@vaultcompass/vault-guard-core 1.0.6 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -30,8 +30,16 @@ const regex_safety_1 = require("../utils/regex-safety");
|
|
|
30
30
|
const BUILTIN_PATTERNS = new Map([
|
|
31
31
|
// --- AI / ML providers ---
|
|
32
32
|
['anthropic', { regex: /sk-ant-[a-zA-Z0-9_-]{20,}/g, severity: 'critical' }],
|
|
33
|
-
|
|
34
|
-
|
|
33
|
+
// OpenAI key formats. All modern keys embed the T3BlbkFJ watermark (base64 "OpenAI").
|
|
34
|
+
// Specific prefixes are ordered first so they get their own rule title (blast radius differs).
|
|
35
|
+
// The legacy sk- catch-all uses the watermark + token-boundary so it does not shadow the
|
|
36
|
+
// prefixed rules and avoids matching short benign identifiers.
|
|
37
|
+
['openai-project', { regex: /sk-proj-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
|
|
38
|
+
['openai-svcacct', { regex: /sk-svcacct-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
|
|
39
|
+
['openai-admin', { regex: /sk-admin-[A-Za-z0-9_-]{20,100}T3BlbkFJ[A-Za-z0-9_-]{20,100}/g, severity: 'critical' }],
|
|
40
|
+
// Legacy user key (sk-<20>T3BlbkFJ<20+>). Token-boundary anchored so benign sk- prefixes
|
|
41
|
+
// in identifiers (e.g. sk-None-short) don't fire without the watermark present.
|
|
42
|
+
['openai', { regex: /(?<![A-Za-z0-9_-])sk-[a-zA-Z0-9]{20}T3BlbkFJ[a-zA-Z0-9]{20,}/g, severity: 'critical' }],
|
|
35
43
|
['huggingface', { regex: /hf_[a-zA-Z0-9]{34,}/g, severity: 'critical' }],
|
|
36
44
|
['replicate', { regex: /r8_[a-zA-Z0-9]{32}/g, severity: 'critical' }],
|
|
37
45
|
// --- Payment processors ---
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vaultcompass/vault-guard-core",
|
|
3
|
-
"version": "1.0
|
|
3
|
+
"version": "1.1.0",
|
|
4
4
|
"description": "Secret-scanning engine: vendor-anchored patterns, entropy gating, baselines, SARIF/JSON, hook helpers.",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|