@octocodeai/octocode-engine 16.5.0

package/dist/security/regexes/cloudProviders.js

@@ -0,0 +1,328 @@
+export const cloudProviderPatterns = [
+    {
+        name: 'googleApiKey',
+        description: 'Google API key (GCP, Gemini, Maps, YouTube, etc.)',
+        regex: /\bAIza[a-zA-Z0-9_-]{30,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'googleOAuth2ClientId',
+        description: 'Google OAuth2 client ID',
+        regex: /\b[0-9]+-[a-z0-9]+\.apps\.googleusercontent\.com\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'googleOAuthClientSecret',
+        description: 'Google OAuth client secret',
+        regex: /\b"client_secret":\s*"[a-zA-Z0-9-_]{24}"\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'gcpServiceAccountEmail',
+        description: 'GCP service account email',
+        regex: /\b[a-z0-9-]+@[a-z0-9-]+\.iam\.gserviceaccount\.com\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'azureStorageConnectionString',
+        description: 'Azure storage account connection string',
+        regex: /\bDefaultEndpointsProtocol=https?;AccountName=[a-z0-9]+;AccountKey=[a-zA-Z0-9+/]+={0,2};EndpointSuffix=core\.windows\.net\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'azureSubscriptionId',
+        description: 'Azure subscription ID',
+        regex: /\b['"]?(?:AZURE|azure)?_?(?:SUBSCRIPTION|subscription)_?(?:ID|id)?['"]?\s*(?::|=>|=)\s*['"]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"]?\b/gi,
+        matchAccuracy: 'high',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'azureTenantDomain',
+        description: 'Azure tenant domain (onmicrosoft.com)',
+        regex: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.onmicrosoft\.com\b/gi,
+        matchAccuracy: 'medium',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'azureCosmosDbConnectionString',
+        description: 'Azure Cosmos DB connection string',
+        regex: /\bAccountEndpoint=https:\/\/[a-z0-9-]+\.documents\.azure\.com:443\/;AccountKey=[a-zA-Z0-9+/]+={0,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'azureServiceBusConnectionString',
+        description: 'Azure Service Bus connection string',
+        regex: /\bEndpoint=sb:\/\/[a-z0-9-]+\.servicebus\.windows\.net\/;SharedAccessKeyName=[a-zA-Z0-9]+;SharedAccessKey=[a-zA-Z0-9+/]+={0,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dropboxAccessToken',
+        description: 'Dropbox access token',
+        regex: /\bsl\.[a-zA-Z0-9_-]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dropboxAppKey',
+        description: 'Dropbox app key',
+        regex: /\b[a-z0-9]{15}\.(?:app|apps)\.dropbox\.com\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'supabaseServiceKey',
+        description: 'Supabase personal access token',
+        regex: /\bsbp_[a-f0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'supabaseSecretKey',
+        description: 'Supabase secret API key',
+        regex: /\bsb_secret_[a-zA-Z0-9_-]{22}_[a-fA-F0-9]{8}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'planetScaleConnectionString',
+        description: 'PlanetScale connection string',
+        regex: /\bmysql:\/\/[a-zA-Z0-9_-]+:[a-zA-Z0-9_=-]+@[a-z0-9.-]+\.psdb\.cloud\/[a-zA-Z0-9_-]+\?sslaccept=strict\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'planetScaleToken',
+        description: 'PlanetScale API token',
+        regex: /\bpscale_tkn_[a-zA-Z0-9_-]{38,43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sendgridApiKey',
+        description: 'SendGrid API key',
+        regex: /\bSG\.[A-Za-z0-9_-]{20,22}\.[A-Za-z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mailgunApiKey',
+        description: 'Mailgun API key',
+        regex: /\bkey-[0-9a-z]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'mailchimpApiKey',
+        description: 'MailChimp API key',
+        regex: /\b[0-9a-f]{32}-us[0-9]{1,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'telegramBotToken',
+        description: 'Telegram bot token',
+        regex: /\b[0-9]{8,10}:[A-Za-z0-9_-]{35}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'twilioApiKey',
+        description: 'Twilio API key',
+        regex: /\bSK[a-z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'twilioAccountSid',
+        description: 'Twilio account SID',
+        regex: /\bAC[0-9a-fA-F]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dockerHubToken',
+        description: 'Docker Hub personal access token',
+        regex: /\bdckr_pat_[a-zA-Z0-9_]{36}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pypiApiToken',
+        description: 'PyPI API token',
+        regex: /\bpypi-[a-zA-Z0-9_-]{84}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'figmaToken',
+        description: 'Figma personal access token',
+        regex: /\bfigd_[a-zA-Z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'renderToken',
+        description: 'Render API token',
+        regex: /\brnd_[a-zA-Z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'airtablePersonalAccessToken',
+        description: 'Airtable personal access token',
+        regex: /\bpat[a-zA-Z0-9]{14}\.[a-zA-Z0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'typeformToken',
+        description: 'Typeform API token',
