@openviking/dsh-memory-plugin 0.5.28 → 0.5.29

package/client.mjs

@@ -1,4 +1,5 @@
 import { createOvHttp } from "./shared/ov-http.mjs";
+import { redactPayload } from "./shared/redact.mjs";
 
 export class OpenVikingClient {
   constructor(config) {
@@ -33,12 +34,20 @@ export class OpenVikingClient {
     return response.ok ? response.result : null;
   }
 
-  async addMessage(sessionId, payload, actorPeerId) {
+  /**
+   * POST one captured message. The payload is secret-redacted first under
+   * `options.redactTier` (default: this client's `captureRedact`), unless
+   * `options.redacted` says the caller already did it with its own tier.
+   */
+  async addMessage(sessionId, payload, actorPeerId, options = {}) {
+    const body = options.redacted === true
+      ? payload
+      : redactPayload(payload, { tier: options.redactTier ?? this.config.captureRedact });
     return this.fetchJSON(
       `/api/v1/sessions/${encodeURIComponent(sessionId)}/messages`,
       {
         method: "POST",
-        body: JSON.stringify(payload),
+        body: JSON.stringify(body),
       },
       { actorPeerId },
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openviking/dsh-memory-plugin",
-  "version": "0.5.28",
+  "version": "0.5.29",
   "description": "OpenViking memory and context bundle for DeepSeek Harness",
   "icon": "./icon.svg",
   "type": "module",

package/runtime.mjs

@@ -7,6 +7,7 @@ import {
   listPending,
   replayPending,
 } from "./shared/pending-queue.mjs";
+import { redactPayload } from "./shared/redact.mjs";
 import { isRetryableFailure } from "./shared/retryable.mjs";
 import { resolveEffectivePeerId } from "./shared/workspace-peer.mjs";
 import {
@@ -150,9 +151,13 @@ export class OpenVikingRuntime {
   capture(session, event) {
     const state = this.stateFor(session);
     if (!isCaptureEnabled(state.config)) return;
-    const payload = captureEvent(event, state.config, state.toolNames);
-    if (!payload) return;
+    const captured = captureEvent(event, state.config, state.toolNames);
+    if (!captured) return;
     this.enqueueWrite(state, async () => {
+      // Redacted once, inside the write chain so a slow scan never blocks the
+      // host's event: the direct POST and the pending queue both carry this
+      // copy, never the plaintext.
+      const payload = redactPayload(captured, { tier: state.config.captureRedact });
       if (state.hasPendingWrites) {
         await this.enqueuePendingMessage(state, payload);
         return;
@@ -171,6 +176,7 @@ export class OpenVikingRuntime {
         state.ovSessionId,
         payload,
         state.config.peerId,
+        { redacted: true },
       );
       if (isRetryableFailure(response)) {
         await this.enqueuePendingMessage(state, payload);
@@ -265,7 +271,10 @@ export class OpenVikingRuntime {
   async enqueuePending(state, type, payload) {
     const createdAt = Math.max(Date.now(), state.pendingCreatedAt + 1);
     state.pendingCreatedAt = createdAt;
-    const result = await enqueue(type, state.ovSessionId, payload, { createdAt });
+    const result = await enqueue(type, state.ovSessionId, payload, {
+      createdAt,
+      redactTier: state.config.captureRedact,
+    });
     if (result.ok) {
       // Log the latch transition only: every message that follows while the
       // latch holds takes the cheap enqueue path, so this fires once per
@@ -334,7 +343,7 @@ export class OpenVikingRuntime {
     await replayPending(
       (path, init) => this.client.fetchJSON(path, init),
       (stage, data) => this.log(stage, data),
-      options,
+      { redactTier: this.config.captureRedact, ...options },
     );
   }
 

package/shared/config-schema.mjs

@@ -24,6 +24,11 @@
  *   harness     per-harness default, where one genuinely differs
  *   min/max     clamped, not rejected: a config file must not kill a hook
  *   values      the enum's members; anything else falls back to the default
+ *   boolValues  enum only: the member a boolean-ish value (`true`/`yes`/`on`,
+ *               `false`/`no`/`off`/`0`) stands for, so `false` can mean "off"
+ *   unknownToDefault
+ *               enum only: a value naming no member resolves to the default
+ *               instead of leaving the lower layer's value standing
  *   env         OPENVIKING_* variable, the highest-priority layer
  *   aliases     older spellings, honoured forever; the doctor names them
  *   workspace   dotted key in `.openviking/config.json`
@@ -84,6 +89,9 @@ export const KNOBS = [
   { name: "recallMaxContentChars", type: "int", default: 500, min: 100, max: 5000, env: "OPENVIKING_RECALL_MAX_CONTENT_CHARS", capability: "recall" },
   { name: "recallPreferAbstract", type: "bool", default: true, env: "OPENVIKING_RECALL_PREFER_ABSTRACT", capability: "recall" },
   { name: "recallPeerScope", type: "enum", values: ["all", "actor"], default: "all", env: "OPENVIKING_RECALL_PEER_SCOPE", workspace: "recall.peer_scope", capability: "recall" },
+  // Sent as events_time_decay_protection ("7d", "12h"): event memories keep their score for
+  // that long and decay afterwards. Empty leaves decay off, as the server does by default.
+  { name: "recallEventsDecayProtection", type: "string", default: "", env: "OPENVIKING_RECALL_EVENTS_DECAY_PROTECTION", capability: "recall" },
   { name: "recallDedupTurns", type: "int", default: 5, min: 0, max: 20, env: "OPENVIKING_RECALL_DEDUP_TURNS", workspace: "recall.dedup_turns", capability: "recall" },
   { name: "recallMaxTokens", type: "int", default: 1600, min: 64, max: 200000, env: "OPENVIKING_RECALL_MAX_TOKENS", sendOnlyWhenConfigured: true, capability: "recall" },
   { name: "recallQueryExpansion", type: "enum", values: ["auto", "off"], default: "auto", env: "OPENVIKING_RECALL_QUERY_EXPANSION", sendOnlyWhenConfigured: true, capability: "recall" },
@@ -148,6 +156,23 @@ export const KNOBS = [
   // tool results, so it captures them by default.
   { name: "captureToolResults", type: "bool", default: false, harness: { dsh: true }, env: "OPENVIKING_CAPTURE_TOOL_RESULTS", capability: "capture" },
   { name: "captureFilters", type: "list", default: [], env: "OPENVIKING_CAPTURE_FILTERS", capability: "capture" },
+  // Secret redaction of every captured payload before it is sent or queued
+  // (lib/redact.mjs); the tiers are REDACT_TIERS there, in the same order.
+  // User-level only — deliberately no `workspace` key, so a repository's
+  // `.openviking/config.json` cannot switch redaction off for whoever opens it.
+  // `false` means off rather than "unparseable"; a tier this build does not
+  // know (a newer config read by an older plugin) means the default, never a
+  // weaker value left over from a lower layer.
+  {
+    name: "captureRedact",
+    type: "enum",
+    values: ["off", "standard", "strict"],
+    default: "standard",
+    boolValues: { true: "standard", false: "off" },
+    unknownToDefault: true,
+    env: "OPENVIKING_CAPTURE_REDACT",
+    capability: "capture",
+  },
   // 0 means "derive from timeoutMs": a write gets a longer budget than a read.
   { name: "captureTimeoutMs", type: "int", default: 0, min: 0, max: 600000, env: "OPENVIKING_CAPTURE_TIMEOUT_MS", capability: "capture" },
   { name: "commitTokenThreshold", type: "int", default: 20000, min: 1000, max: 1000000, env: "OPENVIKING_COMMIT_TOKEN_THRESHOLD", workspace: "capture.commit_token_threshold", capability: "capture" },
@@ -314,8 +339,16 @@ export function coerceKnobValue(knob, raw, fallback) {
       return knob.max === undefined ? floored : Math.min(knob.max, floored);
     }
     case "enum": {
+      const values = knob.values || [];
       const word = String(raw ?? "").trim();
-      return (knob.values || []).includes(word) ? word : fallback;
+      if (values.includes(word)) return word;
+      if (knob.boolValues) {
+        const lower = word.toLowerCase();
+        if (values.includes(lower)) return lower;
+        if (raw === true || TRUE_WORDS.includes(lower)) return knob.boolValues.true;
+        if (raw === false || FALSE_WORDS.includes(lower)) return knob.boolValues.false;
+      }
+      return knob.unknownToDefault && word ? knobDefault(knob) : fallback;
     }
     // A peer template may be one string or an ordered list of fallbacks, and
     // `String([a, b])` would quietly turn the list into one bogus template.

package/shared/pending-queue.mjs

@@ -11,6 +11,12 @@
  *
  * Each file contains: { type, sessionId, payload, createdAt, retries, dedupKey }
  *
+ * An addMessage payload is secret-redacted (lib/redact.mjs) before it is
+ * written, and again before it is replayed: the queue is plaintext on disk, and
+ * an entry written by an older plugin, or by a caller that skipped redaction,
+ * must not reach the server as it was. Redaction is idempotent, so replaying an
+ * already-redacted entry sends the same bytes.
+ *
  * Config (env vars):
  *   OPENVIKING_PENDING_DIR         pending queue directory
  *                                  (default: ~/.openviking/pending)
@@ -25,6 +31,7 @@ import { mkdir, readdir, readFile, rename, writeFile, unlink, stat, chmod, utime
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { redactPayload } from "./redact.mjs";
 import { isRetryableFailure } from "./retryable.mjs";
 
 const DEFAULT_MAX_RETRIES = 3;
@@ -184,8 +191,21 @@ async function recoverStaleProcessing(dir) {
  * @param {object} payload - the data that failed to send
  * @param {object} options
  * @param {number} options.createdAt - optional queue timestamp override
+ * @param {string} [options.redactTier] - the captureRedact tier an addMessage
+ *   payload is redacted under before it is written (default "standard")
+ * @param {boolean} [options.redacted] - the caller already redacted `payload`
+ *   under its configured tier, so it is written as it is
  */
 export async function enqueue(type, sessionId, payload, options = {}) {
+  if (type === "addMessage" && options.redacted !== true) {
+    try {
+      payload = redactPayload(payload, { tier: options.redactTier });
+    } catch (err) {
+      // redactPayload fails closed on its own; this is the last line before
+      // plaintext would be written to disk, so refuse rather than write it.
+      return { ok: false, error: `redaction failed: ${err?.message || String(err)}` };
+    }
+  }
   const dir = getPendingDir();
   const now = Number.isFinite(options.createdAt) ? options.createdAt : Date.now();
   const dedupKey = makeDedupKey(type, sessionId, payload);
@@ -378,6 +398,8 @@ export async function cleanStale() {
  *   a background drainer can keep retrying a transient failure without
  *   burning the session-start retry budget. Exhausted and non-retryable
  *   entries are deleted exactly as in the default mode.
+ * @param {string} [options.redactTier="standard"] - the captureRedact tier
+ *   every replayed addMessage payload is redacted under before it is sent
  * @returns {{ replayed: number, failed: number, skipped: number, deferred: number }}
  */
 export async function replayPending(fetchJSON, log, options = {}) {
@@ -422,7 +444,7 @@ export async function replayPending(fetchJSON, log, options = {}) {
       if (entry.type === "addMessage") {
         res = await fetchJSON(`/api/v1/sessions/${encodedSid}/messages`, {
           method: "POST",
-          body: JSON.stringify(entry.payload),
+          body: JSON.stringify(redactPayload(entry.payload, { tier: options.redactTier })),
         });
       } else if (entry.type === "commitSession") {
         res = await fetchJSON(`/api/v1/sessions/${encodedSid}/commit`, {

package/shared/recall-core.mjs

@@ -129,6 +129,8 @@ export function buildContextSearchBody(cfg = {}, options = {}) {
   if (limitConfigured) body.quotas = codingQuotas(limit);
   if (maxTokensConfigured) body.max_tokens = maxTokens;
   if (cfg.recallPeerScope === "actor") body.peer_scope = "actor";
+  const decayProtection = String(cfg.recallEventsDecayProtection || "").trim();
+  if (decayProtection) body.events_time_decay_protection = decayProtection;
 
