@octocodeai/octocode-engine 16.5.0

package/dist/security/regexes/ai-providers.js

@@ -0,0 +1,177 @@
+export const aiProviderPatterns = [
+    {
+        name: 'openaiApiKeyLegacy',
+        description: 'OpenAI API key (legacy format)',
+        regex: /\b(sk-[a-zA-Z0-9_-]+T3BlbkFJ[a-zA-Z0-9_-]+)\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openaiProjectApiKey',
+        description: 'OpenAI project-scoped API key',
+        regex: /\bsk-proj-[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openaiServiceAccountKey',
+        description: 'OpenAI service account API key',
+        regex: /\bsk-svcacct-[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openaiAdminKey',
+        description: 'OpenAI admin API key',
+        regex: /\bsk-admin-[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openaiOrgId',
+        description: 'OpenAI organization ID',
+        regex: /\borg-[a-zA-Z0-9]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'groqApiKey',
+        description: 'Groq API key',
+        regex: /\bgsk_[a-zA-Z0-9-_]{51,52}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'cohereApiKey',
+        description: 'Cohere API key',
+        regex: /\bco-[a-zA-Z0-9-_]{38,64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'huggingFaceToken',
+        description: 'Hugging Face API token',
+        regex: /\bhf_[a-zA-Z0-9]{34}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'perplexityApiKey',
+        description: 'Perplexity AI API key',
+        regex: /\bpplx-[a-zA-Z0-9]{30,64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'replicateApiToken',
+        description: 'Replicate API token',
+        regex: /\br8_[a-zA-Z0-9]{30,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'anthropicApiKey',
+        description: 'Anthropic API key',
+        regex: /\bsk-ant-(?:admin01|api03|sid01)-[\w-]{80,120}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mistralApiKey',
+        description: 'Mistral AI API key',
+        regex: /\b(?:mistral-|mist_)[a-zA-Z0-9]{32,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'tavilyApiKey',
+        description: 'Tavily API key',
+        regex: /\btvly-[a-zA-Z0-9]{30,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'deepseekApiKey',
+        description: 'DeepSeek API key',
+        regex: /\b['"]?(?:DEEPSEEK|deepseek|DeepSeek)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?sk-[a-zA-Z0-9]{32,64}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'togetherApiKey',
+        description: 'Together AI API key',
+        regex: /\b['"]?(?:TOGETHER|together)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{40,64}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'fireworksApiKey',
+        description: 'Fireworks AI API key',
+        regex: /\b['"]?(?:FIREWORKS|fireworks)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{40,64}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'xaiApiKey',
+        description: 'xAI (Grok) API key',
+        regex: /\bxai-[a-zA-Z0-9]{48,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openRouterApiKey',
+        description: 'OpenRouter API key',
+        regex: /\bsk-or-v1-[a-zA-Z0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'amazonBedrockApiKey',
+        description: 'Amazon Bedrock API key',
+        regex: /\bABSK[A-Za-z0-9+/]{109,269}={0,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'ai21ApiKey',
+        description: 'AI21 Labs API key',
+        regex: /\b['"]?(?:AI21|ai21)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{40,64}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'stabilityApiKey',
+        description: 'Stability AI API key',
+        regex: /\b['"]?(?:STABILITY|stability|Stability)_?(?:AI|ai)?_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?sk-[a-zA-Z0-9]{48,}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'voyageApiKey',
+        description: 'Voyage AI API key',
+        regex: /\bpa-[a-zA-Z0-9]{40,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'elevenLabsApiKey',
+        description: 'ElevenLabs API key (context-based detection)',
+        regex: /\b['"]?(?:ELEVENLABS|elevenlabs)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{32,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'assemblyaiApiKey',
+        description: 'AssemblyAI API key',
+        regex: /\b['"]?(?:ASSEMBLYAI|assemblyai|AssemblyAI)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{32}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'pineconeApiKeyPrefixed',
+        description: 'Pinecone API key (prefixed format)',
+        regex: /\bpcsk_[a-zA-Z0-9_]{50,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'wandbApiKey',
+        description: 'Weights & Biases API key',
+        regex: /\b[a-f0-9]{40}\b/g,
+        matchAccuracy: 'medium',
+        fileContext: /wandb/i,
+    },
+    {
+        name: 'cometApiKey',
+        description: 'Comet ML API key',
+        regex: /\b['"]?(?:COMET|comet)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{32,64}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'langchainApiKey',
+        description: 'LangChain/LangSmith API key',
+        regex: /\blsv2_[a-zA-Z0-9_]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'unstructuredApiKey',
+        description: 'Unstructured.io API key',
+        regex: /\b['"]?(?:UNSTRUCTURED|unstructured)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{32,}['"]?\b/g,
+        matchAccuracy: 'medium',
+    },
+];