+        regex: /\btfp_[a-zA-Z0-9_-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'intercomAccessToken',
+        description: 'Intercom access token',
+        regex: /\bdG9rOi[a-zA-Z0-9+/]{46,48}={0,2}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'digitalOceanToken',
+        description: 'DigitalOcean API token',
+        regex: /\bdop_v1_[a-f0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'digitalOceanOAuthToken',
+        description: 'DigitalOcean OAuth access token',
+        regex: /\bdoo_v1_[a-f0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'digitalOceanRefreshToken',
+        description: 'DigitalOcean OAuth refresh token',
+        regex: /\bdor_v1_[a-f0-9]{64}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'cloudflareApiKey',
+        description: 'Cloudflare API key',
+        regex: /\b['"]?(?:cloudflare)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9_-]{40}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'cloudflareGlobalApiKey',
+        description: 'Cloudflare Global API key',
+        regex: /\b['"]?(?:cloudflare)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{37}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'cloudflareOriginCaKey',
+        description: 'Cloudflare Origin CA key',
+        regex: /\bv1\.0-[a-f0-9]{24}-[a-f0-9]{146}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'flyioAccessToken',
+        description: 'Fly.io API access token',
+        regex: /\bfo1_[\w-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'flyioMachineToken',
+        description: 'Fly.io machine token',
+        regex: /\bfm[12][ar]?_[a-zA-Z0-9+/]{100,}={0,3}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dopplerApiToken',
+        description: 'Doppler API token',
+        regex: /\bdp\.pt\.[a-z0-9]{43}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'dynatraceApiToken',
+        description: 'Dynatrace API token',
+        regex: /\bdt0c01\.[a-z0-9]{24}\.[a-z0-9]{64}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'netlifyAccessToken',
+        description: 'Netlify access token',
+        regex: /\b['"]?(?:netlify)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9=_-]{40,46}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'scalingoApiToken',
+        description: 'Scalingo API token',
+        regex: /\btk-us-[\w-]{48}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'infracostApiToken',
+        description: 'Infracost API token',
+        regex: /\bico-[a-zA-Z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'harnessApiKey',
+        description: 'Harness Access Token (PAT or SAT)',
+        regex: /\b(?:pat|sat)\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9]{24}\.[a-zA-Z0-9]{20}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'azureAdClientSecret',
+        description: 'Azure AD client secret',
+        regex: /(?:^|[\\'"` \s>=:(,)])([a-zA-Z0-9_~.]{3}\dQ~[a-zA-Z0-9_~.-]{31,34})(?:$|[\\'"` \s<),])/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'herokuApiKeyV2',
+        description: 'Heroku API key (new format)',
+        regex: /\bHRKU-AA[0-9a-zA-Z_-]{58}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'microsoftTeamsWebhook',
+        description: 'Microsoft Teams incoming webhook URL',
+        regex: /https:\/\/[a-z0-9]+\.webhook\.office\.com\/webhookb2\/[a-z0-9]{8}-(?:[a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-(?:[a-z0-9]{4}-){3}[a-z0-9]{12}\/IncomingWebhook\/[a-z0-9]{32}\/[a-z0-9]{8}-(?:[a-z0-9]{4}-){3}[a-z0-9]{12}/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'oktaAccessToken',
+        description: 'Okta access token',
+        regex: /\b['"]?(?:okta)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?00[\w=-]{40}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'openshiftUserToken',
+        description: 'OpenShift user token',
+        regex: /\bsha256~[\w-]{43}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'denoDeployToken',
+        description: 'Deno Deploy access token',
+        regex: /\bddp_[a-zA-Z0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'resendApiKey',
+        description: 'Resend email API key',
+        regex: /\bre_[a-zA-Z0-9]{30,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'azureOpenaiApiKey',
+        description: 'Azure OpenAI API key',
+        regex: /\b['"]?(?:AZURE_OPENAI|azure_openai)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'railwayApiToken',
+        description: 'Railway API token',
+        regex: /\b['"]?(?:RAILWAY|railway)_?(?:API|api)?_?(?:TOKEN|token)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'convexDeployKey',
+        description: 'Convex deployment key',
+        regex: /\b(?:prod|dev):[a-zA-Z0-9_-]+:[a-zA-Z0-9_-]{40,}\b/g,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'upstashKafkaCredentials',
+        description: 'Upstash Kafka REST credentials',
+        regex: /\b['"]?(?:UPSTASH_KAFKA)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9=_-]{40,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'cloudflareApiTokenPrefixed',
+        description: 'Cloudflare scannable API credential',
+        regex: /\bcf(?:k|ut|at)_[a-zA-Z0-9]{40}[a-fA-F0-9]{8}\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/communications.d.ts