   const sessionId = String(options.sessionId || "").trim();
   if (sessionId) {

package/shared/redact.mjs

@@ -0,0 +1,522 @@
+// GENERATED FROM examples/memory-plugin-shared/lib. DO NOT EDIT.
+/**
+ * Client-side secret redaction for captured transcripts.
+ *
+ * An agent that runs `cat .env` or prints a token puts that credential in the
+ * transcript the memory plugins capture. This module replaces such secrets
+ * before a payload leaves the machine — before the POST to OpenViking and
+ * before the local pending queue writes it to disk — so the server, its
+ * extractor and the memories it writes never see the plaintext.
+ *
+ * The rules are gitleaks' default rule set plus OpenViking's own key formats
+ * (lib/secret-rules.mjs, generated), and detection follows gitleaks: a
+ * case-insensitive keyword prefilter, the rule regex, the secret taken from
+ * the rule's `secretGroup` or else the first non-empty capture group, the
+ * Shannon entropy threshold, then the global and the rule's allowlists and
+ * stopwords. Only the secret span is replaced, so `API_KEY=sk-...` becomes
+ * `API_KEY={{ov_redacted:<rule>:<tag>}}` and the turn still reads as what
+ * happened.
+ *
+ * The tag is the first 8 hex characters of HMAC-SHA256(install key, secret):
+ * the same secret gets the same tag across turns and sessions on one machine,
+ * but the tag cannot be checked against a guessed secret without the key,
+ * which never leaves the machine.
+ *
+ * Failure policy: redaction fails closed per string. A scan that throws
+ * replaces the whole string with `{{ov_redacted:scan-failed:<tag>}}`; it never
+ * throws to the hook and never lets the string through unscanned. Text past
+ * `maxChars` (MAX_SCAN_CHARS by default) is not scanned either: it is cut at a
+ * whitespace boundary (before an unterminated `-----BEGIN` line) and replaced
+ * with `{{ov_redacted:scan-oversize:<tag>}}`. The same happens once one call
+ * has scanned `maxTotalChars` (MAX_SCAN_TOTAL_CHARS) across all its strings,
+ * which keeps a hook's redaction time bounded however large the batch.
+ * A missing or unwritable key file only costs tag stability (an in-process
+ * random key is used), never redaction itself.
+ *
+ * Redaction is idempotent: existing `{{ov_redacted:<rule>:<tag>}}`
+ * placeholders and well-formed `{{ov_privacy:...}}` references are never
+ * scanned or touched, so replaying a pending entry or redacting twice changes
+ * nothing.
+ */
+
+import { createHmac, randomBytes } from "node:crypto";
+import { linkSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import SECRET_RULES, { GLOBAL_ALLOWLISTS, TIERS } from "./secret-rules.mjs";
+import { stateDir } from "./workspace-identity.mjs";
+
+/** Ordered, cumulative: each tier runs its own rules and every earlier tier's. */
+export const REDACT_TIERS = Object.freeze([...TIERS]);
+export const DEFAULT_REDACT_TIER = "standard";
+
+/**
+ * The most characters of one string that are scanned. It matches the
+ * largest tool output a plugin captures (`captureToolMaxChars`, at most
+ * 1,000,000), so nothing a plugin builds by default is cut.
+ */
+export const MAX_SCAN_CHARS = 1_000_000;
+
+/**
+ * The most characters scanned in one redactText / redactPayload /
+ * redactPayloads call, summed over every string in it. Ordinary text scans at
+ * well under 1 s per MB, but keyword-dense data (hashes, base64) can take
+ * 10-20 s per MB, and a hook that times out re-sends the same turns next time.
+ */
+export const MAX_SCAN_TOTAL_CHARS = 2_000_000;
+
+const OFF_WORDS = new Set(["off", "false", "0", "no"]);
+const ON_WORDS = new Set(["on", "true", "1", "yes"]);
+
+/**
+ * Map a configured value onto a tier name. Anything that says "no" (`false`,
+ * `0`, `"off"`, any case) is `off`; a value naming no tier this build knows (a
+ * newer config, a typo) falls back to the default, so it can only redact more.
+ */
+export function normalizeRedactTier(value, fallback = DEFAULT_REDACT_TIER) {
+  const safeFallback = REDACT_TIERS.includes(fallback) ? fallback : DEFAULT_REDACT_TIER;
+  if (value === false || value === 0) return "off";
+  if (value === true || value === 1) return DEFAULT_REDACT_TIER;
+  if (typeof value !== "string") return safeFallback;
+  const word = value.trim().toLowerCase();
+  if (!word) return safeFallback;
+  if (OFF_WORDS.has(word)) return "off";
+  if (REDACT_TIERS.includes(word)) return word;
+  if (ON_WORDS.has(word)) return DEFAULT_REDACT_TIER;
+  return safeFallback;
+}
+
+// ---------------------------------------------------------------------------
+// Install key
+// ---------------------------------------------------------------------------
+
+const KEY_HEX_RE = /^[0-9a-f]{64}$/;
+let cachedKey = null;
+let processKey = null;
+
+function readKeyFile(file) {
+  try {
+    const text = readFileSync(file, "utf8").trim();
+    return KEY_HEX_RE.test(text) ? Buffer.from(text, "hex") : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Create the key file without exposing a half-written one: a private temp
+ * file is hard-linked into place, which fails if a concurrent hook got there
+ * first (its key is then the one read back). A garbage key file, or a
+ * filesystem without hard links, gets the temp file renamed over it.
+ */
+function createKeyFile(file) {
+  mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const tmp = `${file}.${process.pid}.${randomBytes(6).toString("hex")}`;
+  writeFileSync(tmp, `${randomBytes(32).toString("hex")}\n`, { mode: 0o600, flag: "wx" });
+  try {
+    linkSync(tmp, file);
+  } catch (error) {
+    if (error?.code !== "EEXIST" || !readKeyFile(file)) renameSync(tmp, file);
+  } finally {
+    try { unlinkSync(tmp); } catch { /* renamed into place */ }
+  }
+  return readKeyFile(file);
+}
+
+/**
+ * The per-install HMAC key: 32 random bytes in `<state dir>/redact/install-key`
+ * (dir 0700, file 0600). When it cannot be read or created, a random key for
+ * this process is used: tags then differ between processes, nothing else.
+ */
+export function loadInstallKey({ env = process.env } = {}) {
+  let file = "";
+  try {
+    file = join(stateDir(env), "redact", "install-key");
+  } catch {
+    // No state dir: process key.
+  }
+  if (cachedKey && cachedKey.file === file) return cachedKey.key;
+  let key = file ? readKeyFile(file) : null;
+  if (!key && file) {
+    try {
+      key = createKeyFile(file);
+    } catch {
+      key = null;
+    }
+  }
+  key ||= processKey ||= randomBytes(32);
+  cachedKey = { file, key };
+  return key;
+}
+
+function placeholder(ruleId, key, secret) {
+  const tag = createHmac("sha256", key).update(String(secret), "utf8").digest("hex").slice(0, 8);
+  return `{{ov_redacted:${ruleId}:${tag}}}`;
+}
+
+// ---------------------------------------------------------------------------
+// Detection (gitleaks semantics)
+// ---------------------------------------------------------------------------
+
+function compileAllowlists(list) {
+  return (list || []).map((al) => ({
+    and: al.condition === "AND",
+    target: al.regexTarget || "secret",
+    regexes: (al.regexes || []).map((r) => new RegExp(r.regex, r.flags)),
+    stopwords: (al.stopwords || []).map((w) => String(w).toLowerCase()),
+  }));
+}
+
+const compiledCache = new Map();
+
+/** Compile the rules once per process; throws if a rule does not compile. */
+export function compileRuleSet(rules = SECRET_RULES, globalAllowlists = GLOBAL_ALLOWLISTS) {
+  const hit = compiledCache.get(rules);
+  if (hit && hit.globalsSource === globalAllowlists) return hit;
+  const set = {
+    globalsSource: globalAllowlists,
+    globals: compileAllowlists(globalAllowlists),
+    rules: rules.map((rule) => ({
+      id: rule.id,
+      tierIndex: REDACT_TIERS.indexOf(rule.tier || DEFAULT_REDACT_TIER),
+      keywords: (rule.keywords || []).map((k) => String(k).toLowerCase()),
+      entropy: Number(rule.entropy) || 0,
+      secretGroup: Number(rule.secretGroup) || 0,
+      scan: new RegExp(rule.regex, `${rule.flags || ""}g`),
+      groups: new RegExp(rule.regex, `${rule.flags || ""}d`),
+      allowlists: compileAllowlists(rule.allowlists),
+      generic: rule.id.includes("generic"),
+    })),
+  };
+  compiledCache.set(rules, set);
+  return set;
+}
+
+/**
+ * Shannon entropy as gitleaks computes it: symbol frequencies over code
+ * points, divided by the UTF-8 byte length (Go's `len(string)`).
+ */
+export function shannonEntropy(data) {
+  if (!data) return 0;
+  const counts = new Map();
+  let bytes = 0;
+  for (const ch of data) {
+    counts.set(ch, (counts.get(ch) || 0) + 1);
+    const cp = ch.codePointAt(0);
+    bytes += cp < 0x80 ? 1 : cp < 0x800 ? 2 : cp < 0x10000 ? 3 : 4;
+  }
+  let entropy = 0;
+  for (const count of counts.values()) entropy -= (count / bytes) * Math.log2(count / bytes);
+  return entropy;
+}
+
+function isAllowed(allowlists, secret, match, line) {
+  const secretLower = secret.toLowerCase();
+  for (const al of allowlists) {
+    const target = al.target === "match" ? match : al.target === "line" ? line() : secret;
+    const checks = [];
+    if (al.regexes.length) checks.push(target !== "" && al.regexes.some((re) => re.test(target)));
+    if (al.stopwords.length) checks.push(al.stopwords.some((word) => secretLower.includes(word)));
+    if (al.and ? checks.every(Boolean) : checks.some(Boolean)) return true;
+  }
+  return false;
+}
+
+/**
+ * The secret spans gitleaks would report in `text`. The `gitleaks:allow`
+ * marker is deliberately not honoured: in a transcript it would be a way to
+ * opt a line out of redaction.
+ */
+function detect(text, rules, globals) {
+  const findings = [];
+  const lower = text.toLowerCase();
+  for (const rule of rules) {
+    if (rule.keywords.length && !rule.keywords.some((kw) => lower.includes(kw))) continue;
+    const re = rule.scan;
+    re.lastIndex = 0;
+    for (let m; (m = re.exec(text)) !== null;) {
+      if (m[0].length === 0) {
+        re.lastIndex++;
+        continue;
+      }
+      // gitleaks trims newlines off the match and re-runs the regex on it.
+      let start = m.index;
+      let end = m.index + m[0].length;
+      while (start < end && text.charCodeAt(start) === 10) start++;
+      while (end > start && text.charCodeAt(end - 1) === 10) end--;
+      const match = text.slice(start, end);
+      let span = [0, match.length];
+      const sub = match ? rule.groups.exec(match) : null;
+      if (sub && sub.length >= 2) {
+        if (rule.secretGroup > 0) span = sub.indices[rule.secretGroup] || [0, 0];
+        else span = sub.indices.slice(1).find((idx) => idx && idx[1] > idx[0]) || span;
+      }
+      const secret = match.slice(span[0], span[1]);
+      if (!secret) continue;
+      if (rule.entropy && shannonEntropy(secret) <= rule.entropy) continue;