package/dist/security/regexes/analytics.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const analyticsModernPatterns: SensitiveDataPattern[];

package/dist/security/regexes/analytics.js

@@ -0,0 +1,50 @@
+export const analyticsModernPatterns = [
+    {
+        name: 'vercelToken',
+        description: 'Vercel API token (new prefixed formats: vcp/vci/vca/vcr/vck)',
+        regex: /\b(?:vcp|vci|vca|vcr|vck)_[a-zA-Z0-9]{24,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'posthogApiKey',
+        description: 'PostHog API key',
+        regex: /\bphc_[a-zA-Z0-9_-]{39}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'posthogPersonalApiKey',
+        description: 'PostHog personal API key',
+        regex: /\bphx_[a-zA-Z0-9_-]{39}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'posthogFeatureFlagsSecureApiKey',
+        description: 'PostHog feature flags secure API key',
+        regex: /\bphs_[a-zA-Z0-9_-]{39}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'posthogOauthAccessToken',
+        description: 'PostHog OAuth access token',
+        regex: /\bpha_[a-zA-Z0-9_-]{39}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'posthogOauthRefreshToken',
+        description: 'PostHog OAuth refresh token',
+        regex: /\bphr_[a-zA-Z0-9_-]{39}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'datadogApiKey',
+        description: 'Datadog API and application keys (with context)',
+        regex: /\bdatadog[\s\w]*(?:api|app)[\s\w]*key[\s:=]*["']?[a-fA-F0-9]{32,40}["']?/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'honeycombApiKey',
+        description: 'Honeycomb API key',
+        regex: /\bhcaik_[a-zA-Z0-9_-]{32,64}\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/auth-crypto.d.ts

@@ -0,0 +1,6 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const authPatterns: SensitiveDataPattern[];
+export declare const codeConfigPatterns: SensitiveDataPattern[];
+export declare const cryptographicPatterns: SensitiveDataPattern[];
+export declare const privateKeyPatterns: SensitiveDataPattern[];
+export declare const genericSecretPatterns: SensitiveDataPattern[];

