockTags =
-  'blockquote|br|dd|div|dt|h[1-6]|hr|li|ol|p|pre|table|tbody|td|th|thead|tr|ul';
-const htmlTag = String.raw`<\/?(?:${inlineTags}|${blockTags})(?:\s+(?:class|dir|lang|style)="[^"<>=]*")*\s*\/?>`;
 const inlineTag = new RegExp(String.raw`^<\/?(?:${inlineTags})[\s/>]`);
 // TruffleHog-style escape runs: `U+0074 U+006F ...` and CSS `\74 \6f ...`.
 // Runs need four or more units so prose such as "U+200B" stays untouched.

package/src/proper-names.js

@@ -1,5 +1,6 @@
 import { failure } from './detection.js';
 import { documentDateRange } from './document-dates.js';
+import { keepsProseWord } from './prose-words.js';
 
 const scriptPatterns = new Map();
 const dateRange = new RegExp(`\\(${documentDateRange}\\)`, 'u');
@@ -113,6 +114,21 @@ function quotedSpans(text, emit) {
 function pathToken(value) {
   return value.includes('/') || value.includes('\\');
 }
+// Compact typed document findings, such as `ООО «Ромашка»` after `работал в`
+// or `Казани` after `живу в`, name what the prose tokens inside them are.
+const typedDocumentTypes = new Set([
+  'ORGANIZATION',
+  'LOCATION',
+  'EDUCATION',
+  'PERSON',
+]);
+function compactTyped(text, finding) {
+  return (
+    typedDocumentTypes.has(finding.type) &&
+    finding.end - finding.start <= 160 &&
+    !/[\t\r\n]/u.test(text.slice(finding.start, finding.end))
+  );
+}
 // Keep existing document coverage outside the new replacements. Two naturally
 // ordered runs (quotes, then tokens) provide an interval index without sorting.
 // Overlapping broad document spans must not merge separate prose replacements.
@@ -131,28 +147,48 @@ export function detectProseAndDocuments(text, emit, options, detectDocuments) {
         runs.push([]);
       }
       runs.at(-1).push(finding);
-      emit(finding);
     },
     options
   );
+  const covered = new Set();
   detectDocuments(
     text,
     (finding) => {
+      const overlapping = runs.flatMap((run) => overlapsRun(run, finding));
       if (completeTypes.has(finding.type)) {
         // Contacts and identifiers are indivisible: a domain or series alone
         // cannot safely replace the complete value detected by document rules.
         emit(finding);
         complete++;
-      } else if (!runs.some((run) => overlapsRun(run, finding))) {
+      } else if (!overlapping.length) {
         emit(finding);
+      } else if (
+        compactTyped(text, finding) &&
+        overlapping.every(
+          (prose) => prose.start >= finding.start && prose.end <= finding.end
+        )
+      ) {
+        emit(finding);
+        overlapping.forEach((prose) => covered.add(prose));
       } else {
         suppressed++;
       }
     },
     options
   );
-  options.debug?.({ event: 'document-prose-overlap', complete, suppressed });
+  for (const finding of runs.flat()) {
+    if (!covered.has(finding)) {
+      emit(finding);
+    }
+  }
+  options.debug?.({
+    event: 'document-prose-overlap',
+    complete,
+    suppressed,
+    typed: covered.size,
+  });
 }
+// The prose findings of one ordered run that overlap a document finding.
 function overlapsRun(run, finding) {
   let low = 0,
     high = run.length;
@@ -164,7 +200,11 @@ function overlapsRun(run, finding) {
       high = mid;
     }
   }
-  return low < run.length && run[low].start < finding.end;
+  const overlapping = [];
+  for (let i = low; i < run.length && run[i].start < finding.end; i++) {
+    overlapping.push(run[i]);
+  }
+  return overlapping;
 }
 export function detectProperNames(text, emit, options) {
   if (options.properNames !== 'capitalized' || !proseData(text, options)) {
@@ -199,7 +239,10 @@ export function detectProperNames(text, emit, options) {
     while (range && range.index + range[0].length <= start) {
       range = ranges.next().value;
     }
-    if (preserveToken(text, raw, value, start, end, range)) {
+    if (
+      preserveToken(text, raw, value, start, end, range) ||
+      keepsProseWord(text, value, start, end, options)
+    ) {
       continue;
     }
     const type = tokenType(value);

