context-armor 0.1.0

package/src/reporters.js

@@ -0,0 +1,148 @@
+import path from "node:path";
+
+const colors = {
+  critical: "\u001b[31;1m",
+  high: "\u001b[31m",
+  medium: "\u001b[33m",
+  low: "\u001b[36m",
+  dim: "\u001b[2m",
+  reset: "\u001b[0m",
+};
+
+function colorize(value, color, enabled) {
+  return enabled ? `${colors[color]}${value}${colors.reset}` : value;
+}
+
+export function formatPretty(result, options = {}) {
+  const useColor = options.color ?? (process.stdout.isTTY && !process.env.NO_COLOR);
+  const lines = [];
+  lines.push(
+    `Context Armor scanned ${result.files.discovered} files in ${result.durationMs}ms`,
+  );
+  lines.push("");
+
+  if (result.findings.length === 0) {
+    lines.push(colorize("No sensitive findings detected.", "low", useColor));
+  } else {
+    for (const finding of result.findings) {
+      const severity = finding.severity.toUpperCase().padEnd(8);
+      const location =
+        finding.kind === "content"
+          ? `${finding.path}:${finding.line}:${finding.column}`
+          : finding.path;
+      lines.push(
+        `${colorize(severity, finding.severity, useColor)} ${location} ${colorize(
+          finding.ruleId,
+          "dim",
+          useColor,
+        )}`,
+      );
+      lines.push(`         ${finding.message}`);
+    }
+  }
+
+  const counts = result.summary.bySeverity;
+  lines.push("");
+  lines.push(
+    [
+      colorize(`${counts.critical || 0} critical`, "critical", useColor),
+      colorize(`${counts.high || 0} high`, "high", useColor),
+      colorize(`${counts.medium || 0} medium`, "medium", useColor),
+      colorize(`${counts.low || 0} low`, "low", useColor),
+    ].join(" · "),
+  );
+  if (result.suppressed) lines.push(`${result.suppressed} baseline findings suppressed`);
+  if (result.warnings.length) lines.push(`${result.warnings.length} scan warnings`);
+  if (result.files.skipped) lines.push(`${result.files.skipped} files skipped or uninspected`);
+  return `${lines.join("\n")}\n`;
+}
+
+export function formatJson(result) {
+  return `${JSON.stringify(result, null, 2)}\n`;
+}
+
+function sarifLevel(severity) {
+  if (severity === "critical" || severity === "high") return "error";
+  if (severity === "medium") return "warning";
+  return "note";
+}
+
+export function formatSarif(result) {
+  const ruleMap = new Map();
+  for (const finding of result.findings) {
+    if (!ruleMap.has(finding.ruleId)) {
+      ruleMap.set(finding.ruleId, {
+        id: finding.ruleId,
+        name: finding.title.replace(/\s+/g, ""),
+        shortDescription: { text: finding.title },
+        fullDescription: { text: finding.message },
+        defaultConfiguration: { level: sarifLevel(finding.severity) },
+        properties: {
+          precision: "high",
+          securitySeverity:
+            finding.severity === "critical"
+              ? "9.0"
+              : finding.severity === "high"
+                ? "7.0"
+                : finding.severity === "medium"
+                  ? "4.0"
+                  : "1.0",
+          tags: ["security", "privacy", ...finding.tags],
+        },
+      });
+    }
+  }
+
+  const sarif = {
+    version: "2.1.0",
+    $schema:
+      "https://json.schemastore.org/sarif-2.1.0.json",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: result.tool.name,
+            semanticVersion: result.tool.version,
+            informationUri: "https://github.com/feelyday/context-armor",
+            rules: [...ruleMap.values()],
+          },
+        },
+        originalUriBaseIds: {
+          "%SRCROOT%": {
+            uri: `file://${result.root.split(path.sep).map(encodeURIComponent).join("/")}/`,
+          },
+        },
+        results: result.findings.map((finding) => ({