package/dist/security/regexes/auth-crypto.js

@@ -0,0 +1,255 @@
+export const authPatterns = [
+    {
+        name: 'jwtToken',
+        description: 'JWT (JSON Web Token - 3-part)',
+        regex: /\b(ey[a-zA-Z0-9]{17,}\.ey[a-zA-Z0-9/_-]{17,}\.(?:[a-zA-Z0-9/_-]{10,}={0,2})?)\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sessionIds',
+        description: 'Session IDs / Cookies',
+        regex: /(?:JSESSIONID|PHPSESSID|ASP\.NET_SessionId|connect\.sid|session_id)=([a-zA-Z0-9%:._-]+)/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'googleOauthToken',
+        description: 'Google OAuth token',
+        regex: /\bya29\.[a-zA-Z0-9_-]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'googleOauthRefreshToken',
+        description: 'Google OAuth refresh token',
+        regex: /\b['"]?(?:GOOGLE|google)?_?(?:OAUTH|oauth)?_?(?:REFRESH|refresh)?_?(?:TOKEN|token)['"]?\s*(?::|=>|=)\s*['"]?(1\/\/0[a-zA-Z0-9._-]{40,})['"]?\b/g,
+        matchAccuracy: 'high',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'onePasswordSecretKey',
+        description: '1Password secret key',
+        regex: /\bA3-[A-Z0-9]{6}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'onePasswordServiceAccountToken',
+        description: '1Password service account token',
+        regex: /\bops_eyJ[a-zA-Z0-9+/]+={0,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'jsonWebTokenEnhanced',
+        description: 'JSON Web Token with enhanced detection',
+        regex: /\bey[a-zA-Z0-9]+\.ey[a-zA-Z0-9/_-]+\.(?:[a-zA-Z0-9/_-]+={0,2})?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'authressServiceClientAccessKey',
+        description: 'Authress service client access key',
+        regex: /\b(?:sc|ext|scauth|authress)_[a-z0-9]+\.[a-z0-9]+\.acc[_-][a-z0-9-]+\.[a-z0-9+/_=-]+\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'auth0ClientSecret',
+        description: 'Auth0 client secret',
+        regex: /\b['"]?(?:AUTH0|auth0)_?(?:CLIENT|client)?_?(?:SECRET|secret)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9_-]{32,64}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'auth0ManagementToken',
+        description: 'Auth0 Management API token',
+        regex: /\b['"]?(?:AUTH0|auth0)_?(?:MANAGEMENT|management|MGMT)?_?(?:API)?_?(?:TOKEN|token)['"]?\s*(?::|=>|=)\s*['"]?eyJ[a-zA-Z0-9_-]{50,}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'supertokensApiKey',
+        description: 'SuperTokens API key',
+        regex: /\b['"]?(?:SUPERTOKENS|supertokens)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9_-]{30,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'basicAuthHeader',
+        description: 'Basic authentication header with credentials',
+        regex: /\bBasic\s+[A-Za-z0-9+/]{20,}={0,2}\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'bearerAuthHeader',
+        description: 'HTTP Bearer authentication header with token',
+        regex: /\bAuthorization\s*:\s*Bearer\s+[A-Za-z0-9._~+/=-]{20,}\b/gi,
+        matchAccuracy: 'medium',
+    },
+];
+export const codeConfigPatterns = [
+    {
+        name: 'jwtSecrets',
+        description: 'JWT secrets',
+        regex: /\bjwt[_-]?secret\s*[:=]\s*['"][^'"]{16,}['"]\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'kubernetesSecrets',
+        description: 'Kubernetes secrets in YAML',
+        regex: /\bkind:\s*["']?Secret["']?[\s\S]{0,2000}?\bdata:\s*[\s\S]{0,2000}?[a-zA-Z0-9_-]+:\s*[a-zA-Z0-9+/]{16,}={0,3}\b/gi,
+        matchAccuracy: 'high',
+        fileContext: /\.ya?ml$/i,
+    },
+    {
+        name: 'dockerComposeSecrets',
+        description: 'Docker Compose secrets',
+        regex: /\b(?:MYSQL_ROOT_PASSWORD|POSTGRES_PASSWORD|REDIS_PASSWORD|MONGODB_PASSWORD)\s*[:=]\s*['"][^'"]{4,}['"]\b/gi,
+        matchAccuracy: 'medium',
+        fileContext: /docker-compose\.ya?ml$/i,
+    },
+    {
+        name: 'springBootSecrets',
+        description: 'Spring Boot application secrets',
+        regex: /\b(?:spring\.datasource\.password|spring\.security\.oauth2\.client\.registration\..*\.client-secret)\s*[:=]\s*['"][^'"]{4,}['"]\b/gi,
+        matchAccuracy: 'medium',
+        fileContext: /(?:application|bootstrap)(?:-\w+)?\.(?:properties|ya?ml)$/i,
+    },
+    {
+        name: 'dotnetConnectionStrings',
+        description: '.NET connection strings with credentials',
+        regex: /\b(?:ConnectionStrings?|connectionString)\s*[:=]\s*['"][^'"]*(?:password|pwd)\s*=\s*[^;'"]{4,}[^'"]*['"]\b/gi,
+        matchAccuracy: 'medium',
+        fileContext: /(?:appsettings|web\.config).*\.(?:json|config)$/i,
+    },
+    {
+        name: 'base64EncodedSecrets',
+        description: 'Base64 encoded secrets in config',
+        regex: /\b(?:secret|password|key|token)[_-]?(?:base64|encoded)?\s*[:=]\s*['"][A-Za-z0-9+/]{32,}={0,3}['"]\b/gi,