+      const line = () => {
+        const from = text.lastIndexOf("\n", start - 1) + 1;
+        const to = text.indexOf("\n", end);
+        return text.slice(from, to < 0 ? text.length : to);
+      };
+      if (isAllowed(globals, secret, match, line) || isAllowed(rule.allowlists, secret, match, line)) continue;
+      findings.push({ start: start + span[0], end: start + span[1], id: rule.id, secret, generic: rule.generic });
+    }
+  }
+  return findings;
+}
+
+// ---------------------------------------------------------------------------
+// Redaction
+// ---------------------------------------------------------------------------
+
+/**
+ * Spans that are already placeholders and are never scanned: exactly the
+ * placeholders this module writes, and OpenViking privacy references in the
+ * grammar the server parses (openviking/privacy/reference.py). Anything else
+ * that merely starts with `{{ov_` is scanned like any other text.
+ */
+const PROTECTED_RE = new RegExp(
+  [
+    "\\{\\{ov_redacted:[a-z0-9][a-z0-9-]{0,99}:[0-9a-f]{8}\\}\\}",
+    "\\{\\{[ \\t]*ov_privacy:(?:" +
+      "ambiguous" +
+      "|skill:[A-Za-z0-9_.@-]{1,255}:[^\\s:{}]{1,255}" +
+      "|[^\\s:{}]{1,255}:viking://~/privacy/[^/\\s{}]{1,255}/[^#\\s{}]{1,1024}#/values/[^\\s{}]{1,1024}" +
+      ")[ \\t]*\\}\\}",
+  ].join("|"),
+  "g",
+);
+// One pass is not always a fixed point: a placeholder can give the text after
+// it a word boundary it lacked (`ghp_<36>AKIA<16>`: aws-access-token needs
+// `\bAKIA`, which only exists once the GitHub token is replaced). Passes repeat
+// until nothing changes, so a replayed entry is sent byte for byte; a string
+// with no finding costs one pass.
+const MAX_PASSES = 3;
+
+/** The [start, end) stretches of `text` outside existing placeholders. */
+function scannableSegments(text) {
+  const segments = [];
+  let last = 0;
+  for (const m of text.matchAll(PROTECTED_RE)) {
+    if (m.index > last) segments.push([last, m.index]);
+    last = m.index + m[0].length;
+  }
+  if (last < text.length) segments.push([last, text.length]);
+  return segments;
+}
+
+/**
+ * Where scanning stops in a string with more than `max` scannable characters:
+ * the `max`-th one, pulled back to whitespace within 4 KiB so a token is not
+ * split with its head left in the scanned part. A `-----BEGIN` block whose
+ * `-----END ...-----` line lies past the cut cannot match the private-key rule,
+ * so the cut moves to the start of the BEGIN line instead.
+ */
+function cutPoint(text, segments, max) {
+  let budget = max;
+  for (const [a, b] of segments) {
+    if (b - a <= budget) {
+      budget -= b - a;
+      continue;
+    }
+    const hard = a + budget;
+    const head = text.slice(a, hard).toLowerCase();
+    const begin = head.lastIndexOf("-----begin");
+    if (begin >= 0 && !/-----end[^\n]*-----/.test(head.slice(begin))) return a + head.lastIndexOf("\n", begin) + 1;
+    for (let k = hard; k > Math.max(a, hard - 4096); k--) if (/\s/.test(text[k - 1])) return k;
+    return hard;
+  }
+  return text.length;
+}
+
+/** Overlapping findings become one span, named by a provider rule over the generic one. */
+function mergeFindings(findings) {
+  findings.sort((x, y) => x.start - y.start || y.end - x.end || Number(x.generic) - Number(y.generic));
+  const merged = [];
+  for (const f of findings) {
+    const last = merged[merged.length - 1];
+    if (last && f.start < last.end) {
+      last.end = Math.max(last.end, f.end);
+      if (last.rep.generic && !f.generic) last.rep = f;
+    } else {
+      merged.push({ start: f.start, end: f.end, rep: f });
+    }
+  }
+  return merged;
+}
+
+/**
+ * One scan-and-replace pass over `full`; `base` is where the value starts
+ * after a key prefix, and `max` how many characters of the value to scan.
+ * Returns the redacted value and how many of its characters were scanned.
+ */
+function redactOnce(full, base, ctx, max) {
+  const segments = scannableSegments(full);
+  const scannable = segments.reduce((n, [a, b]) => n + (b - a), 0);
+  const limit = scannable > base + max ? Math.max(base, cutPoint(full, segments, base + max)) : full.length;
+  const findings = [];
+  for (const [a, b] of segments) {
+    if (Math.min(b, limit) <= a) continue;
+    for (const f of detect(full.slice(a, Math.min(b, limit)), ctx.rules, ctx.globals)) {
+      const start = Math.max(a + f.start, base);
+      if (a + f.end > start) findings.push({ ...f, start, end: a + f.end });
+    }
+  }
+  let out = "";
+  let pos = base;
+  for (const span of mergeFindings(findings)) {
+    out += full.slice(pos, span.start) + placeholder(span.rep.id, ctx.key(), span.rep.secret);
+    pos = span.end;
+  }
+  out += full.slice(pos, limit);
+  if (limit < full.length) out += placeholder("scan-oversize", ctx.key(), full.slice(limit));
+  return { text: out, scanned: Math.max(0, Math.min(scannable, base + max) - base) };
+}
+
+function makeContext(opts = {}) {
+  const tier = normalizeRedactTier(opts.tier ?? DEFAULT_REDACT_TIER);
+  let key = opts.key ? Buffer.from(opts.key) : null;
+  const ctx = {
+    tier,
+    rules: [],
+    globals: [],
+    maxChars: Number.isFinite(opts.maxChars) && opts.maxChars > 0 ? opts.maxChars : MAX_SCAN_CHARS,
+    // What is left of the call's scan budget; every string's first pass draws on it.
+    budget: Number.isFinite(opts.maxTotalChars) && opts.maxTotalChars > 0 ? opts.maxTotalChars : MAX_SCAN_TOTAL_CHARS,
+    key: () => (key ||= loadInstallKey(opts.env ? { env: opts.env } : undefined)),
+  };
+  if (tier === "off") return ctx;
+  try {
+    const set = compileRuleSet(opts.rules || SECRET_RULES, opts.globalAllowlists || GLOBAL_ALLOWLISTS);
+    const index = REDACT_TIERS.indexOf(tier);
+    ctx.rules = set.rules.filter((rule) => rule.tierIndex > 0 && rule.tierIndex <= index);
+    ctx.globals = set.globals;
+  } catch (error) {
+    ctx.broken = error;
+  }
+  return ctx;
+}
+
+function failClosed(text, ctx) {
+  try {
+    return placeholder("scan-failed", ctx.key(), text);
+  } catch {
+    return "{{ov_redacted:scan-failed:00000000}}";
+  }
+}
+
+function redactStringIn(text, ctx, keyName = null) {
+  if (typeof text !== "string" || text === "") return text;
+  if (ctx.broken) return failClosed(text, ctx);
+  const prefix = keyName ? `${keyName}=` : "";
+  // Fixed for every pass, so a later pass never cuts what the first one scanned.
+  const max = Math.min(ctx.maxChars, ctx.budget);
+  try {
+    let current = text;
+    for (let pass = 0; pass < MAX_PASSES; pass++) {
+      const { text: next, scanned } = redactOnce(prefix + current, prefix.length, ctx, max);
+      if (pass === 0) ctx.budget -= scanned;
+      if (next === current) return current;
+      current = next;
+    }
+    // Still changing after several passes: not a state to send.
+    return failClosed(text, ctx);
+  } catch {
+    return failClosed(text, ctx);
+  }
+}
+
+/**
+ * Redact the secrets in one string.
+ *
+ * @param {string} text
+ * @param {object} [opts]
+ * @param {string} [opts.tier="standard"] - one of REDACT_TIERS; "off" returns the input
+ * @param {string} [opts.keyName] - a field name to scan the value under, as `keyName=value`
+ * @param {number} [opts.maxChars] - scannable characters of one string before the rest is cut
+ * @param {number} [opts.maxTotalChars] - the same, summed over every string in the call
+ * @returns {string}
+ */
+export function redactText(text, opts = {}) {
+  const ctx = makeContext(opts);
+  if (ctx.tier === "off") return text;
+  return redactStringIn(text, ctx, opts.keyName || null);
+}
+
+// Message and part fields that identify or describe rather than carry text.
+const META_KEYS = new Set([
+  "role", "type", "id", "uri", "peer_id", "session_id", "created_at", "tool_id", "tool_name", "tool_status",
+  "context_type", "tool_output_mime_type", "tool_output_externalized_reason",
+]);
+const META_SUFFIX_RE = /_(?:id|uri|ref|sha256|at)$/;
+const KEY_CONTEXT_RE = /^[A-Za-z_][\w.-]{0,63}$/;
+
+const isObject = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+
+/**
+ * Redact every string under `value`. Inside an object each value is scanned
+ * as `<key>=<value>`, so a rule that needs a key-ish word (generic-api-key)
+ * sees `{ "API_TOKEN": "..." }` as it would see `API_TOKEN=...` in a file;
+ * only the value is replaced. Keys are scanned as text of their own.
+ */
+function redactDeep(value, ctx, keyName) {
+  if (typeof value === "string") return redactStringIn(value, ctx, keyName);
+  if (Array.isArray(value)) return value.map((item) => redactDeep(item, ctx, keyName));
+  if (!isObject(value)) return value;
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    const key = redactStringIn(k, ctx, null);
+    out[key] = redactDeep(v, ctx, key === k && KEY_CONTEXT_RE.test(k) ? k : null);
+  }
+  return out;
+}
+
+/** A message or part: its fields, metadata copied and the rest redacted. */
+function redactFields(value, ctx) {
+  if (!isObject(value)) return redactDeep(value, ctx, null);
+  const out = {};
+  for (const [k, v] of Object.entries(value)) {
+    if (k === "parts" && Array.isArray(v)) out[k] = v.map((part) => redactFields(part, ctx));
+    else if (META_KEYS.has(k) || META_SUFFIX_RE.test(k)) out[k] = v;
+    else out[k] = redactDeep(v, ctx, null);
+  }
+  return out;
+}
+
+/**
+ * Redact one session add-message payload — `{ role, content }` or
+ * `{ role, parts: [...] }` — and return a redacted copy. Text-bearing fields
+ * are scanned (`content`, `parts[].text`, `parts[].tool_output`, every leaf of
+ * `parts[].tool_input`, `abstract`, any other non-metadata field); ids, URIs,
+ * roles, statuses and timestamps are copied. The caller's object is never
+ * mutated.
+ */
+export function redactPayload(payload, opts = {}) {
+  const ctx = makeContext(opts);
+  if (ctx.tier === "off") return payload;
+  return redactPayloadIn(payload, ctx);
+}
+
+function redactPayloadIn(payload, ctx) {
+  if (payload == null) return payload;
+  if (typeof payload === "string") return redactStringIn(payload, ctx, null);
+  if (typeof payload !== "object") return payload;
+  // Walk the data the payload is on the wire (class instances, `toJSON`), as a
+  // copy; a payload that cannot be serialised could not be sent either.
+  let data;
+  try {
+    data = JSON.parse(JSON.stringify(payload));
+  } catch {
+    return failClosed("", ctx);
+  }
+  return redactFields(data, ctx);
+}
+
+/** redactPayload over a list, with one scan budget (maxTotalChars) for the whole list. */
+export function redactPayloads(payloads, opts = {}) {
+  if (!Array.isArray(payloads)) return payloads;
+  const ctx = makeContext(opts);
+  if (ctx.tier === "off") return payloads;
+  return payloads.map((payload) => redactPayloadIn(payload, ctx));
+}

package/shared/secret-rules.mjs

@@ -0,0 +1,294 @@
+// GENERATED FROM examples/memory-plugin-shared/lib. DO NOT EDIT.
+// GENERATED by examples/memory-plugin-shared/scripts/update-secret-rules.mjs. DO NOT EDIT.
+//
+// Secret detection rules for lib/redact.mjs: the gitleaks v8.30.1 default
+// configuration (config/gitleaks.toml, https://github.com/gitleaks/gitleaks),
+// converted from Go to JavaScript regex syntax and otherwise unchanged, plus
+// the rules for OpenViking's own key formats.
+// Source file sha256: e163e53b9e7e8a8511e77271e2b323ed057759542a6d988258afe3a1fa329caf
+//
+// Tier `strict`: generic-api-key. Every other rule is tier `standard`.
+// Skipped gitleaks rules:
+//   cisco-meraki-api-key: nested [\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url
+//   cohere-api-token: nested [\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url
+//   curl-auth-header: time quadratic in line length: minutes for a 1 MB line of `curl ...;` commands
+//   curl-auth-user: time quadratic in line length: minutes for a 1 MB line of `curl ...;` commands
+//   freemius-secret-key: path-scoped rule; captured text has no file path
+//   hashicorp-tf-password: path-scoped rule; captured text has no file path
+//   kubernetes-secret-yaml: path-scoped rule; captured text has no file path
+//   nuget-config-password: path-scoped rule; captured text has no file path
+//   okta-access-token: nested [\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url
+//   pkcs12-file: path-scoped rule; captured text has no file path
+//   privateai-api-token: nested [\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url
+//   sumologic-access-id: nested [\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url
+// OpenViking rules (not from gitleaks):
+//   openviking-gateway-key: ovgw_... issued by openviking_gateway/management.py
+//   openviking-gateway-management-key: ovgm_... issued by openviking_gateway/cli.py
+//   openviking-oauth-access-token: ovat_... issued by openviking/server/oauth/provider.py
+//   openviking-oauth-refresh-token: ovrt_... issued by openviking/server/oauth/provider.py
+//   openviking-oauth-auth-code: ovac_... issued by openviking/server/oauth/provider.py
+//
+// The gitleaks rule data is used under its license:
+//
+// MIT License
+//
+// Copyright (c) 2019 Zachary Rice
+//
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+//
+// The above copyright notice and this permission notice shall be included in all
+// copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+// SOFTWARE.
+
+export const GITLEAKS_VERSION = "v8.30.1";
+
+export const TIERS = ["off","standard","strict"];
+
+export const SKIPPED_RULES = [
+  {"id":"cisco-meraki-api-key","reason":"nested [\\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url"},
+  {"id":"cohere-api-token","reason":"nested [\\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url"},
+  {"id":"curl-auth-header","reason":"time quadratic in line length: minutes for a 1 MB line of `curl ...;` commands"},
+  {"id":"curl-auth-user","reason":"time quadratic in line length: minutes for a 1 MB line of `curl ...;` commands"},
+  {"id":"freemius-secret-key","reason":"path-scoped rule; captured text has no file path"},
+  {"id":"hashicorp-tf-password","reason":"path-scoped rule; captured text has no file path"},
+  {"id":"kubernetes-secret-yaml","reason":"path-scoped rule; captured text has no file path"},
+  {"id":"nuget-config-password","reason":"path-scoped rule; captured text has no file path"},
+  {"id":"okta-access-token","reason":"nested [\\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url"},
+  {"id":"pkcs12-file","reason":"path-scoped rule; captured text has no file path"},
+  {"id":"privateai-api-token","reason":"nested [\\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url"},
+  {"id":"sumologic-access-id","reason":"nested [\\w.-]{0,50}? prefixes: ~3-11 s per MB of hashes or base64url"},
+];
+
+export const GLOBAL_ALLOWLISTS = [
+  {"condition":"OR","regexTarget":"secret","regexes":[{"regex":"^true|false|null$","flags":"i"},{"regex":"^(?:[aA]+|[bB]+|[cC]+|[dD]+|[eE]+|[fF]+|[gG]+|[hH]+|[iI]+|[jJ]+|[kK]+|[lL]+|[mM]+|[nN]+|[oO]+|[pP]+|[qQ]+|[rR]+|[sS]+|[tT]+|[uU]+|[vV]+|[wW]+|[xX]+|[yY]+|[zZ]+|\\*+|\\.+)$","flags":""},{"regex":"^\\$(?:\\d+|{\\d+})$","flags":""},{"regex":"^\\$(?:[A-Z_]+|[a-z_]+)$","flags":""},{"regex":"^\\${(?:[A-Z_]+|[a-z_]+)}$","flags":""},{"regex":"^\\{\\{[ \\t]*[\\w ().|]+[ \\t]*}}$","flags":""},{"regex":"^\\$\\{\\{[ \\t]*(?:(?:env|github|secrets|vars)(?:\\.[A-Za-z]\\w+)+[\\w \"'&./=|]*)[ \\t]*}}$","flags":""},{"regex":"^%(?:[A-Z_]+|[a-z_]+)%$","flags":""},{"regex":"^%[+\\-# 0]?[bcdeEfFgGoOpqstTUvxX]$","flags":""},{"regex":"^\\{\\d{0,2}}$","flags":""},{"regex":"^@(?:[A-Z_]+|[a-z_]+)@$","flags":""},{"regex":"^/Users/[a-z0-9A-Z]+/[\\w .-/]+$","flags":""},{"regex":"^/(?:bin|etc|home|opt|tmp|usr|var)/[\\w ./\\-]+$","flags":""}],"stopwords":["014df517-39d1-4453-b7b3-9930c563627c","abcdefghijklmnopqrstuvwxyz"]},
+];
+
+export default [
+  {"id":"1password-secret-key","regex":"\\bA3-[A-Z0-9]{6}-(?:(?:[A-Z0-9]{11})|(?:[A-Z0-9]{6}-[A-Z0-9]{5}))-[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z0-9]{5}\\b","flags":"","keywords":["a3-"],"entropy":3.8,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"1password-service-account-token","regex":"ops_eyJ[a-zA-Z0-9+/]{250,}={0,3}","flags":"","keywords":["ops_"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"adafruit-api-key","regex":"[\\w.\\-]{0,50}?(?:adafruit)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["adafruit"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"adobe-client-id","regex":"[\\w.\\-]{0,50}?(?:adobe)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["adobe"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"adobe-client-secret","regex":"\\b(p8e-[a-z0-9A-Z]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["p8e-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"age-secret-key","regex":"AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}","flags":"","keywords":["age-secret-key-1"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"airtable-api-key","regex":"[\\w.\\-]{0,50}?(?:airtable)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{17})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["airtable"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"airtable-personnal-access-token","regex":"\\b(pat[0-9A-Za-z]{14}\\.[a-f0-9]{64})\\b","flags":"","keywords":["airtable"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"algolia-api-key","regex":"[\\w.\\-]{0,50}?(?:algolia)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["algolia"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"alibaba-access-key-id","regex":"\\b(LTAI[a-z0-9A-Z]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["ltai"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"alibaba-secret-key","regex":"[\\w.\\-]{0,50}?(?:alibaba)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["alibaba"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"anthropic-admin-api-key","regex":"\\b(sk-ant-admin01-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sk-ant-admin01"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"anthropic-api-key","regex":"\\b(sk-ant-api03-[a-zA-Z0-9_\\-]{93}AA)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sk-ant-api03"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"artifactory-api-key","regex":"\\bAKCp[A-Za-z0-9]{69}\\b","flags":"","keywords":["akcp"],"entropy":4.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"artifactory-reference-token","regex":"\\bcmVmd[A-Za-z0-9]{59}\\b","flags":"","keywords":["cmvmd"],"entropy":4.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"asana-client-id","regex":"[\\w.\\-]{0,50}?(?:asana)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["asana"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"asana-client-secret","regex":"[\\w.\\-]{0,50}?(?:asana)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["asana"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"atlassian-api-token","regex":"[\\w.\\-]{0,50}?(?:(?:ATLASSIAN|[Aa]tlassian)|(?:CONFLUENCE|[Cc]onfluence)|(?:JIRA|[Jj]ira))(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9A-Z]{20}[a-f0-9A-F]{4})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)|\\b([Aa][Tt][Aa][Tt][Tt]3[A-Za-z0-9_\\-=a-zA-Z]{186})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)","flags":"","keywords":["atlassian","confluence","jira","atatt3"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"authress-service-client-access-key","regex":"\\b((?:sc|ext|scauth|authress)_[a-z0-9A-Z]{5,30}\\.[a-z0-9A-Z]{4,6}\\.(?:acc)[_\\-][a-z0-9\\-A-Z]{10,32}\\.[a-z0-9+/_=\\-A-Z]{30,120})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sc_","ext_","scauth_","authress_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"aws-access-token","regex":"\\b((?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]{16})\\b","flags":"","keywords":["a3t","akia","asia","abia","acca"],"entropy":3,"secretGroup":0,"allowlists":[{"condition":"OR","regexTarget":"secret","regexes":[{"regex":"[^\\n]+EXAMPLE$","flags":""}],"stopwords":[]}],"tier":"standard"},
+  {"id":"aws-amazon-bedrock-api-key-long-lived","regex":"\\b(ABSK[A-Za-z0-9+/]{109,269}={0,2})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["absk"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"aws-amazon-bedrock-api-key-short-lived","regex":"bedrock-api-key-YmVkcm9jay5hbWF6b25hd3MuY29t","flags":"","keywords":["bedrock-api-key-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"azure-ad-client-secret","regex":"(?:^|[\\\\'\"\\x60\\s>=:(,)])([a-zA-Z0-9_~.]{3}\\dQ~[a-zA-Z0-9_~.\\-]{31,34})(?:$|[\\\\'\"\\x60\\s<),])","flags":"","keywords":["q~"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"beamer-api-token","regex":"[\\w.\\-]{0,50}?(?:beamer)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(b_[a-z0-9=_\\-]{44})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["beamer"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"bitbucket-client-id","regex":"[\\w.\\-]{0,50}?(?:bitbucket)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["bitbucket"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"bitbucket-client-secret","regex":"[\\w.\\-]{0,50}?(?:bitbucket)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["bitbucket"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"bittrex-access-key","regex":"[\\w.\\-]{0,50}?(?:bittrex)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["bittrex"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"bittrex-secret-key","regex":"[\\w.\\-]{0,50}?(?:bittrex)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["bittrex"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"clickhouse-cloud-api-secret-key","regex":"\\b(4b1d[A-Za-z0-9]{38})\\b","flags":"","keywords":["4b1d"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"clojars-api-token","regex":"CLOJARS_[a-z0-9]{60}","flags":"i","keywords":["clojars_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"cloudflare-api-key","regex":"[\\w.\\-]{0,50}?(?:cloudflare)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["cloudflare"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"cloudflare-global-api-key","regex":"[\\w.\\-]{0,50}?(?:cloudflare)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{37})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["cloudflare"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"cloudflare-origin-ca-key","regex":"\\b(v1\\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["cloudflare","v1.0-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"codecov-access-token","regex":"[\\w.\\-]{0,50}?(?:codecov)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["codecov"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"coinbase-access-token","regex":"[\\w.\\-]{0,50}?(?:coinbase)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_\\-]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["coinbase"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"confluent-access-token","regex":"[\\w.\\-]{0,50}?(?:confluent)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["confluent"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"confluent-secret-key","regex":"[\\w.\\-]{0,50}?(?:confluent)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["confluent"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"contentful-delivery-api-token","regex":"[\\w.\\-]{0,50}?(?:contentful)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{43})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["contentful"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"databricks-api-token","regex":"\\b(dapi[a-f0-9]{32}(?:-\\d)?)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["dapi"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"datadog-access-token","regex":"[\\w.\\-]{0,50}?(?:datadog)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["datadog"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"defined-networking-api-token","regex":"[\\w.\\-]{0,50}?(?:dnkey)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(dnkey-[a-z0-9=_\\-]{26}-[a-z0-9=_\\-]{52})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["dnkey"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"digitalocean-access-token","regex":"\\b(doo_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["doo_v1_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"digitalocean-pat","regex":"\\b(dop_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["dop_v1_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"digitalocean-refresh-token","regex":"\\b(dor_v1_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["dor_v1_"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"discord-api-token","regex":"[\\w.\\-]{0,50}?(?:discord)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["discord"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"discord-client-id","regex":"[\\w.\\-]{0,50}?(?:discord)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{18})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["discord"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"discord-client-secret","regex":"[\\w.\\-]{0,50}?(?:discord)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["discord"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"doppler-api-token","regex":"dp\\.pt\\.[a-z0-9A-Z]{43}","flags":"","keywords":["dp.pt."],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"droneci-access-token","regex":"[\\w.\\-]{0,50}?(?:droneci)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["droneci"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"dropbox-api-token","regex":"[\\w.\\-]{0,50}?(?:dropbox)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{15})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["dropbox"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"dropbox-long-lived-api-token","regex":"[\\w.\\-]{0,50}?(?:dropbox)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{11}(AAAAAAAAAA)[a-z0-9\\-_=]{43})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["dropbox"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"dropbox-short-lived-api-token","regex":"[\\w.\\-]{0,50}?(?:dropbox)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(sl\\.[a-z0-9\\-=_]{135})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["dropbox"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"duffel-api-token","regex":"duffel_(?:test|live)_[a-z0-9_\\-=A-Z]{43}","flags":"","keywords":["duffel_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"dynatrace-api-token","regex":"dt0c01\\.[a-z0-9A-Z]{24}\\.[a-z0-9A-Z]{64}","flags":"","keywords":["dt0c01."],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"easypost-api-token","regex":"\\bEZAK[a-z0-9A-Z]{54}\\b","flags":"","keywords":["ezak"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"easypost-test-api-token","regex":"\\bEZTK[a-z0-9A-Z]{54}\\b","flags":"","keywords":["eztk"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"etsy-access-token","regex":"[\\w.\\-]{0,50}?(?:(?:ETSY|[Ee]tsy))(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9A-Z]{24})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)","flags":"","keywords":["etsy"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"facebook-access-token","regex":"\\b(\\d{15,16}(\\||%)[0-9a-z\\-_]{27,40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["facebook"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"facebook-page-access-token","regex":"\\b(EAA[MC][a-z0-9A-Z]{100,})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["eaam","eaac"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"facebook-secret","regex":"[\\w.\\-]{0,50}?(?:facebook)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["facebook"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"fastly-api-token","regex":"[\\w.\\-]{0,50}?(?:fastly)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["fastly"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"finicity-api-token","regex":"[\\w.\\-]{0,50}?(?:finicity)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["finicity"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"finicity-client-secret","regex":"[\\w.\\-]{0,50}?(?:finicity)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["finicity"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"finnhub-access-token","regex":"[\\w.\\-]{0,50}?(?:finnhub)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["finnhub"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"flickr-access-token","regex":"[\\w.\\-]{0,50}?(?:flickr)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["flickr"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"flutterwave-encryption-key","regex":"FLWSECK_TEST-[a-h0-9A-H]{12}","flags":"","keywords":["flwseck_test"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"flutterwave-public-key","regex":"FLWPUBK_TEST-[a-h0-9A-H]{32}-[Xx]","flags":"","keywords":["flwpubk_test"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"flutterwave-secret-key","regex":"FLWSECK_TEST-[a-h0-9A-H]{32}-[Xx]","flags":"","keywords":["flwseck_test"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"flyio-access-token","regex":"\\b((?:fo1_[\\w\\-]{43}|fm1[ar]_[a-zA-Z0-9+\\/]{100,}={0,3}|fm2_[a-zA-Z0-9+\\/]{100,}={0,3}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["fo1_","fm1","fm2_"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"frameio-api-token","regex":"fio-u-[a-z0-9\\-_=A-Z]{64}","flags":"","keywords":["fio-u-"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"freshbooks-access-token","regex":"[\\w.\\-]{0,50}?(?:freshbooks)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["freshbooks"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gcp-api-key","regex":"\\b(AIza[\\w\\-]{35})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["aiza"],"entropy":4,"secretGroup":0,"allowlists":[{"condition":"OR","regexTarget":"secret","regexes":[{"regex":"AIzaSyabcdefghijklmnopqrstuvwxyz1234567","flags":""},{"regex":"AIzaSyAnLA7NfeLquW1tJFpx_eQCxoX-oo6YyIs","flags":""},{"regex":"AIzaSyCkEhVjf3pduRDt6d1yKOMitrUEke8agEM","flags":""},{"regex":"AIzaSyDMAScliyLx7F0NPDEJi1QmyCgHIAODrlU","flags":""},{"regex":"AIzaSyD3asb-2pEZVqMkmL6M9N6nHZRR_znhrh0","flags":""},{"regex":"AIzayDNSXIbFmlXbIE6mCzDLQAqITYefhixbX4A","flags":""},{"regex":"AIzaSyAdOS2zB6NCsk1pCdZ4-P6GBdi_UUPwX7c","flags":""},{"regex":"AIzaSyASWm6HmTMdYWpgMnjRBjxcQ9CKctWmLd4","flags":""},{"regex":"AIzaSyANUvH9H9BsUccjsu2pCmEkOPjjaXeDQgY","flags":""},{"regex":"AIzaSyA5_iVawFQ8ABuTZNUdcwERLJv_a_p4wtM","flags":""},{"regex":"AIzaSyA4UrcGxgwQFTfaI3no3t7Lt1sjmdnP5sQ","flags":""},{"regex":"AIzaSyDSb51JiIcB6OJpwwMicseKRhhrOq1cS7g","flags":""},{"regex":"AIzaSyBF2RrAIm4a0mO64EShQfqfd2AFnzAvvuU","flags":""},{"regex":"AIzaSyBcE-OOIbhjyR83gm4r2MFCu4MJmprNXsw","flags":""},{"regex":"AIzaSyB8qGxt4ec15vitgn44duC5ucxaOi4FmqE","flags":""},{"regex":"AIzaSyA8vmApnrHNFE0bApF4hoZ11srVL_n0nvY","flags":""}],"stopwords":[]}],"tier":"standard"},
+  {"id":"generic-api-key","regex":"[\\w.\\-]{0,50}?(?:[aA][cC][cC][eE][sS][sS]|[aA][uU][tT][hH]|(?:[Aa]pi|API)|[cC][rR][eE][dD][eE][nN][tT][iI][aA][lL]|[cC][rR][eE][dD][sS]|[kK][eE][yY]|[pP][aA][sS][sS][wW](?:[oO][rR])?[dD]|[sS][eE][cC][rR][eE][tT]|[tT][oO][kK][eE][nN])(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([\\w.=\\-]{10,150}|[a-z0-9A-Z][a-z0-9+/A-Z]{11,}={0,3})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)","flags":"","keywords":["access","api","auth","key","credential","creds","passwd","password","secret","token"],"entropy":3.5,"secretGroup":0,"allowlists":[{"condition":"OR","regexTarget":"secret","regexes":[{"regex":"^[a-zA-Z_.\\-]+$","flags":""}],"stopwords":[]},{"condition":"OR","regexTarget":"match","regexes":[{"regex":"(?:[aA][cC][cC][eE][sS][sS](?:[iI][bB][iI][lL][iI][tT][yY]|[oO][rR])|[aA][cC][cC][eE][sS][sS][_.\\-]?[iI][dD]|[rR][aA][nN][dD][oO][mM][_.\\-]?[aA][cC][cC][eE][sS][sS]|[aA][pP][iI][_.\\-]?(?:[iI][dD]|[nN][aA][mM][eE]|[vV][eE][rR][sS][iI][oO][nN])|[rR][aA][pP][iI][dD]|[cC][aA][pP][iI][tT][aA][lL]|[a-z0-9\\-A-Z]*?[aA][pP][iI][a-z0-9\\-A-Z]*?:[jJ][aA][rR]:|[aA][uU][tT][hH][oO][rR]|[Xx]-[Mm][Ss]-[Ee][xX][cC][hH][aA][nN][gG][eE]-[Oo][rR][gG][aA][nN][iI][zZ][aA][tT][iI][oO][nN]-[Aa][uU][tT][hH]|[Aa][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][iI][oO][nN]-[Rr][eE][sS][uU][lL][tT][sS]|(?:[cC][rR][eE][dD][eE][nN][tT][iI][aA][lL][sS]?[_.\\-]?[iI][dD]|[wW][iI][tT][hH][Cc][rR][eE][dD][eE][nN][tT][iI][aA][lL][sS])|(?:[bB][uU][cC][kK][eE][tT]|[fF][oO][rR][eE][iI][gG][nN]|[hH][oO][tT]|[iI][dD][xX]|[nN][aA][tT][uU][rR][aA][lL]|[pP][rR][iI][mM][aA][rR][yY]|[pP][uU][bB](?:[lL][iI][cC])?|[sS][cC][hH][eE][mM][aA]|[sS][eE][qQ][uU][eE][nN][cC][eE])[_.\\-]?[kK][eE][yY]|(?:[tT][uU][rR][kK][eE][yY])|[kK][eE][yY][_.\\-]?(?:[aA][lL][iI][aA][sS]|[bB][oO][aA][rR][dD]|[cC][oO][dD][eE]|[fF][rR][aA][mM][eE]|[iI][dD]|[lL][eE][nN][gG][tT][hH]|[mM][eE][sS][hH]|[nN][aA][mM][eE]|[pP][aA][iI][rR]|[pP][rR][eE][sS][sS](?:[eE][dD])?|[rR][iI][nN][gG]|[sS][eE][lL][eE][cC][tT][oO][rR]|[sS][iI][gG][nN][aA][tT][uU][rR][eE]|[sS][iI][zZ][eE]|[sS][tT][oO][nN][eE]|[sS][tT][oO][rR][eE][tT][yY][pP][eE]|[wW][oO][rR][dD]|[uU][pP]|[dD][oO][wW][nN]|[lL][eE][fF][tT]|[rR][iI][gG][hH][tT])|[kK][eE][yY][_.\\-]?[vV][aA][uU][lL][tT][_.\\-]?(?:[iI][dD]|[nN][aA][mM][eE])|[kK][eE][yY][Vv][aA][uU][lL][tT][Tt][oO][Ss][tT][oO][rR][eE][Ss][eE][cC][rR][eE][tT][sS]|[kK][eE][yY](?:[sS][tT][oO][rR][eE]|[tT][aA][bB])[_.\\-]?(?:[fF][iI][lL][eE]|[pP][aA][tT][hH])|[iI][sS][sS][uU][eE][rR][kK][eE][yY][hH][aA][sS][hH]|(?:[DdMm]onkey|[DM]ONKEY)|[kK][eE][yY][iI][nN][gG]|(?:[sS][eE][cC][rR][eE][tT])[_.\\-]?(?:[lL][eE][nN][gG][tT][hH]|[nN][aA][mM][eE]|[sS][iI][zZ][eE])|[Uu][sS][eE][rR][Ss][eE][cC][rR][eE][tT][sS][Ii][dD]|(?:[cC][sS][rR][fF])[_.\\-]?[tT][oO][kK][eE][nN]|(?:[iI][oO]\\.[jJ][sS][oO][nN][wW][eE][bB][tT][oO][kK][eE][nN][ \\t]?:[ \\t]?[\\w\\-]+)|(?:[aA][pP][iI]|[cC][rR][eE][dD][eE][nN][tT][iI][aA][lL][sS]|[tT][oO][kK][eE][nN])[_.\\-]?(?:[eE][nN][dD][pP][oO][iI][nN][tT]|[uU][rR][ilIL])|[pP][uU][bB][lL][iI][cC][_.\\-]?[tT][oO][kK][eE][nN]|(?:[kK][eE][yY]|[tT][oO][kK][eE][nN])[_.\\-]?[fF][iI][lL][eE]|(?:(?:[A-Z_]+=\\n[A-Z_]+=|[a-z_]+=\\n[a-z_]+=)(?:\\n|$))|(?:(?:[A-Z.]+=\\n[A-Z.]+=|[a-z.]+=\\n[a-z.]+=)(?:\\n|$)))","flags":""}],"stopwords":["000000","6fe4476ee5a1832882e326b506d14126","_ec2_","aaaaaa","about","abstract","academy","acces","account","act-","act.","act_","action","active","actively","activity","adapter","add-","add-on","add.","add_","addon","addres","admin","adobe","advanced","adventure","agent","agile","air-","air.","air_","ajax","akka","alert","alfred","algorithm","all-","all.","all_","alloy","alpha","amazon","amqp","analysi","analytic","analyzer","android","angular","angularj","animate","animation","another","ansible","answer","ant-","ant.","ant_","any-","any.","any_","apache","app-","app.","app_","apple","arch","archive","archived","arduino","array","art-","art.","art_","article","asp-","asp.","asp_","asset","async","atom","attention","audio","audit","aura","auth","author","authorize","auto","automated","automatic","awesome","aws_","azure","back","backbone","backend","backup","bar-","bar.","bar_","base","based","bash","basic","batch","been","beer","behavior","being","benchmark","best","beta","better","big-","big.","big_","binary","binding","bit-","bit.","bit_","bitcoin","block","blog","board","book","bookmark","boost","boot","bootstrap","bosh","bot-","bot.","bot_","bower","box-","box.","box_","boxen","bracket","branch","bridge","browser","brunch","buffer","bug-","bug.","bug_","build","builder","building","buildout","buildpack","built","bundle","busines","but-","but.","but_","button","cache","caching","cakephp","calendar","call","camera","campfire","can-","can.","can_","canva","captcha","capture","card","carousel","case","cassandra","cat-","cat.","cat_","category","center","cento","challenge","change","changelog","channel","chart","chat","cheat","check","checker","chef","ches","chinese","chosen","chrome","ckeditor","clas","classe","classic","clean","cli-","cli.","cli_","client","clojure","clone","closure","cloud","club","cluster","cms-","cms_","coco","code","coding","coffee","color","combination","combo","command","commander","comment","commit","common","community","compas","compiler","complete","component","composer","computer","computing","con-","con.","con_","concept","conf","config","connect","connector","console","contact","container","contao","content","contest","context","control","convert","converter","conway'","cookbook","cookie","cool","copy","cordova","core","couchbase","couchdb","countdown","counter","course","craft","crawler","create","creating","creator","credential","crm-","crm.","crm_","cros","crud","csv-","csv.","csv_","cube","cucumber","cuda","current","currently","custom","daemon","dark","dart","dash","dashboard","data","database","date","day-","day.","day_","dead","debian","debug","debugger","deck","define","del-","del.","del_","delete","demo","deploy","design","designer","desktop","detection","detector","dev-","dev.","dev_","develop","developer","device","devise","diff","digital","directive","directory","discovery","display","django","dns-","dns_","doc-","doc.","doc_","docker","docpad","doctrine","document","doe-","doe.","doe_","dojo","dom-","dom.","dom_","domain","don't","done","dot-","dot.","dot_","dotfile","download","draft","drag","drill","drive","driven","driver","drop","dropbox","drupal","dsl-","dsl.","dsl_","dynamic","easy","ecdsa","eclipse","edit","editing","edition","editor","element","emac","email","embed","embedded","ember","emitter","emulator","encoding","endpoint","engine","english","enhanced","entity","entry","env_","episode","erlang","error","espresso","event","evented","example","exchange","exercise","experiment","expire","exploit","explorer","export","exporter","expres","ext-","ext.","ext_","extended","extension","external","extra","extractor","fabric","facebook","factory","fake","fast","feature","feed","fewfwef","ffmpeg","field","file","filter","find","finder","firefox","firmware","first","fish","fix-","fix_","flash","flask","flat","flex","flexible","flickr","flow","fluent","fluentd","fluid","folder","font","force","foreman","fork","form","format","formatter","forum","foundry","framework","free","friend","friendly","front-end","frontend","ftp-","ftp.","ftp_","fuel","full","fun-","fun.","fun_","func","future","gaia","gallery","game","gateway","gem-","gem.","gem_","gen-","gen.","gen_","general","generator","generic","genetic","get-","get.","get_","getenv","getting","ghost","gist","git-","git.","git_","github","gitignore","gitlab","glas","gmail","gnome","gnu-","gnu.","gnu_","goal","golang","gollum","good","google","gpu-","gpu.","gpu_","gradle","grail","graph","graphic","great","grid","groovy","group","grunt","guard","gui-","gui.","gui_","guide","guideline","gulp","gwt-","gwt.","gwt_","hack","hackathon","hacker","hacking","hadoop","haml","handler","hardware","has-","has_","hash","haskell","have","haxe","hello","help","helper","here","hero","heroku","high","hipchat","history","home","homebrew","homepage","hook","host","hosting","hot-","hot.","hot_","house","how-","how.","how_","html","http","hub-","hub.","hub_","hubot","human","icon","ide-","ide.","ide_","idea","identity","idiomatic","image","impact","import","important","importer","impres","index","infinite","info","injection","inline","input","inside","inspector","instagram","install","installer","instant","intellij","interface","internet","interview","into","intro","ionic","iphone","ipython","irc-","irc_","iso-","iso.","iso_","issue","jade","jasmine","java","jbos","jekyll","jenkin","jetbrains","job-","job.","job_","joomla","jpa-","jpa.","jpa_","jquery","json","just","kafka","karma","kata","kernel","keyboard","kindle","kit-","kit.","kit_","kitchen","knife","koan","kohana","lab-","lab.","lab_","lambda","lamp","language","laravel","last","latest","latex","launcher","layer","layout","lazy","ldap","leaflet","league","learn","learning","led-","led.","led_","leetcode","les-","les.","les_","level","leveldb","lib-","lib.","lib_","librarie","library","license","life","liferay","light","lightbox","like","line","link","linked","linkedin","linux","lisp","list","lite","little","load","loader","local","location","lock","log-","log.","log_","logger","logging","logic","login","logstash","longer","look","love","lua-","lua.","lua_","mac-","mac.","mac_","machine","made","magento","magic","mail","make","maker","making","man-","man.","man_","manage","manager","manifest","manual","map-","map.","map_","mapper","mapping","markdown","markup","master","math","matrix","maven","md5","mean","media","mediawiki","meetup","memcached","memory","menu","merchant","message","messaging","meta","metadata","meteor","method","metric","micro","middleman","migration","minecraft","miner","mini","minimal","mirror","mit-","mit.","mit_","mobile","mocha","mock","mod-","mod.","mod_","mode","model","modern","modular","module","modx","money","mongo","mongodb","mongoid","mongoose","monitor","monkey","more","motion","moved","movie","mozilla","mqtt","mule","multi","multiple","music","mustache","mvc-","mvc.","mvc_","mysql","nagio","name","native","need","neo-","neo.","neo_","nest","nested","net-","net.","net_","nette","network","new-","new.","new_","next","nginx","ninja","nlp-","nlp.","nlp_","node","nodej","nosql","not-","not.","not_","note","notebook","notepad","notice","notifier","now-","now.","now_","number","oauth","object","objective","obsolete","ocaml","octopres","official","old-","old.","old_","onboard","online","only","open","opencv","opengl","openshift","openwrt","option","oracle","org-","org.","org_","origin","original","orm-","orm.","orm_","osx-","osx_","our-","our.","our_","out-","out.","out_","output","over","overview","own-","own.","own_","pack","package","packet","page","panel","paper","paperclip","para","parallax","parallel","parse","parser","parsing","particle","party","password","patch","path","pattern","payment","paypal","pdf-","pdf.","pdf_","pebble","people","perl","personal","phalcon","phoenix","phone","phonegap","photo","php-","php.","php_","physic","picker","pipeline","platform","play","player","please","plu-","plu.","plu_","plug-in","plugin","plupload","png-","png.","png_","poker","polyfill","polymer","pool","pop-","pop.","pop_","popcorn","popup","port","portable","portal","portfolio","post","power","powered","powerful","prelude","pretty","preview","principle","print","pro-","pro.","pro_","problem","proc","product","profile","profiler","program","progres","project","protocol","prototype","provider","proxy","public","pull","puppet","pure","purpose","push","pusher","pyramid","python","quality","query","queue","quick","rabbitmq","rack","radio","rail","railscast","random","range","raspberry","rdf-","rdf.","rdf_","react","reactive","read","reader","readme","ready","real","real-time","reality","realtime","recipe","recorder","red-","red.","red_","reddit","redi","redmine","reference","refinery","refresh","registry","related","release","remote","rendering","repo","report","request","require","required","requirej","research","resource","response","resque","rest","restful","resume","reveal","reverse","review","riak","rich","right","ring","robot","role","room","router","routing","rpc-","rpc.","rpc_","rpg-","rpg.","rpg_","rspec","ruby-","ruby.","ruby_","rule","run-","run.","run_","runner","running","runtime","rust","rvm-","rvm.","rvm_","salt","sample","sandbox","sas-","sas.","sas_","sbt-","sbt.","sbt_","scala","scalable","scanner","schema","scheme","school","science","scraper","scratch","screen","script","scroll","scs-","scs.","scs_","sdk-","sdk.","sdk_","sdl-","sdl.","sdl_","search","secure","security","see-","see.","see_","seed","select","selector","selenium","semantic","sencha","send","sentiment","serie","server","service","session","set-","set.","set_","setting","setup","sha1","sha2","sha256","share","shared","sharing","sheet","shell","shield","shipping","shop","shopify","shortener","should","show","showcase","side","silex","simple","simulator","single","site","skeleton","sketch","skin","slack","slide","slider","slim","small","smart","smtp","snake","snapshot","snippet","soap","social","socket","software","solarized","solr","solution","solver","some","soon","source","space","spark","spatial","spec","sphinx","spine","spotify","spree","spring","sprite","sql-","sql.","sql_","sqlite","ssh-","ssh.","ssh_","stack","staging","standard","stanford","start","started","starter","startup","stat","statamic","state","static","statistic","statsd","statu","steam","step","still","stm-","stm.","stm_","storage","store","storm","story","strategy","stream","streaming","string","stripe","structure","studio","study","stuff","style","sublime","sugar","suite","summary","super","support","supported","svg-","svg.","svg_","svn-","svn.","svn_","swagger","swift","switch","switcher","symfony","symphony","sync","synopsi","syntax","system","tab-","tab.","tab_","table","tag-","tag.","tag_","talk","target","task","tcp-","tcp.","tcp_","tdd-","tdd.","tdd_","team","tech","template","term","terminal","testing","tetri","text","textmate","theme","theory","three","thrift","time","timeline","timer","tiny","tinymce","tip-","tip.","tip_","title","todo","todomvc","token","tool","toolbox","toolkit","top-","top.","top_","tornado","touch","tower","tracker","tracking","traffic","training","transfer","translate","transport","tree","trello","try-","try.","try_","tumblr","tut-","tut.","tut_","tutorial","tweet","twig","twitter","type","typo","ubuntu","uiview","ultimate","under","unit","unity","universal","unix","update","updated","upgrade","upload","uploader","uri-","uri.","uri_","url-","url.","url_","usage","usb-","usb.","usb_","use-","use.","use_","used","useful","user","using","util","utilitie","utility","vagrant","validator","value","variou","varnish","version","via-","via.","via_","video","view","viewer","vim-","vim.","vim_","vimrc","virtual","vision","visual","vpn","want","warning","watch","watcher","wave","way-","way.","way_","weather","web-","web_","webapp","webgl","webhook","webkit","webrtc","website","websocket","welcome","what","what'","when","where","which","why-","why.","why_","widget","wifi","wiki","win-","win.","win_","window","wip-","wip.","wip_","within","without","wizard","word","wordpres","work","worker","workflow","working","workshop","world","wrapper","write","writer","writing","written","www-","www.","www_","xamarin","xcode","xml-","xml.","xml_","xmpp","xxxxxx","yahoo","yaml","yandex","yeoman","yet-","yet.","yet_","yii-","yii.","yii_","youtube","yui-","yui.","yui_","zend","zero","zip-","zip.","zip_","zsh-","zsh.","zsh_"]},{"condition":"OR","regexTarget":"line","regexes":[{"regex":"--mount=type=secret,","flags":""},{"regex":"import[ \\t]+{[ \\t\\w,]+}[ \\t]+from[ \\t]+['\"][^'\"]+['\"]","flags":""}],"stopwords":[]}],"tier":"strict"},
+  {"id":"github-app-token","regex":"(?:ghu|ghs)_[0-9a-zA-Z]{36}","flags":"","keywords":["ghu_","ghs_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"github-fine-grained-pat","regex":"github_pat_\\w{82}","flags":"","keywords":["github_pat_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"github-oauth","regex":"gho_[0-9a-zA-Z]{36}","flags":"","keywords":["gho_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"github-pat","regex":"ghp_[0-9a-zA-Z]{36}","flags":"","keywords":["ghp_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"github-refresh-token","regex":"ghr_[0-9a-zA-Z]{36}","flags":"","keywords":["ghr_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-cicd-job-token","regex":"glcbt-[0-9a-zA-Z]{1,5}_[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["glcbt-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-deploy-token","regex":"gldt-[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["gldt-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-feature-flag-client-token","regex":"glffct-[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["glffct-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-feed-token","regex":"glft-[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["glft-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-incoming-mail-token","regex":"glimt-[0-9a-zA-Z_\\-]{25}","flags":"","keywords":["glimt-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-kubernetes-agent-token","regex":"glagent-[0-9a-zA-Z_\\-]{50}","flags":"","keywords":["glagent-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-oauth-app-secret","regex":"gloas-[0-9a-zA-Z_\\-]{64}","flags":"","keywords":["gloas-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-pat","regex":"glpat-[\\w\\-]{20}","flags":"","keywords":["glpat-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-pat-routable","regex":"\\bglpat-[0-9a-zA-Z_\\-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b","flags":"","keywords":["glpat-"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-ptt","regex":"glptt-[0-9a-f]{40}","flags":"","keywords":["glptt-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-rrt","regex":"GR1348941[\\w\\-]{20}","flags":"","keywords":["gr1348941"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-runner-authentication-token","regex":"glrt-[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["glrt-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-runner-authentication-token-routable","regex":"\\bglrt-t\\d_[0-9a-zA-Z_\\-]{27,300}\\.[0-9a-z]{2}[0-9a-z]{7}\\b","flags":"","keywords":["glrt-"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-scim-token","regex":"glsoat-[0-9a-zA-Z_\\-]{20}","flags":"","keywords":["glsoat-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitlab-session-cookie","regex":"_gitlab_session=[0-9a-z]{32}","flags":"","keywords":["_gitlab_session="],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gitter-access-token","regex":"[\\w.\\-]{0,50}?(?:gitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["gitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"gocardless-api-token","regex":"[\\w.\\-]{0,50}?(?:gocardless)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(live_[a-z0-9\\-_=A-Z]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["live_","gocardless"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"grafana-api-key","regex":"\\b(eyJrIjoi[A-Za-z0-9]{70,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["eyjrijoi"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"grafana-cloud-api-token","regex":"\\b(glc_[A-Za-z0-9+/]{32,400}={0,3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["glc_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"grafana-service-account-token","regex":"\\b(glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["glsa_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"harness-api-key","regex":"(?:pat|sat)\\.[a-zA-Z0-9_\\-]{22}\\.[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{20}","flags":"","keywords":["pat.","sat."],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"hashicorp-tf-api-token","regex":"[a-z0-9A-Z]{14}\\.(?:atlasv1)\\.[a-z0-9\\-_=A-Z]{60,70}","flags":"","keywords":["atlasv1"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"heroku-api-key","regex":"[\\w.\\-]{0,50}?(?:heroku)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["heroku"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"heroku-api-key-v2","regex":"\\b((HRKU-AA[0-9a-zA-Z_\\-]{58}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["hrku-aa"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"hubspot-api-key","regex":"[\\w.\\-]{0,50}?(?:hubspot)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["hubspot"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"huggingface-access-token","regex":"\\b(hf_(?:[a-zA-Z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["hf_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"huggingface-organization-api-token","regex":"\\b(api_org_(?:[a-zA-Z]{34}))(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["api_org_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"infracost-api-token","regex":"\\b(ico-[a-zA-Z0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["ico-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"intercom-api-key","regex":"[\\w.\\-]{0,50}?(?:intercom)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{60})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["intercom"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"intra42-client-secret","regex":"\\b(s-s4t2(?:ud|af)-[abcdef0123456789ABCDEF]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["intra","s-s4t2ud-","s-s4t2af-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"jfrog-api-key","regex":"[\\w.\\-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{73})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["jfrog","artifactory","bintray","xray"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"jfrog-identity-token","regex":"[\\w.\\-]{0,50}?(?:jfrog|artifactory|bintray|xray)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["jfrog","artifactory","bintray","xray"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"jwt","regex":"\\b(ey[a-zA-Z0-9]{17,}\\.ey[a-zA-Z0-9\\/\\\\_\\-]{17,}\\.(?:[a-zA-Z0-9\\/\\\\_\\-]{10,}={0,2})?)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["ey"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"jwt-base64","regex":"\\bZXlK(?:(?<alg>aGJHY2lPaU)|(?<apu>aGNIVWlPaU)|(?<apv>aGNIWWlPaU)|(?<aud>aGRXUWlPaU)|(?<b64>aU5qUWlP)|(?<crit>amNtbDBJanBi)|(?<cty>amRIa2lPaU)|(?<epk>bGNHc2lPbn)|(?<enc>bGJtTWlPaU)|(?<jku>cWEzVWlPaU)|(?<jwk>cWQyc2lPb)|(?<iss>cGMzTWlPaU)|(?<iv>cGRpSTZJ)|(?<kid>cmFXUWlP)|(?<key_ops>clpYbGZiM0J6SWpwY)|(?<kty>cmRIa2lPaUp)|(?<nonce>dWIyNWpaU0k2)|(?<p2c>d01tTWlP)|(?<p2s>d01uTWlPaU)|(?<ppt>d2NIUWlPaU)|(?<sub>emRXSWlPaU)|(?<svt>emRuUWlP)|(?<tag>MFlXY2lPaU)|(?<typ>MGVYQWlPaUp)|(?<url>MWNtd2l)|(?<use>MWMyVWlPaUp)|(?<ver>MlpYSWlPaU)|(?<version>MlpYSnphVzl1SWpv)|(?<x>NElqb2)|(?<x5c>NE5XTWlP)|(?<x5t>NE5YUWlPaU)|(?<x5ts256>NE5YUWpVekkxTmlJNkl)|(?<x5u>NE5YVWlPaU)|(?<zip>NmFYQWlPaU))[a-zA-Z0-9\\/\\\\_+\\-\\r\\n]{40,}={0,2}","flags":"","keywords":["zxlk"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"kraken-access-token","regex":"[\\w.\\-]{0,50}?(?:kraken)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9\\/=_\\+\\-]{80,90})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["kraken"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"kucoin-access-token","regex":"[\\w.\\-]{0,50}?(?:kucoin)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["kucoin"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"kucoin-secret-key","regex":"[\\w.\\-]{0,50}?(?:kucoin)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["kucoin"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"launchdarkly-access-token","regex":"[\\w.\\-]{0,50}?(?:launchdarkly)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["launchdarkly"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"linear-api-key","regex":"lin_api_[a-z0-9A-Z]{40}","flags":"","keywords":["lin_api_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"linear-client-secret","regex":"[\\w.\\-]{0,50}?(?:linear)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["linear"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"linkedin-client-id","regex":"[\\w.\\-]{0,50}?(?:linked[_\\-]?in)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{14})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["linkedin","linked_in","linked-in"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"linkedin-client-secret","regex":"[\\w.\\-]{0,50}?(?:linked[_\\-]?in)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["linkedin","linked_in","linked-in"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"lob-api-key","regex":"[\\w.\\-]{0,50}?(?:lob)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((live|test)_[a-f0-9]{35})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["test_","live_"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"lob-pub-api-key","regex":"[\\w.\\-]{0,50}?(?:lob)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((test|live)_pub_[a-f0-9]{31})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["test_pub","live_pub","_pub"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"looker-client-id","regex":"[\\w.\\-]{0,50}?(?:looker)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["looker"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"looker-client-secret","regex":"[\\w.\\-]{0,50}?(?:looker)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["looker"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mailchimp-api-key","regex":"[\\w.\\-]{0,50}?(?:MailchimpSDK[^\\n]initialize|mailchimp)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{32}-us\\d\\d)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mailchimp"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mailgun-private-api-token","regex":"[\\w.\\-]{0,50}?(?:mailgun)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(key-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mailgun"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mailgun-pub-key","regex":"[\\w.\\-]{0,50}?(?:mailgun)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pubkey-[a-f0-9]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mailgun"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mailgun-signing-key","regex":"[\\w.\\-]{0,50}?(?:mailgun)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-h0-9]{32}-[a-h0-9]{8}-[a-h0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mailgun"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mapbox-api-token","regex":"[\\w.\\-]{0,50}?(?:mapbox)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(pk\\.[a-z0-9]{60}\\.[a-z0-9]{22})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mapbox"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"mattermost-access-token","regex":"[\\w.\\-]{0,50}?(?:mattermost)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["mattermost"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"maxmind-license-key","regex":"\\b([A-Za-z0-9]{6}_[A-Za-z0-9]{29}_mmk)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["_mmk"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"messagebird-api-token","regex":"[\\w.\\-]{0,50}?(?:message[_\\-]?bird)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["messagebird","message-bird","message_bird"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"messagebird-client-id","regex":"[\\w.\\-]{0,50}?(?:message[_\\-]?bird)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["messagebird","message-bird","message_bird"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"microsoft-teams-webhook","regex":"https://[a-z0-9]+\\.webhook\\.office\\.com/webhookb2/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}@[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}/IncomingWebhook/[a-z0-9]{32}/[a-z0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}","flags":"","keywords":["webhook.office.com","webhookb2","incomingwebhook"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"netlify-access-token","regex":"[\\w.\\-]{0,50}?(?:netlify)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{40,46})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["netlify"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"new-relic-browser-api-token","regex":"[\\w.\\-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRJS-[a-f0-9]{19})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["nrjs-"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"new-relic-insert-key","regex":"[\\w.\\-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRII-[a-z0-9\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["nrii-"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"new-relic-user-api-id","regex":"[\\w.\\-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["new-relic","newrelic","new_relic"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"new-relic-user-api-key","regex":"[\\w.\\-]{0,50}?(?:new-relic|newrelic|new_relic)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(NRAK-[a-z0-9]{27})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["nrak"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"notion-api-token","regex":"\\b(ntn_[0-9]{11}[A-Za-z0-9]{32}[A-Za-z0-9]{3})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["ntn_"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"npm-access-token","regex":"\\b(npm_[a-z0-9]{36})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["npm_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"nytimes-access-token","regex":"[\\w.\\-]{0,50}?(?:nytimes|new-york-times,|newyorktimes)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9=_\\-]{32})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["nytimes","new-york-times","newyorktimes"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"octopus-deploy-api-key","regex":"\\b(API-[A-Z0-9]{26})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["api-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"openai-api-key","regex":"\\b(sk-(?:proj|svcacct|admin)-(?:[A-Za-z0-9_\\-]{74}|[A-Za-z0-9_\\-]{58})T3BlbkFJ(?:[A-Za-z0-9_\\-]{74}|[A-Za-z0-9_\\-]{58})\\b|sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["t3blbkfj"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"openshift-user-token","regex":"\\b(sha256~[\\w\\-]{43})(?:[^\\w\\-]|$)","flags":"","keywords":["sha256~"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"perplexity-api-key","regex":"\\b(pplx-[a-zA-Z0-9]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$|\\b)","flags":"","keywords":["pplx-"],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"plaid-api-token","regex":"[\\w.\\-]{0,50}?(?:plaid)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(access-(?:sandbox|development|production)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["plaid"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"plaid-client-id","regex":"[\\w.\\-]{0,50}?(?:plaid)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{24})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["plaid"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"plaid-secret-key","regex":"[\\w.\\-]{0,50}?(?:plaid)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["plaid"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"planetscale-api-token","regex":"\\b(pscale_tkn_[\\w=\\.\\-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["pscale_tkn_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"planetscale-oauth-token","regex":"\\b(pscale_oauth_[\\w=\\.\\-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["pscale_oauth_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"planetscale-password","regex":"\\b(pscale_pw_[\\w=\\.