+          ruleId: finding.ruleId,
+          level: sarifLevel(finding.severity),
+          message: { text: finding.message },
+          partialFingerprints: {
+            contextArmorFingerprint: finding.fingerprint,
+          },
+          locations: [
+            {
+              physicalLocation: {
+                artifactLocation: {
+                  uri: finding.path.split("/").map(encodeURIComponent).join("/"),
+                  uriBaseId: "%SRCROOT%",
+                },
+                region: {
+                  startLine: finding.line,
+                  startColumn: finding.column,
+                },
+              },
+            },
+          ],
+          properties: { severity: finding.severity, kind: finding.kind },
+        })),
+        invocations: [
+          {
+            executionSuccessful: result.warnings.length === 0,
+            endTimeUtc: result.scannedAt,
+          },
+        ],
+      },
+    ],
+  };
+  return `${JSON.stringify(sarif, null, 2)}\n`;
+}

package/src/rules.js

@@ -0,0 +1,225 @@
+import { isLikelyPlaceholder, isValidKoreanRrn, passesLuhn } from "./validators.js";
+
+export const severityRank = Object.freeze({
+  none: 99,
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3,
+});
+
+function patternRule({
+  id,
+  title,
+  severity,
+  pattern,
+  description,
+  validate,
+  capture = 0,
+  tags = [],
+}) {
+  return { id, title, severity, pattern, description, validate, capture, tags };
+}
+
+export const contentRules = [
+  patternRule({
+    id: "SECRET_PRIVATE_KEY",
+    title: "Private key",
+    severity: "critical",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+    description: "A private key can grant direct access to systems or identities.",
+    tags: ["secret", "credential"],
+  }),
+  patternRule({
+    id: "SECRET_AWS_ACCESS_KEY",
+    title: "AWS access key",
+    severity: "critical",
+    pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+    description: "An AWS access key identifier was found.",
+    tags: ["secret", "cloud"],
+  }),
+  patternRule({
+    id: "SECRET_GITHUB_TOKEN",
+    title: "GitHub token",
+    severity: "critical",
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9_]{36,255}|github_pat_[A-Za-z0-9_]{22,255})\b/g,
+    description: "A GitHub authentication token was found.",
+    tags: ["secret", "source-control"],
+  }),
+  patternRule({
+    id: "SECRET_ANTHROPIC_KEY",
+    title: "Anthropic API key",
+    severity: "critical",
+    pattern: /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{32,}\b/g,
+    description: "An Anthropic API key was found.",
+    tags: ["secret", "ai"],
+  }),
+  patternRule({
+    id: "SECRET_OPENAI_KEY",
+    title: "OpenAI API key",
+    severity: "critical",
+    pattern: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,}\b/g,
+    description: "An OpenAI-style API key was found.",
+    tags: ["secret", "ai"],
+  }),
+  patternRule({
+    id: "SECRET_GOOGLE_API_KEY",
+    title: "Google API key",
+    severity: "critical",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    description: "A Google API key was found.",
+    tags: ["secret", "cloud"],
+  }),
+  patternRule({
+    id: "SECRET_SLACK_TOKEN",
+    title: "Slack token",
+    severity: "critical",
+    pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g,
+    description: "A Slack token was found.",
+    tags: ["secret", "messaging"],
+  }),
+  patternRule({
+    id: "SECRET_STRIPE_LIVE_KEY",
+    title: "Stripe live key",
+    severity: "critical",
+    pattern: /\b(?:sk|rk)_live_[0-9A-Za-z]{16,}\b/g,
+    description: "A live Stripe secret or restricted key was found.",
+    tags: ["secret", "payments"],
+  }),