package/src/prose-words.js

@@ -0,0 +1,116 @@
+import { isNameForm } from './russian-names.js';
+import { compiledVocabulary, defaultVocabulary } from './vocabulary.js';
+
+// Words that are capitalized by position or politeness in prose but identify
+// nobody. `properNames: 'capitalized'` leaves them readable. Any word that is
+// also a given name form (`Вера`, `Любовь`, `Will`) is removed from the lists,
+// so a list entry can never keep a name.
+const fold = (word) => word.toLowerCase().replaceAll('ё', 'е');
+const words = (list) =>
+  new Set(
+    list
+      .split(/\s+/u)
+      .filter(Boolean)
+      .map(fold)
+      .filter((word) => !isNameForm(word))
+  );
+
+// Pronouns are capitalized anywhere in polite Russian (`благодарим Вас`).
+const pronouns = words(`
+  я меня мне мной мы нас нам нами ты тебя тебе тобой вы вас вам вами
+  ваш ваша ваше вашего вашей вашему вашим ваши ваших
+  наш наша наше нашего нашей нашему нашим наши наших
+  мой моя мое моего моей моему моим мои моих
+  твой твоя твое твои он она оно они его ее ему ей им ими их них нее него
+  i me my mine we us our you your he him his she her they them their
+`);
+// Role and label words stay beside the name they introduce
+// (`Кандидат Петров Иван Сергеевич` -> `Кандидат Person-1`).
+const cues = words(`
+  кандидат кандидатка кандидата кандидату соискатель соискательница соискателя
+  сотрудник сотрудница сотрудника клиент клиентка клиента пациент пациентка
+  пациента абонент абонента заявитель заявительница заявителя студент
+  студентка гражданин гражданка господин госпожа коллега коллеги менеджер
+  директор руководитель инженер аналитик разработчик специалист водитель врач
+  candidate employee client customer patient applicant student citizen
+  colleague manager director engineer developer analyst
+`);
+// Greetings and function words are left alone only at the start of a
+// sentence, where capitalization says nothing about a name.
+const sentenceWords = words(`
+  здравствуйте здравствуй привет приветствую добрый доброе доброго добрая
+  уважаемый уважаемая уважаемые дорогой дорогая дорогие спасибо благодарю
+  благодарим пожалуйста извините простите скажите подскажите прошу просьба
+  это этот эта эти тот та те то там тут здесь где когда как что кто чем
+  почему зачем если но и а или да нет не ни в во на по с со к ко у о об от до
+  из за для при без про после перед также тоже еще уже вот так все весь вся
+  каждый сейчас сегодня вчера завтра потом затем далее итак кроме однако
+  поэтому хотя возможно конечно хорошо ладно ок буду будет был была были было
+  есть могу можно нужно надо готов готова готовы имею хочу работаю живу
+  учусь зовут звать занимаюсь звоню пишу
+  нёс перенёс принёс вёз привёз мог смог помог умер рос вырос лёг шёл пришёл
+  ушёл перешёл нашёл
+  hello hi hey dear thanks thank please regards sincerely best the this that
+  these those a an it is are was were in on at for from to with and but or if
+  when where what who why how yes no not also
+`);
+// Past tense (`Работал`, `Звонила`, `Переехали`), first person present
+// (`Работаю`, `Занимаюсь`) and third person present. A bare masculine `-л` form is also a surname shape
+// (`Шагал`), so it is kept only before a lowercase word.
+const pastTense = /^[а-яе]{2,}[аеиоуыя]л(?:а|о|и|ся|ась|ось|ись)$/u;
+const masculinePast = /^[а-яе]{3,}[аеиуыя]л$/u;
+const firstPerson = /^[а-яе]{3,}[аеуя]ю(?:сь)?$/u;
+// Third person present (`Рекомендует`, `Работает`, `Говорит`, `Учатся`).
+const thirdPerson =
+  /^[а-яе]{2,}(?:[аеиоуюя]ет|[аеиоуюя]ют|ит|ят|[аеиуя]ется|[аеиуя]ются|ится|атся|ятся)$/u;
+
+function sentenceStart(text, start) {
+  let i = start - 1;
+  while (i >= 0 && /[ \t"'«„“(—–-]/u.test(text[i])) {
+    i--;
+  }
+  return i < 0 || /[.!?…\r\n:;]/u.test(text[i]);
+}
+function nextWordLowercase(text, end) {
+  return /^[ \t]+\p{Ll}/u.test(text.slice(end, end + 4));
+}
+const defaultCues = new Set(
+  [...defaultVocabulary.roles, ...defaultVocabulary.personalLabels].map(fold)
+);
+
+// True when a word of the cue lists, including the configured `roles` and
+// `personalLabels` vocabulary, is not part of a name.
+export function isProseCue(word, options) {
+  const lower = fold(word);
+  return (
+    (cues.has(lower) ||
+      defaultCues.has(lower) ||
+      compiledVocabulary(options?.vocabulary)?.cues.has(lower)) &&
+    !isNameForm(word)
+  );
+}
+// True for a pronoun or cue word, which identify nobody wherever they stand.
+export function isCommonProseWord(word, options) {
+  return pronouns.has(fold(word)) || isProseCue(word, options);
+}
+// Decides whether a capitalized prose token is an ordinary word of the
+// sentence and not a name.
+export function keepsProseWord(text, value, start, end, options) {
+  if (!/^\p{L}+$/u.test(value) || isNameForm(value)) {
+    return false;
+  }
+  if (isCommonProseWord(value, options)) {
+    return true;
+  }
+  if (!sentenceStart(text, start)) {
+    return false;
+  }
+  const lower = fold(value);
+  return (
+    sentenceWords.has(lower) ||
+    pastTense.test(lower) ||
+    firstPerson.test(lower) ||
+    thirdPerson.test(lower) ||
+    (masculinePast.test(lower) && nextWordLowercase(text, end))
+  );
+}