\\-]{32,64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["pscale_pw_"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"postman-api-token","regex":"\\b(PMAK-[a-f0-9A-F]{24}\\-[a-f0-9A-F]{34})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["pmak-"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"prefect-api-token","regex":"\\b(pnu_[a-zA-Z0-9]{36})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["pnu_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"private-key","regex":"-----BEGIN[ A-Z0-9_\\-]{0,100}PRIVATE KEY(?: BLOCK)?-----[\\s\\S\\-]{64,}?KEY(?: BLOCK)?-----","flags":"i","keywords":["-----begin"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"pulumi-api-token","regex":"\\b(pul-[a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["pul-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"pypi-upload-token","regex":"pypi-AgEIcHlwaS5vcmc[\\w\\-]{50,1000}","flags":"","keywords":["pypi-ageichlwas5vcmc"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"rapidapi-access-token","regex":"[\\w.\\-]{0,50}?(?:rapidapi)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9_\\-]{50})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["rapidapi"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"readme-api-token","regex":"\\b(rdme_[a-z0-9]{70})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["rdme_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"rubygems-api-token","regex":"\\b(rubygems_[a-f0-9]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["rubygems_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"scalingo-api-token","regex":"\\b(tk-us-[\\w\\-]{48})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["tk-us-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sendbird-access-id","regex":"[\\w.\\-]{0,50}?(?:sendbird)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["sendbird"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sendbird-access-token","regex":"[\\w.\\-]{0,50}?(?:sendbird)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["sendbird"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sendgrid-api-token","regex":"\\b(SG\\.[a-z0-9=_\\-\\.A-Z]{66})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sg."],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sendinblue-api-token","regex":"\\b(xkeysib-[a-f0-9]{64}\\-[a-z0-9A-Z]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["xkeysib-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sentry-access-token","regex":"[\\w.\\-]{0,50}?(?:sentry)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["sentry"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sentry-org-token","regex":"\\bsntrys_eyJpYXQiO[a-zA-Z0-9+/]{10,200}(?:LCJyZWdpb25fdXJs|InJlZ2lvbl91cmwi|cmVnaW9uX3VybCI6)[a-zA-Z0-9+/]{10,200}={0,2}_[a-zA-Z0-9+/]{43}(?:[^a-zA-Z0-9+/]|$)","flags":"","keywords":["sntrys_eyjpyxqio"],"entropy":4.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sentry-user-token","regex":"\\b(sntryu_[a-f0-9]{64})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sntryu_"],"entropy":3.5,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"settlemint-application-access-token","regex":"\\b(sm_aat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sm_aat"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"settlemint-personal-access-token","regex":"\\b(sm_pat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sm_pat"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"settlemint-service-access-token","regex":"\\b(sm_sat_[a-zA-Z0-9]{16})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sm_sat"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"shippo-api-token","regex":"\\b(shippo_(?:live|test)_[a-fA-F0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["shippo_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"shopify-access-token","regex":"shpat_[a-fA-F0-9]{32}","flags":"","keywords":["shpat_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"shopify-custom-access-token","regex":"shpca_[a-fA-F0-9]{32}","flags":"","keywords":["shpca_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"shopify-private-app-access-token","regex":"shppa_[a-fA-F0-9]{32}","flags":"","keywords":["shppa_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"shopify-shared-secret","regex":"shpss_[a-fA-F0-9]{32}","flags":"","keywords":["shpss_"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sidekiq-secret","regex":"[\\w.\\-]{0,50}?(?:BUNDLE_ENTERPRISE__CONTRIBSYS__COM|BUNDLE_GEMS__CONTRIBSYS__COM)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-f0-9]{8}:[a-f0-9]{8})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["bundle_enterprise__contribsys__com","bundle_gems__contribsys__com"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sidekiq-sensitive-url","regex":"\\bhttps?://([a-f0-9]{8}:[a-f0-9]{8})@(?:gems[^\\n]contribsys[^\\n]com|enterprise[^\\n]contribsys[^\\n]com)(?:[\\/|\\#|\\?|:]|$)","flags":"i","keywords":["gems.contribsys.com","enterprise.contribsys.com"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-app-token","regex":"xapp-\\d-[A-Z0-9]+-\\d+-[a-z0-9]+","flags":"i","keywords":["xapp"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-bot-token","regex":"xoxb-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9\\-]*","flags":"","keywords":["xoxb"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-config-access-token","regex":"xoxe[^\\n]xox[bp]-\\d-[A-Z0-9]{163,166}","flags":"i","keywords":["xoxe.xoxb-","xoxe.xoxp-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-config-refresh-token","regex":"xoxe-\\d-[A-Z0-9]{146}","flags":"i","keywords":["xoxe-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-legacy-bot-token","regex":"xoxb-[0-9]{8,14}-[a-zA-Z0-9]{18,26}","flags":"","keywords":["xoxb"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-legacy-token","regex":"xox[os]-\\d+-\\d+-\\d+-[a-fA-F\\d]+","flags":"","keywords":["xoxo","xoxs"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-legacy-workspace-token","regex":"xox[ar]-(?:\\d-)?[0-9a-zA-Z]{8,48}","flags":"","keywords":["xoxa","xoxr"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-user-token","regex":"xox[pe](?:-[0-9]{10,13}){3}-[a-zA-Z0-9\\-]{28,34}","flags":"","keywords":["xoxp-","xoxe-"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"slack-webhook-url","regex":"(?:https?://)?hooks[^\\n]slack[^\\n]com/(?:services|workflows|triggers)/[A-Za-z0-9+/]{43,56}","flags":"","keywords":["hooks.slack.com"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"snyk-api-token","regex":"[\\w.\\-]{0,50}?(?:snyk[_.\\-]?(?:(?:api|oauth)[_.\\-]?)?(?:key|token))(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["snyk"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sonar-api-token","regex":"[\\w.\\-]{0,50}?(?:sonar[_.\\-]?(login|token))(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}((?:squ_|sqp_|sqa_)?[a-z0-9=_\\-]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["sonar"],"entropy":0,"secretGroup":2,"allowlists":[],"tier":"standard"},
+  {"id":"sourcegraph-access-token","regex":"\\b(\\b(sgp_(?:[a-fA-F0-9]{16}|local)_[a-fA-F0-9]{40}|sgp_[a-fA-F0-9]{40}|[a-fA-F0-9]{40})\\b)(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["sgp_","sourcegraph"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"square-access-token","regex":"\\b((?:EAAA|sq0atp-)[\\w\\-]{22,60})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sq0atp-","eaaa"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"squarespace-access-token","regex":"[\\w.\\-]{0,50}?(?:squarespace)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["squarespace"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"stripe-access-token","regex":"\\b((?:sk|rk)_(?:test|live|prod)_[a-zA-Z0-9]{10,99})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["sk_test","sk_live","sk_prod","rk_test","rk_live","rk_prod"],"entropy":2,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"sumologic-access-token","regex":"[\\w.\\-]{0,50}?(?:(?:[Ss]umo|SUMO))(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9A-Z]{64})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)","flags":"","keywords":["sumo"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"telegram-bot-api-token","regex":"[\\w.\\-]{0,50}?(?:[tT][eE][lL][eE][gG][rR])(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{5,16}:(?:A)[a-z0-9_\\-A-Z]{34})(?:[\\x60'\"\\s;]|\\\\[nrNR]|$)","flags":"","keywords":["telegr"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"travisci-access-token","regex":"[\\w.\\-]{0,50}?(?:travis)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{22})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["travis"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twilio-api-key","regex":"SK[0-9a-fA-F]{32}","flags":"","keywords":["sk"],"entropy":3,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitch-api-token","regex":"[\\w.\\-]{0,50}?(?:twitch)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{30})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitch"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitter-access-secret","regex":"[\\w.\\-]{0,50}?(?:twitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{45})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitter-access-token","regex":"[\\w.\\-]{0,50}?(?:twitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([0-9]{15,25}-[a-zA-Z0-9]{20,40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitter-api-key","regex":"[\\w.\\-]{0,50}?(?:twitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{25})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitter-api-secret","regex":"[\\w.\\-]{0,50}?(?:twitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{50})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"twitter-bearer-token","regex":"[\\w.\\-]{0,50}?(?:twitter)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(A{22}[a-zA-Z0-9%]{80,100})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["twitter"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"typeform-api-token","regex":"[\\w.\\-]{0,50}?(?:typeform)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(tfp_[a-z0-9\\-_\\.=]{59})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["tfp_"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"vault-batch-token","regex":"\\b(hvb\\.[\\w\\-]{138,300})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["hvb."],"entropy":4,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"vault-service-token","regex":"\\b((?:hvs\\.[\\w\\-]{90,120}|s\\.(?:[a-z0-9A-Z]{24})))(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"","keywords":["hvs.","s."],"entropy":3.5,"secretGroup":0,"allowlists":[{"condition":"OR","regexTarget":"secret","regexes":[{"regex":"s\\.[A-Za-z]{24}","flags":""}],"stopwords":[]}],"tier":"standard"},
+  {"id":"yandex-access-token","regex":"[\\w.\\-]{0,50}?(?:yandex)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(t1\\.[A-Z0-9a-z_\\-]+[=]{0,2}\\.[A-Z0-9a-z_\\-]{86}[=]{0,2})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["yandex"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"yandex-api-key","regex":"[\\w.\\-]{0,50}?(?:yandex)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(AQVN[A-Za-z0-9_\\-]{35,38})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["yandex"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"yandex-aws-access-token","regex":"[\\w.\\-]{0,50}?(?:yandex)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}(YC[a-zA-Z0-9_\\-]{38})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["yandex"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"zendesk-secret-key","regex":"[\\w.\\-]{0,50}?(?:zendesk)(?:[ \\t\\w.\\-]{0,20})[\\s'\"]{0,3}(?:=|>|:{1,3}=|\\|\\||:|=>|\\?=|,)[\\x60'\"\\s=]{0,5}([a-z0-9]{40})(?:[\\x60'\"\\s;]|\\\\[nr]|$)","flags":"i","keywords":["zendesk"],"entropy":0,"secretGroup":0,"allowlists":[],"tier":"standard"},
+  {"id":"openviking-gateway-key","regex":"(?<![A-Za-z0-9_-])(ovgw_[A-Za-z0-9_-]{43})(?![A-Za-z0-9_-])","flags":"","keywords":["ovgw_"],"entropy":3,"secretGroup":1,"allowlists":[],"tier":"standard"},
+  {"id":"openviking-gateway-management-key","regex":"(?<![A-Za-z0-9_-])(ovgm_[A-Za-z0-9_-]{43})(?![A-Za-z0-9_-])","flags":"","keywords":["ovgm_"],"entropy":3,"secretGroup":1,"allowlists":[],"tier":"standard"},
+  {"id":"openviking-oauth-access-token","regex":"(?<![A-Za-z0-9_-])(ovat_[A-Za-z0-9_-]{54})(?![A-Za-z0-9_-])","flags":"","keywords":["ovat_"],"entropy":3,"secretGroup":1,"allowlists":[],"tier":"standard"},
+  {"id":"openviking-oauth-refresh-token","regex":"(?<![A-Za-z0-9_-])(ovrt_[A-Za-z0-9_-]{54})(?![A-Za-z0-9_-])","flags":"","keywords":["ovrt_"],"entropy":3,"secretGroup":1,"allowlists":[],"tier":"standard"},
+  {"id":"openviking-oauth-auth-code","regex":"(?<![A-Za-z0-9_-])(ovac_[A-Za-z0-9_-]{54})(?![A-Za-z0-9_-])","flags":"","keywords":["ovac_"],"entropy":3,"secretGroup":1,"allowlists":[],"tier":"standard"},
+];