@@ -0,0 +1,4 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const slackPatterns: SensitiveDataPattern[];
+export declare const socialMediaPatterns: SensitiveDataPattern[];
+export declare const shippingLogisticsPatterns: SensitiveDataPattern[];

package/dist/security/regexes/communications.js

@@ -0,0 +1,260 @@
+export const slackPatterns = [
+    {
+        name: 'slackBotToken',
+        description: 'Slack bot token',
+        regex: /\bxoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackUserToken',
+        description: 'Slack user token',
+        regex: /\bxoxp-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackWorkspaceToken',
+        description: 'Slack workspace token',
+        regex: /\bxoxa-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackRefreshToken',
+        description: 'Slack refresh token',
+        regex: /\bxoxr-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackWebhookUrl',
+        description: 'Slack incoming webhook URL',
+        regex: /(?:https?:\/\/)?hooks\.slack\.com\/(?:services|workflows|triggers)\/[A-Za-z0-9+/]{43,56}/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackWebhookUrlClassic',
+        description: 'Slack classic incoming webhook URL',
+        regex: /\bhttps:\/\/hooks\.slack\.com\/services\/[A-Z0-9]{8,12}\/[A-Z0-9]{8,12}\/[A-Za-z0-9]{20,32}\b/g,
+        matchAccuracy: 'high',
+        fileContext: /(?:\.env|config|settings|secrets)/i,
+    },
+    {
+        name: 'slackAppToken',
+        description: 'Slack app-level token',
+        regex: /\bxapp-\d-[A-Z0-9]+-\d+-[a-z0-9]+\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'slackConfigAccessToken',
+        description: 'Slack configuration access token',
+        regex: /\bxoxe\.xox[bp]-\d-[A-Z0-9]{163,166}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'sendbirdAccessToken',
+        description: 'Sendbird access token',
+        regex: /\b['"]?(?:sendbird)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{40}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'messagebirdApiToken',
+        description: 'MessageBird API token',
+        regex: /\b['"]?(?:messagebird|message_bird|message-bird)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{25}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'mattermostAccessToken',
+        description: 'Mattermost access token',
+        regex: /\b['"]?(?:mattermost)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{26}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'zendeskSecretKey',
+        description: 'Zendesk secret key',
+        regex: /\b['"]?(?:zendesk)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{40}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'freshdeskApiKey',
+        description: 'Freshdesk API key',
+        regex: /\b['"]?(?:freshdesk)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{20}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'sendinblueApiToken',
+        description: 'Sendinblue (Brevo) API token',
+        regex: /\bxkeysib-[a-f0-9]{64}-[a-z0-9]{16}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pusherAppSecret',
+        description: 'Pusher app secret',
+        regex: /\b['"]?(?:PUSHER|pusher)_?(?:APP|app)?_?(?:SECRET|secret)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{20}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'streamApiSecret',
+        description: 'Stream (GetStream.io) API secret',
+        regex: /\b['"]?(?:STREAM|stream|GETSTREAM)_?(?:API|api)?_?(?:SECRET|secret|KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{40,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'postmarkServerToken',
+        description: 'Postmark server API token',
+        regex: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g,
+        matchAccuracy: 'medium',
+        fileContext: /postmark/i,
+    },
+    {
+        name: 'vonageApiSecret',
+        description: 'Vonage/Nexmo API secret',
+        regex: /\b['"]?(?:VONAGE|NEXMO|vonage|nexmo)_?(?:API|api)?_?(?:SECRET|secret)['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{16}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'customerIoApiKey',
+        description: 'Customer.io API key',
+        regex: /\b['"]?(?:CUSTOMERIO|customer_io|CUSTOMER_IO)_?(?:API|api)?_?(?:KEY|key)['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{32,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+];
+export const socialMediaPatterns = [
+    {
+        name: 'twitterBearerToken',
+        description: 'Twitter/X Bearer token',