+        matchAccuracy: 'medium',
+    },
+];
+export const cryptographicPatterns = [
+    {
+        name: 'rsaPrivateKey',
+        description: 'RSA private key',
+        regex: /-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(?:RSA\s+)?PRIVATE\s+KEY-----/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pkcs8PrivateKey',
+        description: 'PKCS#8 private key',
+        regex: /\b-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----\s*[\s\S]*?-----END (?:ENCRYPTED )?PRIVATE KEY-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'ecPrivateKey',
+        description: 'Elliptic Curve private key',
+        regex: /\b-----BEGIN EC PRIVATE KEY-----\s*[\s\S]*?-----END EC PRIVATE KEY-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dsaPrivateKey',
+        description: 'DSA private key',
+        regex: /\b-----BEGIN DSA PRIVATE KEY-----\s*[\s\S]*?-----END DSA PRIVATE KEY-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'opensshPrivateKey',
+        description: 'OpenSSH private key',
+        regex: /-----BEGIN\s+OPENSSH\s+PRIVATE\s+KEY-----[\s\S]*?-----END\s+OPENSSH\s+PRIVATE\s+KEY-----/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sshPrivateKeyEncrypted',
+        description: 'SSH private key (SSH2 encrypted format)',
+        regex: /\b-----BEGIN SSH2 ENCRYPTED PRIVATE KEY-----\s*[\s\S]*?-----END SSH2 ENCRYPTED PRIVATE KEY-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'puttyPrivateKey',
+        description: 'PuTTY private key file',
+        regex: /\bPuTTY-User-Key-File-[23]:\s*[\s\S]*?Private-MAC:\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pgpPrivateKey',
+        description: 'PGP private key block',
+        regex: /\b-----BEGIN PGP PRIVATE KEY BLOCK-----\s*[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'firebaseServiceAccountPrivateKey',
+        description: 'Firebase service account private key (JSON format)',
+        regex: /\b"private_key":\s*"-----BEGIN PRIVATE KEY-----\\n[a-zA-Z0-9+/=\\n]+\\n-----END PRIVATE KEY-----"\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openvpnClientPrivateKey',
+        description: 'OpenVPN client private key',
+        regex: /\b<key>\s*-----BEGIN[^<]*-----END[^<]*<\/key>\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dhParameters',
+        description: 'Diffie-Hellman parameters',
+        regex: /\b-----BEGIN DH PARAMETERS-----\s*[\s\S]*?-----END DH PARAMETERS-----\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'ageSecretKey',
+        description: 'Age encryption secret key',
+        regex: /\bAGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'vaultBatchToken',
+        description: 'HashiCorp Vault batch token',
+        regex: /\bhvb\.[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'vaultServiceToken',
+        description: 'HashiCorp Vault service token',
+        regex: /\bhvs\.[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'vaultPeriodicToken',
+        description: 'HashiCorp Vault periodic token',
+        regex: /\bhvp\.[a-zA-Z0-9_-]{20,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'base64PrivateKeyContent',
+        description: 'Base64 encoded private key content',
+        regex: /\b(?:private[_-]?key|secret[_-]?key)\s*[:=]\s*["'][A-Za-z0-9+/]{64,}={0,2}["']\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'hexEncodedKey',
+        description: 'Hexadecimal encoded cryptographic key',
+        regex: /\b(?:key|secret)\s*[:=]\s*["'][a-fA-F0-9]{32,}["']\b/gi,
+        matchAccuracy: 'medium',
+    },
+];
+export const privateKeyPatterns = [
+    {
+        name: 'privateKeyPem',
+        description: 'Private key in PEM format (all key types)',
+        regex: /-----BEGIN\s+(?:(?:RSA|DSA|EC|OPENSSH|ENCRYPTED)\s+)?PRIVATE\s+KEY(?:\s+BLOCK)?-----[\s\S]*?-----END\s+(?:(?:RSA|DSA|EC|OPENSSH|ENCRYPTED)\s+)?PRIVATE\s+KEY(?:\s+BLOCK)?-----/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pgpPrivateKeyBlock',
+        description: 'PGP private key block (BEGIN to END)',
+        regex: /-----BEGIN\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----[\s\S]*?-----END\s+PGP\s+PRIVATE\s+KEY\s+BLOCK-----/g,
+        matchAccuracy: 'high',
+    },
+];
+export const genericSecretPatterns = [
+    {
+        name: 'credentialsInUrl',
+        description: 'Credentials embedded in URL',
+        regex: /\b[a-zA-Z]{3,10}:\/\/[^\\/\s:@]{3,20}:[^\\/\s:@]{3,20}@[^\s'"]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'envVarSecrets',
+        description: 'Environment variable secrets (KEY, SECRET, TOKEN, PASSWORD)',
+        regex: /\b(?:\w+_)?(?:SECRET|secret|password|key|token|jwt_secret)(?:_\w+)?\s*=\s*["'][^"']{16,}["']/gi,
+        matchAccuracy: 'medium',
+    },
+];