+  patternRule({
+    id: "SECRET_DATABASE_URL",
+    title: "Database URL with credentials",
+    severity: "critical",
+    pattern:
+      /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^/\s:@]+:[^@\s/]+@[^\s"'`]+/gi,
+    description: "A database connection URL contains embedded credentials.",
+    tags: ["secret", "database"],
+  }),
+  patternRule({
+    id: "SECRET_JWT",
+    title: "JSON Web Token",
+    severity: "high",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+    description: "A JWT may contain identity data or grant access.",
+    tags: ["secret", "identity"],
+  }),
+  patternRule({
+    id: "SECRET_PASSWORD_ASSIGNMENT",
+    title: "Hard-coded password",
+    severity: "high",
+    pattern:
+      /\b(?:password|passwd|pwd|secret)\s*(?:=|:)\s*["']?([^\s"',;}{]{7,})["']?/gi,
+    capture: 1,
+    validate: (value) => !isLikelyPlaceholder(value),
+    description: "A password-like value appears to be hard-coded.",
+    tags: ["secret", "credential"],
+  }),
+  patternRule({
+    id: "PII_KR_RRN",
+    title: "Korean resident registration number",
+    severity: "critical",
+    pattern: /\b\d{6}[- ]?[1-8]\d{6}\b/g,
+    validate: isValidKoreanRrn,
+    description: "A checksum-valid Korean resident registration number was found.",
+    tags: ["pii", "korea", "identity"],
+  }),
+  patternRule({
+    id: "PII_CREDIT_CARD",
+    title: "Payment card number",
+    severity: "critical",
+    pattern:
+      /(?<!\d)(?:\d{4}[ -]\d{4}[ -]\d{4}(?:[ -]\d{1,7})?|\d{4}[ -]\d{6}[ -]\d{5})(?!\d)/g,
+    validate: passesLuhn,
+    description: "A formatted, Luhn-valid payment card number was found.",
+    tags: ["pii", "payments"],
+  }),
+  patternRule({
+    id: "PII_US_SSN",
+    title: "US Social Security number",
+    severity: "high",
+    pattern: /\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g,
+    description: "A hyphenated value matching a valid US SSN range was found.",
+    tags: ["pii", "us", "identity"],
+  }),
+  patternRule({
+    id: "PII_KR_PHONE",
+    title: "Korean phone number",
+    severity: "medium",
+    pattern: /(?<!\d)(?:\+82[- ]?1[016789]|01[016789])[- ]?\d{3,4}[- ]?\d{4}(?!\d)/g,
+    description: "A Korean mobile phone number was found.",
+    tags: ["pii", "korea", "contact"],
+  }),
+  patternRule({
+    id: "PII_EMAIL",
+    title: "Email address",
+    severity: "low",
+    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,63}\b/gi,
+    validate: (value) => !/\b(?:example\.(?:com|org|net)|test\.invalid)\b/i.test(value),
+    description: "An email address was found.",
+    tags: ["pii", "contact"],
+  }),
+];
+
+export const filenameRules = [
+  {
+    id: "FILE_ENV",
+    title: "Environment file",
+    severity: "high",
+    pattern: /(^|\/)\.env(?:\.|$)/i,
+    description: "Environment files commonly contain credentials.",
+  },
+  {
+    id: "FILE_PRIVATE_KEY",
+    title: "Private key file",
+    severity: "critical",
+    pattern: /(^|\/)(?:id_(?:rsa|dsa|ecdsa|ed25519)|[^/]+\.(?:pem|key|p12|pfx))$/i,
+    description: "The filename indicates private-key material.",
+  },
+  {
+    id: "FILE_CREDENTIALS",
+    title: "Credential file",
+    severity: "high",
+    pattern:
+      /(^|\/)(?:credentials?|secrets?|service[-_ ]?account)(?:\.[^/]*)?$/i,
+    description: "The filename indicates credentials or secrets.",
+  },
+  {
+    id: "FILE_AUTH_CONFIG",
+    title: "Package registry authentication config",
+    severity: "medium",
+    pattern: /(^|\/)(?:\.npmrc|\.pypirc|\.netrc)$/i,
+    description: "Package registry configuration can contain authentication tokens.",
+  },
+  {
+    id: "FILE_IDENTITY_DOCUMENT_KR",
+    title: "Korean identity document",
+    severity: "high",
+    pattern: /(?:주민등록|기본증명|가족관계|여권|운전면허)/i,
+    description: "The filename indicates a Korean identity document.",
+  },
+  {
+    id: "FILE_FINANCIAL_DOCUMENT_KR",
+    title: "Korean financial document",
+    severity: "medium",
+    pattern: /(?:통장사본|계좌|세금|부가세|원천징수|급여)/i,
+    description: "The filename indicates a financial or tax document.",
+  },
+  {
+    id: "FILE_LEGAL_DOCUMENT_KR",
+    title: "Korean legal document",
+    severity: "medium",
+    pattern: /(?:계약서|비밀유지|인감|등기부|사업자등록)/i,
+    description: "The filename indicates a legal or registration document.",
+  },
+  {
+    id: "FILE_DATABASE_DUMP",
+    title: "Database dump",
+    severity: "high",
+    pattern: /\.(?:sql|sqlite3?|dump|bak)$/i,
+    description: "Database exports can contain credentials and personal data.",
+  },
+];
+
+export function clonePattern(pattern) {
+  return new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`);
+}

package/src/scanner.js

@@ -0,0 +1,289 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { loadConfig } from "./config.js";
+import { extractDocument, isDocumentExtension } from "./documents.js";
+import { createIgnoreMatcher, normalize } from "./ignore.js";
+import { clonePattern, contentRules, filenameRules, severityRank } from "./rules.js";
+
+const TEXT_EXTENSIONS = new Set([
+  "",
+  ".c",
+  ".cc",
+  ".cfg",
+  ".conf",
+  ".cpp",
+  ".cs",
+  ".css",
+  ".csv",
+  ".env",
+  ".go",
+  ".h",
+  ".hpp",
+  ".html",
+  ".ini",
+  ".java",
+  ".js",
+  ".json",
+  ".jsx",
+  ".kt",
+  ".log",
+  ".md",
+  ".mjs",
+  ".php",
+  ".properties",
+  ".py",
+  ".rb",
+  ".rs",
+  ".sh",
+  ".sql",
+  ".svelte",
+  ".swift",
+  ".toml",
+  ".ts",
+  ".tsx",
+  ".txt",
+  ".vue",
+  ".xml",
+  ".yaml",
+  ".yml",
+  ".zsh",
+]);
+
+function fingerprint(ruleId, relativePath, rawValue) {
+  return crypto
+    .createHash("sha256")
+    .update(`${ruleId}\0${relativePath}\0${rawValue}`)
+    .digest("hex")
+    .slice(0, 24);
+}
+
+function lineAndColumn(text, offset) {
+  const before = text.slice(0, offset);
+  const lines = before.split("\n");
+  return { line: lines.length, column: lines.at(-1).length + 1 };
+}
+
+function redactedEvidence(value) {
+  const length = [...String(value)].length;
+  return `[REDACTED ${length} chars]`;
+}
+
+function makeFinding(rule, relativePath, rawValue = "", location = {}) {
+  return {
+    ruleId: rule.id,
+    title: rule.title,
+    severity: rule.severity,
+    kind: rule.id.startsWith("FILE_") ? "file" : "content",
+    path: relativePath,
+    line: location.line ?? 1,
+    column: location.column ?? 1,
+    message: rule.description,
+    evidence: rawValue ? redactedEvidence(rawValue) : undefined,
+    fingerprint: fingerprint(rule.id, relativePath, rawValue),
+    tags: rule.tags || [],
+  };
+}
+
+function ruleWithConfig(rule, config) {
+  const severity = config.severity[rule.id] || rule.severity;
+  return severity === rule.severity ? rule : { ...rule, severity };
+}
+
+function scanText(text, relativePath, config) {
+  const findings = [];
+  for (const baseRule of contentRules) {
+    if (config.disabledRules.includes(baseRule.id)) continue;
+    const rule = ruleWithConfig(baseRule, config);
+    const pattern = clonePattern(rule.pattern);
+    let match;
+    while ((match = pattern.exec(text)) !== null) {
+      const value = match[rule.capture || 0] || match[0];
+      if (!rule.validate || rule.validate(value, match)) {
+        const valueOffset =
+          (rule.capture || 0) > 0 ? match.index + match[0].indexOf(value) : match.index;
+        findings.push(
+          makeFinding(rule, relativePath, value, lineAndColumn(text, valueOffset)),
+        );
+      }
+      if (match[0].length === 0) pattern.lastIndex += 1;
+    }
+  }
+  return findings;
+}
+
+function looksBinary(buffer) {
+  const sample = buffer.subarray(0, Math.min(buffer.length, 8_192));
+  let suspicious = 0;
+  for (const byte of sample) {
+    if (byte === 0) return true;
+    if (byte < 7 || (byte > 14 && byte < 32)) suspicious += 1;
+  }
+  return sample.length > 0 && suspicious / sample.length > 0.1;
+}
+
+async function collectFiles(root, config, ignored) {
+  const files = [];
+  const warnings = [];
+  const stack = [root];
+  while (stack.length > 0 && files.length < config.maxFiles) {
+    const directory = stack.pop();
+    let entries;
+    try {
+      entries = await fs.readdir(directory, { withFileTypes: true });
+    } catch (error) {
+      warnings.push({ path: normalize(path.relative(root, directory)), message: error.message });
+      continue;
+    }
+
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (!config.includeHidden && entry.name.startsWith(".")) continue;
+      const absolute = path.join(directory, entry.name);
+      const relative = normalize(path.relative(root, absolute));
+      if (entry.isSymbolicLink()) continue;
+      if (ignored(relative, entry.isDirectory())) continue;
+      if (entry.isDirectory()) stack.push(absolute);
+      else if (entry.isFile()) files.push({ absolute, relative });
+      if (files.length >= config.maxFiles) break;
+    }
+  }
+  if (files.length >= config.maxFiles) {
+    warnings.push({
+      path: ".",
+      message: `Stopped after maxFiles=${config.maxFiles}. Results may be incomplete.`,
+    });
+  }
+  return { files, warnings };
+}
+
+async function scanFile(file, config) {
+  const findings = [];
+  for (const baseRule of filenameRules) {
+    if (config.disabledRules.includes(baseRule.id)) continue;
+    const rule = ruleWithConfig(baseRule, config);
+    if (rule.pattern.test(file.relative)) findings.push(makeFinding(rule, file.relative));
+  }
+
+  let stats;
+  try {
+    stats = await fs.stat(file.absolute);
+  } catch (error) {
+    return { findings, warning: { path: file.relative, message: error.message } };
+  }
+  if (stats.size > config.maxFileSize) {
+    return {
+      findings,
+      skipped: { path: file.relative, reason: "max-file-size", size: stats.size },
+    };
+  }
+
+  const extension = path.extname(file.absolute).toLowerCase();
+  if (config.documents && isDocumentExtension(extension)) {
+    const document = await extractDocument(file.absolute, config);
+    if (document?.inspected) findings.push(...scanText(document.text, file.relative, config));
+    if (document && !document.inspected) {
+      return {
+        findings,
+        inspected: false,
+        skipped: {
+          path: file.relative,
+          reason: `document-uninspected:${document.extractor}`,
+          size: stats.size,
+        },
+      };
+    }
+    return { findings, inspected: document?.inspected ?? false };
+  }
+
+  if (!TEXT_EXTENSIONS.has(extension)) return { findings, inspected: false };
+  let buffer;
+  try {
+    buffer = await fs.readFile(file.absolute);
+  } catch (error) {
+    return { findings, warning: { path: file.relative, message: error.message } };
+  }
+  if (looksBinary(buffer)) return { findings, inspected: false };
+  findings.push(...scanText(buffer.toString("utf8"), file.relative, config));
+  return { findings, inspected: true };
+}
+
+function summarize(findings) {
+  const bySeverity = { critical: 0, high: 0, medium: 0, low: 0 };
+  const byRule = {};
+  for (const finding of findings) {
+    bySeverity[finding.severity] = (bySeverity[finding.severity] || 0) + 1;
+    byRule[finding.ruleId] = (byRule[finding.ruleId] || 0) + 1;
+  }
+  return { total: findings.length, bySeverity, byRule };
+}
+
+export async function scan(target = ".", options = {}) {
+  const root = path.resolve(target);
+  const rootStats = await fs.stat(root);
+  if (!rootStats.isDirectory()) throw new Error(`Scan target is not a directory: ${root}`);
+  const { config: fileConfig, configPath } = await loadConfig(root, options.configPath);
+  const providedOptions = Object.fromEntries(
+    Object.entries(options).filter(([, value]) => value !== undefined),
+  );
+  const config = {
+    ...fileConfig,
+    ...providedOptions,
+    ignore: providedOptions.ignore
+      ? [...fileConfig.ignore, ...providedOptions.ignore]
+      : fileConfig.ignore,
+    severity: { ...fileConfig.severity, ...(providedOptions.severity || {}) },
+  };
+  delete config.configPath;
+
+  const ignored = await createIgnoreMatcher(root, config);
+  const started = Date.now();
+  const { files, warnings } = await collectFiles(root, config, ignored);
+  const findings = [];
+  const skipped = [];
+  let inspectedFiles = 0;
+
+  const concurrency = Math.max(1, Math.min(Number(options.concurrency) || 8, 32));
+  let cursor = 0;
+  async function worker() {
+    while (cursor < files.length) {
+      const file = files[cursor];
+      cursor += 1;
+      const result = await scanFile(file, config);
+      findings.push(...result.findings);
+      if (result.warning) warnings.push(result.warning);
+      if (result.skipped) skipped.push(result.skipped);
+      if (result.inspected) inspectedFiles += 1;
+    }
+  }
+  await Promise.all(Array.from({ length: concurrency }, () => worker()));
+
+  findings.sort(
+    (a, b) =>
+      severityRank[a.severity] - severityRank[b.severity] ||
+      a.path.localeCompare(b.path) ||
+      a.line - b.line ||
+      a.ruleId.localeCompare(b.ruleId),
+  );
+
+  return {
+    schemaVersion: "1.0",
+    tool: { name: "context-armor", version: options.toolVersion || "0.1.0" },
+    root,
+    configPath,
+    policy: { failOn: config.failOn },
+    scannedAt: new Date().toISOString(),
+    durationMs: Date.now() - started,
+    files: {
+      discovered: files.length,
+      inspected: inspectedFiles,
+      skipped: skipped.length,
+    },
+    findings,
+    summary: summarize(findings),
+    warnings,
+    skipped,
+  };
+}
+
+export { scanText, summarize };

package/src/validators.js

@@ -0,0 +1,48 @@
+export function passesLuhn(value) {
+  const digits = String(value).replace(/\D/g, "");
+  if (digits.length < 13 || digits.length > 19 || /^(\d)\1+$/.test(digits)) {
+    return false;
+  }
+
+  let sum = 0;
+  let doubleDigit = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let digit = Number(digits[index]);
+    if (doubleDigit) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    doubleDigit = !doubleDigit;
+  }
+  return sum % 10 === 0;
+}
+
+export function isValidKoreanRrn(value) {
+  const digits = String(value).replace(/\D/g, "");
+  if (digits.length !== 13 || /^(\d)\1+$/.test(digits)) return false;
+
+  const month = Number(digits.slice(2, 4));
+  const day = Number(digits.slice(4, 6));
+  if (month < 1 || month > 12 || day < 1 || day > 31) return false;
+
+  const weights = [2, 3, 4, 5, 6, 7, 8, 9, 2, 3, 4, 5];
+  const weighted = weights.reduce(
+    (total, weight, index) => total + Number(digits[index]) * weight,
+    0,
+  );
+  const legacyCheck = (11 - (weighted % 11)) % 10;
+  return legacyCheck === Number(digits[12]);
+}
+
+export function isLikelyPlaceholder(value) {
+  const normalized = String(value).trim().toLowerCase();
+  return (
+    normalized.length === 0 ||
+    /^(example|sample|test|dummy|placeholder|changeme|your[_-]|xxx|todo|null|undefined)/.test(
+      normalized,
+    ) ||
+    /^\$\{[^}]+\}$/.test(normalized) ||
+    /^<[^>]+>$/.test(normalized)
+  );
+}