+        regex: /\bAAAAAAAAAAAAAAAAAAAAA[a-zA-Z0-9%]{50,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'facebookAccessToken',
+        description: 'Facebook/Meta access token',
+        regex: /\bEAA[a-zA-Z0-9]{80,120}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'facebookPageAccessToken',
+        description: 'Facebook/Meta page access token',
+        regex: /\bEAAB[a-zA-Z0-9+/]{100,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'instagramAccessToken',
+        description: 'Instagram access token',
+        regex: /\bIGQV[a-zA-Z0-9_-]{100,}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'discordSocialBotToken',
+        description: 'Discord social bot token',
+        regex: /\b[MN][A-Za-z\d]{23}\.[A-Za-z\d-_]{6}\.[A-Za-z\d-_]{27}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'discordSocialWebhookUrl',
+        description: 'Discord social webhook URL',
+        regex: /\bhttps:\/\/discord(?:app)?\.com\/api\/webhooks\/[0-9]{17,19}\/[A-Za-z0-9_-]{68}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'pinterestAccessToken',
+        description: 'Pinterest access token',
+        regex: /\bpina_[a-zA-Z0-9]{32}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'linkedinApiToken',
+        description: 'LinkedIn API token',
+        regex: /\b['"]?(?:linkedin|linked_in|linked-in)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-z0-9]{14,16}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'youtubeApiKey',
+        description: 'YouTube Data API key',
+        regex: /\b['"]?(?:youtube)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?AIza[a-zA-Z0-9_-]{35}['"]?\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'tiktokApiToken',
+        description: 'TikTok API token',
+        regex: /\b['"]?(?:tiktok)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9_-]{40,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+];
+export const shippingLogisticsPatterns = [
+    {
+        name: 'shippoApiToken',
+        description: 'Shippo API token',
+        regex: /\bshippo_(?:live|test)_[a-fA-F0-9]{40}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'easypostApiToken',
+        description: 'EasyPost API token',
+        regex: /\bEZAK[a-z0-9]{54}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'easypostTestApiToken',
+        description: 'EasyPost test API token',
+        regex: /\bEZTK[a-z0-9]{54}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'duffelApiToken',
+        description: 'Duffel travel API token',
+        regex: /\bduffel_(?:test|live)_[a-z0-9_\-=]{43}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'frameioApiToken',
+        description: 'Frame.io API token',
+        regex: /\bfio-u-[a-z0-9\-_=]{64}\b/gi,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'maxmindLicenseKey',
+        description: 'MaxMind license key',
+        regex: /\b[A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'asanaPersonalAccessToken',
+        description: 'Asana personal access token',
+        regex: /\b['"]?(?:asana)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[0-9]{16}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'mondayApiToken',
+        description: 'Monday.com API token',
+        regex: /\b['"]?(?:monday)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?eyJ[a-zA-Z0-9_-]{100,}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'trelloApiKey',
+        description: 'Trello API key',
+        regex: /\b['"]?(?:trello)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-f0-9]{32}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'jiraApiToken',
+        description: 'Jira API token',
+        regex: /\b['"]?(?:jira)(?:[\s\w.-]{0,20})['"]?\s*(?::|=>|=)\s*['"]?[a-zA-Z0-9]{24}['"]?\b/gi,
+        matchAccuracy: 'medium',
+    },
+    {
+        name: 'settlemintApplicationAccessToken',
+        description: 'SettleMint application access token',
+        regex: /\bsm_aat_[a-zA-Z0-9]{16}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'settlemintPersonalAccessToken',
+        description: 'SettleMint personal access token',
+        regex: /\bsm_pat_[a-zA-Z0-9]{16}\b/g,
+        matchAccuracy: 'high',
+    },
+    {
+        name: 'settlemintServiceAccessToken',
+        description: 'SettleMint service access token',
+        regex: /\bsm_sat_[a-zA-Z0-9]{16}\b/g,
+        matchAccuracy: 'high',
+    },
+];

package/dist/security/regexes/databases.d.ts

@@ -0,0 +1,2 @@
+import type { SensitiveDataPattern } from './types.js';
+export declare const databasePatterns: SensitiveDataPattern[];