package/dist/security/regexes/aws.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const awsPatterns: SensitiveDataPattern[];

package/dist/security/regexes/aws.js

@@ -0,0 +1,68 @@
+export const awsPatterns = [
+    {
+        name: 'awsAccessKeyId',
+        description: 'AWS access key ID',
+        regex: /\b((?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16})\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsAccountId',
+        description: 'AWS account ID',
+        regex: /\b['"]?(?:AWS|aws|Aws)?_?(?:ACCOUNT|account|Account)_?(?:ID|id|Id)?['"]?\s*(?::|=>|=)\s*['"]?[0-9]{12}['"]?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsAppSyncApiKey',
+        description: 'AWS AppSync GraphQL API key',
+        regex: /\bda2-[a-z0-9]{26}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsIamRoleArn',
+        description: 'AWS IAM role ARN',
+        regex: /\barn:aws:iam::[0-9]{12}:role\/[a-zA-Z0-9_+=,.@-]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsLambdaFunctionArn',
+        description: 'AWS Lambda function ARN',
+        regex: /\barn:aws:lambda:[a-z0-9-]+:[0-9]{12}:function:[a-zA-Z0-9_-]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsMwsAuthToken',
+        description: 'AWS MWS authentication token',
+        regex: /\bamzn\.mws\.[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsS3BucketArn',
+        description: 'AWS S3 bucket ARN',
+        regex: /\barn:aws:s3:::[a-zA-Z0-9._-]+\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'alibabaAccessKeyId',
+        description: 'Alibaba Cloud AccessKey ID',
+        regex: /\bLTAI[a-zA-Z0-9]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsSecretAccessKey',
+        description: 'AWS secret access key',
+        regex: /\b['"]?(?:AWS|aws|Aws)?_?(?:SECRET|secret|Secret)_?(?:ACCESS|access|Access)_?(?:KEY|key|Key)['"]?\s*(?::|=>|=)\s*['"]?[A-Za-z0-9/+=]{40}['"]?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsSessionToken',
+        description: 'AWS session token',
+        regex: /\b['"]?(?:AWS|aws|Aws)?_?(?:SESSION|session|Session)_?(?:TOKEN|token|Token)['"]?\s*(?::|=>|=)\s*['"]?[A-Za-z0-9/+=]{200,}['"]?\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'awsSecretsManagerArn',
+        description: 'AWS Secrets Manager secret ARN',
+        regex: /\barn:aws:secretsmanager:[a-z0-9-]+:[0-9]{12}:secret:[a-zA-Z0-9/_+=.@-]+\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/cloudProviders.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const cloudProviderPatterns: SensitiveDataPattern[];