package/src/public-technologies.js

@@ -0,0 +1,32 @@
+// Exact spellings only: a technology token never exempts a surrounding name,
+// caller-specified private value, credential, URL or identifier.
+export const publicTechnologies = [
+  ['Python', 'https://www.python.org/'],
+  ['SQL', 'https://www.iso.org/standard/76583.html'],
+  ['JavaScript', 'https://developer.mozilla.org/en-US/docs/Web/JavaScript'],
+  ['TypeScript', 'https://www.typescriptlang.org/'],
+  ['Java', 'https://dev.java/'],
+  ['C++', 'https://isocpp.org/'],
+  ['C#', 'https://learn.microsoft.com/en-us/dotnet/csharp/'],
+  ['PHP', 'https://www.php.net/'],
+  ['Kotlin', 'https://kotlinlang.org/'],
+  ['PostgreSQL', 'https://www.postgresql.org/'],
+  ['MySQL', 'https://www.mysql.com/'],
+  ['SQLite', 'https://sqlite.org/'],
+  ['MongoDB', 'https://www.mongodb.com/'],
+  ['Redis', 'https://redis.io/'],
+  ['Elasticsearch', 'https://www.elastic.co/elasticsearch'],
+  ['Docker', 'https://www.docker.com/'],
+  ['Kubernetes', 'https://kubernetes.io/'],
+  ['React', 'https://react.dev/'],
+  ['Vue', 'https://vuejs.org/'],
+  ['Angular', 'https://angular.dev/'],
+  ['Django', 'https://www.djangoproject.com/'],
+  ['Flask', 'https://flask.palletsprojects.com/'],
+  ['Node.js', 'https://nodejs.org/'],
+  ['TensorFlow', 'https://www.tensorflow.org/'],
+  ['PyTorch', 'https://pytorch.org/'],
+  ['AWS', 'https://aws.amazon.com/'],
+  ['Azure', 'https://azure.microsoft.com/'],
+  ['GCP', 'https://cloud.google.com/'],
+].map(([value, source]) => ({ value, source }));

package/src/public.js

@@ -1,9 +1,12 @@
 import { isIP } from 'node:net';
+import { publicTechnologies } from './public-technologies.js';
 
 // Exact public knowledge and narrowly scoped role-mail heuristics. A role name
 // alone is never an exemption on an unknown/personal domain. Credentials and
 // caller-specified private values always outrank these automatic exceptions.
 export const publicKnowledge = {
+  PROPER_NAME: publicTechnologies,
+  URL: publicTechnologies.filter((entry) => entry.value === 'Node.js'),
   PERSON: [
     ['Albert Einstein', 'Q937'],
     ['Marie Curie', 'Q7186'],

package/src/record-worker.js

@@ -1,4 +1,5 @@
 import { parentPort, workerData } from 'node:worker_threads';
+import './personal-features.js';
 import { createSanitizer, prepareStreamEngine } from './engines.js';
 import { compileKnown } from './compiled-known.js';
 

package/src/rule-catalog.js

@@ -532,6 +532,7 @@ export const builtInRules = Object.freeze([
   'mac',
   'mail-display-name',
   'mailchimp',
+  'marker-token',
   'messenger-handle',
   'messenger-label',
   'mrz',
@@ -1068,6 +1069,7 @@ export const credentialRules = new Set([
   'linear',
   'login-call',
   'mailchimp',
+  'marker-token',
   'named-value',
   'netrc',
   'notion',

package/src/rules.js

@@ -50,6 +50,14 @@ export const serviceRules = [
     /[MN][A-Za-z0-9_-]{23}[A-Za-z0-9_-]*\.[A-Za-z0-9_-]{6}\.[A-Za-z0-9_-]{20}[A-Za-z0-9_-]*/g,
   ],
   ['huggingface', /hf_[A-Za-z0-9]{20}[A-Za-z0-9]*/g],
+  // All-caps CI/test credentials (`SYNTHETIC_TOKEN_ALPHA_123456`) carry only
+  // a semantic marker. A digit separates them from constant names
+  // (`KNOWN_LOCAL_TOKEN_ENV_VARS`); a key (`NAME_TOKEN_2=`) or a reference
+  // (`$NAME_TOKEN_2`, `secrets.NAME_TOKEN_2`) is a name, not a value.
+  [
+    'marker-token',
+    /(?<![A-Za-z0-9_$.{%-])(?=[A-Z_-]{0,200}\d)(?:[A-Z0-9]{1,32}[_-]){1,8}(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API[_-]?KEY)(?:[_-][A-Z0-9]{1,32}){1,8}(?![A-Za-z0-9_$-])(?![ \t]*(?:[:=]|\}))/g,
+  ],
   ['shopify', /shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g],
   ['databricks', /dapi[a-fA-F0-9]{32}/g],
   ['square', /sq0(?:atp|csp)-[A-Za-z0-9_-]{20}[A-Za-z0-9_-]*/g],