ciphergate-cli 0.12.0__tar.gz → 0.13.0__tar.gz

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/CHANGELOG.md

@@ -6,6 +6,19 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-11-02
+
+Fewer random IDs are reported as payment cards. Cards with an unrecognised prefix and no card
+keyword nearby are no longer reported, so check that your data is still covered.
+
+### Changed
+
+- `luhn_card` reports fewer random IDs as cards. A Luhn-valid number now needs a known
+  issuer prefix or a card keyword nearby, and an issuer-prefixed number right after an ID
+  word such as `invoice` or `batch id` needs a card keyword. JCB, UnionPay, Diners Club,
+  Mir and Discover 644-649 prefixes are now recognised. Cards with other prefixes and no
+  keyword are no longer reported.
+
 ## [0.12.0] - 2026-11-02
 
 Blocked runs now say what to do next, and directory runs no longer hide files they never
@@ -350,7 +363,8 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.12.0...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.13.0...HEAD
+[0.13.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.12.0...v0.13.0
 [0.12.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.9.0...v0.10.0

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.12.0
+Version: 0.13.0
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.12.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.13.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.12.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.13.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/docs/detector-coverage.md

@@ -12,7 +12,7 @@ are engineering estimates mapped to bands (`low` < 0.5 <= `medium` < 0.8 <= `hig
 | `email_regex` | `pii.email` | `alice.test@example.com`, `alice.test%40example.com` | `a..b@example.com`, `user@localhost` | 0.9 | ASCII only; no IDN; obfuscated forms (`alice at example dot com`) missed; `%40` is the only percent-encoding recognised outside `accesslog` |
 | `phone_pattern` | `pii.phone` | `+1 202 555 0143` (high), `(202) 555-0143` (medium) | dates, IPs, card numbers, repeated digits, < 7 digits | 0.3 bare digits, 0.55–0.8 prefixed/formatted, +0.2 keyword | no numbering-plan validation; IDs can look like phones (low band) |
 | `ip_address` | `pii.ip_address` (global), `network.telemetry` (private/loopback/link-local) | `8.8.8.8`, `10.0.0.1`, `2606:4700::1111`, `fe80::1%eth0` | `256.1.1.1`, `std::vector`, `12:30:45` | 0.85 / 0.8 | version strings like `1.2.3.4` match; documentation ranges flagged with evidence |
-| `luhn_card` | `pii.payment_card` | `4111 1111 1111 1111` | Luhn-invalid, mixed separators, repeated digits | 0.4 Luhn-only, 0.8 issuer prefix, +0.15 keyword; labelled CVV/CVC values 0.85 | random IDs pass Luhn ~10% (low band); cards split across fields missed |
+| `luhn_card` | `pii.payment_card` | `4111 1111 1111 1111` | Luhn-invalid, mixed separators, repeated digits | 0.8 issuer prefix (Visa, Mastercard, Amex, Discover, JCB, UnionPay, Diners, Mir), +0.15 keyword; 0.55 keyword without prefix; labelled CVV/CVC values 0.85 | a Luhn-valid number with no issuer prefix and no card keyword is not reported, nor is one right after an ID word (`invoice`, `batch id`, `order`) without a card keyword, so such cards are missed (for example Maestro without a keyword); cards split across fields missed |
 | `mac_address` | `pii.device_identifier` | `00:1A:2B:3C:4D:5E`, `00-1a-2b-3c-4d-5e`, `001a.2b3c.4d5e` | all-zero, broadcast, mixed separators, `12:30:45` | 0.85, 0.6 when all digits | bare 12-hex values are missed; digit-only IDs in this shape are flagged |
 | `iban` | `pii.bank_account` | a mod-97-valid IBAN, compact or space-grouped | wrong check digits, lowercase | 0.9 | country length and national format are not checked; about 1 in 97 random strings of this shape pass; lowercase forms are missed |
 | `ssn_pattern` | `pii.government_id` | `219-09-9999` | never-issued areas (`000`, `666`, `9xx`), group `00`, serial `0000`, undashed | 0.8, 0.95 with a keyword | US only; undashed numbers are missed; other dashed IDs in this shape are flagged |

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/src/ciphergate/__init__.py

@@ -24,7 +24,7 @@ Supported public API (everything else is internal and may change without notice)
     rescan_directory(root, policy, context=None, *, recursive=False, strict=None) -> BatchReport
 """
 
-__version__ = "0.12.0"
+__version__ = "0.13.0"
 
 from ciphergate.config import RuntimeSettings
 from ciphergate.constants import (

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/src/ciphergate/detectors/payment_card.py

@@ -1,7 +1,9 @@
 """Payment-card-like detector: 13-19 digits, Luhn-valid, scored by issuer prefix and context.
 
-A Luhn-valid digit run without a known issuer prefix or context keyword is low confidence:
-long numeric identifiers pass Luhn roughly 10% of the time by chance.
+Long numeric identifiers pass Luhn roughly 10% of the time by chance, so a Luhn-valid run is
+reported only with a known issuer prefix or a card keyword nearby. An issuer-prefixed run right
+after an identifier word such as "invoice" or "batch id" is also skipped unless a card keyword
+is present. Cards with other prefixes (for example Maestro) and no keyword are missed.
 """
 
 from __future__ import annotations
@@ -16,6 +18,12 @@ _CVV_RE = re.compile(
     r"(?i)(?<![a-z0-9])(?:cvv2?|cvc2?)(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}(?:\\?[\"'])?(\d{3,4})(?!\d)"
 )
 _KEYWORDS = ("card", "visa", "mastercard", "amex", "pan", "cc", "credit", "debit", "payment")
+# Words that label a number as some other identifier. Whole words only: a substring match
+# would let "paid" (which contains "id") hide a real card.
+_ID_WORD_RE = re.compile(
+    r"(?i)(?<![a-z])(?:id|invoice|order|batch|total|trace|request|ref|seq|sequence|ticket|"
+    r"build|job|txn|transaction)(?![a-z])"
+)
 
 
 def luhn_valid(digits: str) -> bool:
@@ -38,8 +46,15 @@ def known_issuer_prefix(digits: str) -> bool:
         return len(digits) == 16
     if two in (34, 37):
         return len(digits) == 15
-    if digits.startswith("6011") or two == 65:
+    three = int(digits[:3])
+    if digits.startswith("6011") or two == 65 or 644 <= three <= 649:
         return len(digits) in (16, 19)
+    if 3528 <= four <= 3589 or two == 62:  # JCB, UnionPay
+        return 16 <= len(digits) <= 19
+    if 300 <= three <= 305 or two in (36, 38, 39):  # Diners Club
+        return 14 <= len(digits) <= 19
+    if 2200 <= four <= 2204:  # Mir
+        return 16 <= len(digits) <= 19
     return False
 
 
@@ -71,12 +86,18 @@ class PaymentCardDetector:
             seps = {c for c in raw if c in " -"}
             if len(seps) > 1:
                 continue
+            issuer = known_issuer_prefix(digits)
+            keyword = preceding_context(text, m.start(), _KEYWORDS, window=32)
+            if not keyword and (
+                not issuer or _ID_WORD_RE.search(text[max(0, m.start() - 16) : m.start()])
+            ):
+                continue
             evidence = ["pattern_match", "checksum_valid"]
             confidence = 0.4
-            if known_issuer_prefix(digits):
+            if issuer:
                 confidence = 0.8
                 evidence.append("issuer_prefix")
-            if preceding_context(text, m.start(), _KEYWORDS, window=32):
+            if keyword:
                 confidence += 0.15
                 evidence.append("context_keyword")
             out.append(

{ciphergate_cli-0.12.0 → ciphergate_cli-0.13.0}/tests/unit/test_detectors.py

@@ -158,12 +158,58 @@ def test_card_luhn_invalid_ignored() -> None:
     assert PaymentCardDetector().detect(item("4111 1111 1111 1112")) == []
 
 
-def test_long_luhn_valid_identifier_without_prefix_is_low() -> None:
-    # 18-digit Luhn-valid number without issuer prefix or context.
+def test_luhn_valid_identifier_without_prefix_or_keyword_is_ignored() -> None:
+    # 18-digit Luhn-valid number without issuer prefix or context: a random ID, not a card.
     digits = "100000000000000008"
     assert luhn_valid(digits)
-    f = PaymentCardDetector().detect(item(f"order {digits}"))
-    assert f and f[0].band == "low"
+    assert PaymentCardDetector().detect(item(f"order {digits}")) == []
+
+
+def test_card_keyword_still_finds_a_number_without_issuer_prefix() -> None:
+    f = PaymentCardDetector().detect(item("card 100000000000000008"))
+    assert f and f[0].band == "medium" and "context_keyword" in f[0].evidence
+
+
+@pytest.mark.parametrize(
+    "text",
+    ["invoice total 4111111111111111 units", "batch id 4111111111111111 queued"],
+)
+def test_issuer_prefixed_identifier_after_an_id_word_is_ignored(text: str) -> None:
+    assert PaymentCardDetector().detect(item(text)) == []
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        "user paid with 4111 1111 1111 1111",
+        "valid 4111111111111111",
+        "orderly 4111111111111111",
+        "rebuilds 4111111111111111",
+    ],
+)
+def test_id_words_match_whole_words_only(text: str) -> None:
+    # "paid" contains "id": a substring match hid real cards (caught by the leak test).
+    assert PaymentCardDetector().detect(item(text))
+
+
+def test_card_keyword_wins_over_an_id_word() -> None:
+    assert PaymentCardDetector().detect(item("order paid by card 4111111111111111"))
+
+
+@pytest.mark.parametrize(
+    "digits",
+    [
+        "3530111333300000",  # JCB
+        "6200000000000005",  # UnionPay
+        "36227206271667",  # Diners Club
+        "6445644564456445",  # Discover 644-649
+        "2200000000000004",  # Mir
+    ],
+)
+def test_more_issuer_prefixes(digits: str) -> None:
+    assert luhn_valid(digits)
+    f = PaymentCardDetector().detect(item(f"charged {digits}"))
+    assert f and "issuer_prefix" in f[0].evidence
 
 
 def test_card_mixed_separators_and_repeated_digits_ignored() -> None: