ciphergate-cli 0.7.1__tar.gz → 0.9.0__tar.gz

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/CHANGELOG.md

@@ -6,6 +6,32 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-30
+
+Detects more values. A run that passed before can now redact, review or block, so re-check your
+policies before upgrading a gate.
+
+### Added
+
+- `mac_address` detector (`pii.device_identifier`) and `iban` detector (`pii.bank_account`, mod-97
+  check). Both are on by default and can be turned off with `detectors.disabled`.
+
+### Changed
+
+- `email_regex` also finds percent-encoded addresses (`%40`) in text, and `secret_pattern` finds
+  values assigned to `PGPASSWORD`, `MYSQL_PWD` and similar names (`DBPASSWORD`, `ROOTPASSWORD`).
+  These values now follow your policy rules, so a run can redact, review or block content it
+  used to pass.
+
+## [0.8.0] - 2026-10-30
+
+Adds the packaged policy templates to the Python API. Existing behaviour is unchanged.
+
+### Added
+
+- Python API for the packaged policy templates: `load_template(name)` returns a `Policy` and
+  `template_names()` lists the names. An unknown name raises `UsageError`.
+
 ## [0.7.1] - 2026-10-30
 
 Makes the starter policy templates available after `pip install`. Existing commands and
@@ -270,7 +296,9 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.1...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.8.0...v0.9.0
+[0.8.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.1...v0.8.0
 [0.7.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...v0.7.1
 [0.7.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.6.0...v0.6.1

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.7.1
+Version: 0.9.0
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.1 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.9.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -494,6 +494,15 @@ report = sanitize_file("app.log", "app.clean.log", policy,
 print(report.status, report.exit_code)
 ```
 
+After `pip install`, there is no `policies/` folder. Load a packaged template by name instead;
+`template_names()` lists them. Templates require review for your data and destination.
+
+```python
+from ciphergate import load_template, template_names
+print(template_names())
+policy = load_template("developer_logs")
+```
+
 Streams and directories use the same pipeline and the same safety rules as the CLI:
 
 ```python

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.7.1 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.9.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.
@@ -455,6 +455,15 @@ report = sanitize_file("app.log", "app.clean.log", policy,
 print(report.status, report.exit_code)
 ```
 
+After `pip install`, there is no `policies/` folder. Load a packaged template by name instead;
+`template_names()` lists them. Templates require review for your data and destination.
+
+```python
+from ciphergate import load_template, template_names
+print(template_names())
+policy = load_template("developer_logs")
+```
+
 Streams and directories use the same pipeline and the same safety rules as the CLI:
 
 ```python

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/docs/detector-coverage.md

@@ -9,12 +9,14 @@ are engineering estimates mapped to bands (`low` < 0.5 <= `medium` < 0.8 <= `hig
 |---|---|---|---|---|---|
 | `field_name` | field names -> many categories | `email`, `contactEmail`, `api_key`, `date-of-birth`, `userId`, `trace_id` | `token_count`, `key_name`, `monkey`, `product_name`, `email_verified` | 0.45–0.85 per term | heuristic dictionary; benign values in sensitive-looking fields are flagged; sensitive data in generic fields (`notes`, `value`) is missed unless content detectors match |
 | `policy_classification` | policy-declared fields | `admission_date` (healthcare template) | | configured | only as good as the policy |
-| `email_regex` | `pii.email` | `alice.test@example.com` | `a..b@example.com`, `user@localhost` | 0.9 | ASCII only; no IDN; obfuscated forms (`alice at example dot com`) missed |
+| `email_regex` | `pii.email` | `alice.test@example.com`, `alice.test%40example.com` | `a..b@example.com`, `user@localhost` | 0.9 | ASCII only; no IDN; obfuscated forms (`alice at example dot com`) missed; `%40` is the only percent-encoding recognised outside `accesslog` |
 | `phone_pattern` | `pii.phone` | `+1 202 555 0143` (high), `(202) 555-0143` (medium) | dates, IPs, card numbers, repeated digits, < 7 digits | 0.3 bare digits, 0.55–0.8 prefixed/formatted, +0.2 keyword | no numbering-plan validation; IDs can look like phones (low band) |
 | `ip_address` | `pii.ip_address` (global), `network.telemetry` (private/loopback/link-local) | `8.8.8.8`, `10.0.0.1`, `2606:4700::1111`, `fe80::1%eth0` | `256.1.1.1`, `std::vector`, `12:30:45` | 0.85 / 0.8 | version strings like `1.2.3.4` match; documentation ranges flagged with evidence |
 | `luhn_card` | `pii.payment_card` | `4111 1111 1111 1111` | Luhn-invalid, mixed separators, repeated digits | 0.4 Luhn-only, 0.8 issuer prefix, +0.15 keyword | random IDs pass Luhn ~10% (low band); cards split across fields missed |
+| `mac_address` | `pii.device_identifier` | `00:1A:2B:3C:4D:5E`, `00-1a-2b-3c-4d-5e`, `001a.2b3c.4d5e` | all-zero, broadcast, mixed separators, `12:30:45` | 0.85, 0.6 when all digits | bare 12-hex values are missed; digit-only IDs in this shape are flagged |
+| `iban` | `pii.bank_account` | a mod-97-valid IBAN, compact or space-grouped | wrong check digits, lowercase | 0.9 | country length and national format are not checked; about 1 in 97 random strings of this shape pass; lowercase forms are missed |
 | `date_pattern` | `pii.date_of_birth` with field/keyword evidence; `date.generic` if enabled | `dob: 1990-04-12`, field `birth_date` | `created 2026-01-05` (no DOB evidence), invalid dates | 0.85 / 0.6 | `DD/MM` vs `MM/DD` ambiguity flagged; free-text DOBs without keywords missed |
-| `secret_pattern` | `credential.secret` | PEM blocks, `Bearer ...`, `AKIA...`, `ghp_...`, `xox?-`, `sk_test_...`, `AIza...`, JWTs, `scheme://u:pw@`, `Password=...;`, `password=`, `api_key:`, `token=` | `password=`, `password: null`, markers, `******` | 0.8–0.99 | base64/hex-wrapped, split, custom-format or high-entropy secrets without keywords are **missed**; prose like `password: required` is flagged |
+| `secret_pattern` | `credential.secret` | PEM blocks, `Bearer ...`, `AKIA...`, `ghp_...`, `xox?-`, `sk_test_...`, `AIza...`, JWTs, `scheme://u:pw@`, `Password=...;`, `password=`, assignments to `PGPASSWORD` or `MYSQL_PWD`, `api_key:`, `token=` | `password=`, `password: null`, markers, `******` | 0.8–0.99 | base64/hex-wrapped, split, custom-format or high-entropy secrets without keywords are **missed**; prose like `password: required` is flagged |
 | `internal_host` | `network.telemetry` | `api-1.prod.internal`, `db.corp`, `localhost` | `example.com`, `a.internalx` | 0.75 | internal names without listed suffixes missed; configurable |
 | `custom:<id>` | configured | | | configured | regex-safety checks are heuristics |
 | `presidio_ner` (optional, off by default) | Presidio entities -> mapped categories (default `PERSON` -> `pii.person_name`, `LOCATION` -> `location.coarse`) | `ticket opened by <a person's name>` | numbers, single characters, CipherGate markers/pseudonyms | Presidio score, filtered by `min_score` | statistical model: misses and false positives, language/model dependent, slow; requires `ciphergate-cli[ner]` plus a locally installed spaCy model |

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/docs/policy-schema.md

@@ -52,7 +52,8 @@ A pinned value combined with a different caller value fails with
 ## Detectors
 
 `disabled` (built-in IDs: `field_name`, `secret_pattern`, `luhn_card`, `ip_address`,
-`date_pattern`, `email_regex`, `internal_host`, `phone_pattern`), `dates_emit_generic` (report
+`date_pattern`, `email_regex`, `internal_host`, `phone_pattern`, `mac_address`, `iban`),
+`dates_emit_generic` (report
 non-DOB dates as `date.generic`), `internal_host_suffixes` (default `.internal .local .corp .lan
 .intranet .localdomain`), `custom` (list of `{id, category, pattern, confidence, ignore_case}`;
 patterns are checked for compile errors, empty matches, nested quantifiers, backreferences and

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/src/ciphergate/__init__.py

@@ -3,6 +3,8 @@
 Supported public API (everything else is internal and may change without notice)::
 
     load_policy(path) -> Policy
+    load_template(name) -> Policy        # a packaged template; review it before relying on it
+    template_names() -> list[str]
     validate_policy(path_or_policy) -> ValidationResult
     inspect_file(path, policy, context=None) -> RunReport
     plan_file(path, policy, context=None) -> RunReport
@@ -22,7 +24,7 @@ Supported public API (everything else is internal and may change without notice)
     rescan_directory(root, policy, context=None, *, recursive=False, strict=None) -> BatchReport
 """
 
-__version__ = "0.7.1"
+__version__ = "0.9.0"
 
 from ciphergate.config import RuntimeSettings
 from ciphergate.constants import (
@@ -55,6 +57,7 @@ from ciphergate.pipeline.streams import (
     rescan_stream,
     sanitize_stream,
 )
+from ciphergate.policy.templates import load_template, template_names
 from ciphergate.policy.validator import (
     Policy,
     ValidationResult,
@@ -82,6 +85,7 @@ __all__ = [
     "inspect_file",
     "inspect_stream",
     "load_policy",
+    "load_template",
     "plan_directory",
     "plan_file",
     "plan_stream",
@@ -91,5 +95,6 @@ __all__ = [
     "sanitize_directory",
     "sanitize_file",
     "sanitize_stream",
+    "template_names",
     "validate_policy",
 ]

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/src/ciphergate/detectors/email.py

@@ -12,6 +12,12 @@ _EMAIL_RE = re.compile(
     r"([A-Za-z0-9._%+-]{1,64})@((?:[A-Za-z0-9-]{1,63}\.){1,8}[A-Za-z]{2,63})"
     r"(?![A-Za-z0-9-])"
 )
+# Percent-encoded form in URLs and query strings: the "@" is written as %40.
+_ENCODED_EMAIL_RE = re.compile(
+    r"(?<![A-Za-z0-9._%+-])"
+    r"([A-Za-z0-9._%+-]{1,64})%40((?:[A-Za-z0-9-]{1,63}\.){1,8}[A-Za-z]{2,63})"
+    r"(?![A-Za-z0-9-])"
+)
 
 RESERVED_EMAIL_DOMAINS = ("example.com", "example.org", "example.net")
 RESERVED_EMAIL_TLDS = (".invalid", ".example", ".test", ".localhost")
@@ -31,10 +37,10 @@ class EmailDetector:
 
     def detect(self, item: ScanItem) -> list[Finding]:
         text = item.text
-        if not text or "@" not in text:
+        if not text or ("@" not in text and "%40" not in text):
             return []
         out: list[Finding] = []
-        for m in _EMAIL_RE.finditer(text):
+        for m in (*_EMAIL_RE.finditer(text), *_ENCODED_EMAIL_RE.finditer(text)):
             local, domain = m.group(1), m.group(2)
             if local.startswith(".") or local.endswith(".") or ".." in local or ".." in domain:
                 continue

ciphergate_cli-0.9.0/src/ciphergate/detectors/iban.py

@@ -0,0 +1,53 @@
+"""IBAN detector: compact or space-grouped, uppercase, validated with the ISO 7064 mod-97 check.
+
+Country-specific lengths and national formats are not checked. Lowercase forms are not matched.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ciphergate.detectors.base import make_finding
+from ciphergate.models.finding import Finding, ScanItem
+
+_IBAN_RE = re.compile(
+    r"(?<![0-9A-Za-z])"
+    r"([A-Z]{2}\d{2}(?:[A-Z0-9]{11,30}|(?: [A-Z0-9]{4}){2,7}(?: [A-Z0-9]{1,3})?))"
+    r"(?![0-9A-Za-z])"
+)
+
+
+def iban_valid(compact: str) -> bool:
+    if not 15 <= len(compact) <= 34:
+        return False
+    rearranged = compact[4:] + compact[:4]
+    return int("".join(str(int(c, 36)) for c in rearranged)) % 97 == 1
+
+
+class IbanDetector:
+    id = "iban"
+
+    def detect(self, item: ScanItem) -> list[Finding]:
+        text = item.text
+        if not text or len(text) < 15:
+            return []
+        out: list[Finding] = []
+        for m in _IBAN_RE.finditer(text):
+            # A following uppercase word can join a spaced match, so retry without trailing groups.
+            groups = m.group(1).split(" ")
+            while groups:
+                if iban_valid("".join(groups)):
+                    end = m.start(1) + len(" ".join(groups))
+                    out.append(
+                        make_finding(
+                            item,
+                            category="pii.bank_account",
+                            detector=self.id,
+                            confidence=0.9,
+                            evidence=("pattern_match", "checksum_valid"),
+                            span=(m.start(1), end),
+                        )
+                    )
+                    break
+                groups.pop()
+        return out

ciphergate_cli-0.9.0/src/ciphergate/detectors/mac_address.py

@@ -0,0 +1,47 @@
+"""MAC address detector: six hex pairs with one separator, or Cisco dotted form.
+
+All-digit forms are medium confidence because they can be other identifiers. The all-zero and
+broadcast addresses identify no device and are skipped.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ciphergate.detectors.base import make_finding
+from ciphergate.models.finding import Finding, ScanItem
+
+_MAC_RE = re.compile(
+    r"(?<![0-9A-Fa-f:.-])"
+    r"([0-9A-Fa-f]{2}(?:[:-][0-9A-Fa-f]{2}){5}|[0-9A-Fa-f]{4}(?:\.[0-9A-Fa-f]{4}){2})"
+    r"(?![0-9A-Za-z:.-])"
+)
+_NON_DEVICE = frozenset({"0" * 12, "f" * 12})
+
+
+class MacAddressDetector:
+    id = "mac_address"
+
+    def detect(self, item: ScanItem) -> list[Finding]:
+        text = item.text
+        if not text or len(text) < 14:
+            return []
+        out: list[Finding] = []
+        for m in _MAC_RE.finditer(text):
+            raw = m.group(1)
+            if len({c for c in raw if c in ":-."}) > 1:
+                continue
+            compact = re.sub(r"[:.-]", "", raw).lower()
+            if compact in _NON_DEVICE:
+                continue
+            out.append(
+                make_finding(
+                    item,
+                    category="pii.device_identifier",
+                    detector=self.id,
+                    confidence=0.85 if not compact.isdigit() else 0.6,
+                    evidence=("pattern_match",),
+                    span=(m.start(1), m.end(1)),
+                )
+            )
+        return out

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/src/ciphergate/detectors/registry.py

@@ -9,7 +9,9 @@ from ciphergate.detectors.custom_regex import CustomRegexDetector
 from ciphergate.detectors.dates import DateDetector
 from ciphergate.detectors.email import EmailDetector, is_reserved_email_domain
 from ciphergate.detectors.field_names import FieldNameDetector, PolicyClassificationDetector
+from ciphergate.detectors.iban import IbanDetector
 from ciphergate.detectors.ip_address import IPAddressDetector
+from ciphergate.detectors.mac_address import MacAddressDetector
 from ciphergate.detectors.network import InternalHostDetector
 from ciphergate.detectors.payment_card import PaymentCardDetector
 from ciphergate.detectors.phone import PhoneDetector
@@ -26,10 +28,14 @@ BUILTIN_DETECTOR_IDS: tuple[str, ...] = (
     "email_regex",
     "internal_host",
     "phone_pattern",
+    "mac_address",
+    "iban",
 )
 
 # Phone matching is the least specific pattern; drop phone spans that overlap these detectors.
-_PHONE_SUPPRESSORS = frozenset({"luhn_card", "ip_address", "date_pattern", "secret_pattern"})
+_PHONE_SUPPRESSORS = frozenset(
+    {"luhn_card", "ip_address", "date_pattern", "secret_pattern", "mac_address", "iban"}
+)
 
 
 FIELD_CONTEXT_DETECTORS = frozenset({"field_name", "policy_classification"})
@@ -59,6 +65,8 @@ class DetectorSet:
             "email_regex": EmailDetector(),
             "internal_host": InternalHostDetector(settings.internal_host_suffixes),
             "phone_pattern": PhoneDetector(),
+            "mac_address": MacAddressDetector(),
+            "iban": IbanDetector(),
         }
         for detector_id in BUILTIN_DETECTOR_IDS:
             if detector_id not in disabled:
@@ -173,6 +181,10 @@ def unsafe_replacement_reason(value: str) -> str | None:
         return f"looks like a credential ({secrets[0].evidence[-1]})"
     if PaymentCardDetector().detect(probe):
         return "looks like a payment card number"
+    if IbanDetector().detect(probe):
+        return "looks like a real IBAN"
+    if MacAddressDetector().detect(probe):
+        return "looks like a real MAC address"
     for f in EmailDetector().detect(probe):
         if "reserved_domain" not in f.evidence:
             return "email replacements must use a reserved domain such as example.invalid"

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/src/ciphergate/detectors/secrets.py

@@ -65,7 +65,8 @@ _PATTERNS: tuple[_Pattern, ...] = (
         "assignment",
         re.compile(
             r"(?i)(?<![a-z0-9])"
-            r"(?:password|passwd|passphrase|secret|api[_-]?key|apikey|access[_-]?token|"
+            r"(?:(?:pg|db|mysql|admin|root|user)?password|mysql_pwd|passwd|passphrase|secret|"
+            r"api[_-]?key|apikey|access[_-]?token|"
             r"refresh[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?key|"
             r"access[_-]?key|token|credentials?)"
             r"(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}(?:\\?[\"'])?"

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/src/ciphergate/policy/templates.py

@@ -7,6 +7,7 @@ from importlib.resources.abc import Traversable
 from pathlib import Path
 
 from ciphergate.errors import UsageError
+from ciphergate.policy.validator import Policy, load_policy_text
 
 
 def _templates_dir() -> Traversable:
@@ -34,3 +35,8 @@ def read_template(name: str) -> str:
             code="unknown_policy_template",
         )
     return _templates_dir().joinpath(f"{name}.yml").read_text(encoding="utf-8")
+
+
+def load_template(name: str) -> Policy:
+    """Load a named template as a `Policy`. It is a starting point that requires review."""
+    return load_policy_text(read_template(name), source_name=f"{name}.yml")

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/tests/unit/test_accesslog.py

@@ -161,7 +161,8 @@ def test_field_context_and_decoded_values(
     assert ("pii.ip_address", "/remote_addr") in found
     assert ("pii.email", "/http_user_agent") in found  # only visible after \x40 decoding
     text_cats = [i["category"] for i in _items(tmp_path, line, InputFormat.TEXT, policy)]
-    assert "pii.email" not in text_cats
+    # Text mode sees the %40 form but does not decode log escapes such as \x40.
+    assert text_cats.count("pii.email") == 1
 
 
 def test_not_inferred_from_extension(tmp_path: Path, policy_text: Callable[[str], Policy]) -> None:

{ciphergate_cli-0.7.1 → ciphergate_cli-0.9.0}/tests/unit/test_detectors.py

@@ -13,7 +13,9 @@ from ciphergate.detectors.field_names import (
     classify_field_name,
     normalize_field_name,
 )
+from ciphergate.detectors.iban import IbanDetector, iban_valid
 from ciphergate.detectors.ip_address import IPAddressDetector
+from ciphergate.detectors.mac_address import MacAddressDetector
 from ciphergate.detectors.network import InternalHostDetector
 from ciphergate.detectors.payment_card import PaymentCardDetector, luhn_valid
 from ciphergate.detectors.phone import PhoneDetector
@@ -390,3 +392,104 @@ def test_findings_never_contain_raw_values() -> None:
         rendered = repr(f) + str(f.location.to_dict()) + str(f.evidence)
         for secret in ("alice.test", "TEST_ONLY_NOT", "4111"):
             assert secret not in rendered
+
+
+# ----------------------------------------------------------------- mac address and iban
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        ("dhcp lease for 00:1A:2B:3C:4D:5E done", ["00:1A:2B:3C:4D:5E"]),
+        ("device 00-1a-2b-3c-4d-5e offline", ["00-1a-2b-3c-4d-5e"]),
+        ("port 001a.2b3c.4d5e up", ["001a.2b3c.4d5e"]),
+        ("mixed 00:1a-2b:3c:4d:5e", []),
+        ("null 00:00:00:00:00:00 broadcast ff:ff:ff:ff:ff:ff", []),
+        ("at 12:30:45 today", []),
+        ("seven 00:1a:2b:3c:4d:5e:6f groups", []),
+        ("host 2001:db8::1 up", []),
+    ],
+)
+def test_mac_address(text: str, expected: list[str]) -> None:
+    findings = MacAddressDetector().detect(item(text))
+    assert spans(findings, text) == expected
+    assert all(f.category == "pii.device_identifier" for f in findings)
+
+
+def test_mac_address_confidence_is_lower_when_all_digits() -> None:
+    assert MacAddressDetector().detect(item("id 12-34-56-78-90-12"))[0].confidence == 0.6
+    assert MacAddressDetector().detect(item("id 12-34-56-78-90-ab"))[0].confidence == 0.85
+
+
+IBAN = "GB82" + "WEST" + "12345698765432"  # the ISO 13616 example number
+IBAN_SPACED = "GB82 WEST 1234 5698 7654 32"
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        (f"payout to {IBAN} failed", [IBAN]),
+        (f"payout to {IBAN_SPACED} failed", [IBAN_SPACED]),
+        (f"payout to {IBAN_SPACED} DONE", [IBAN_SPACED]),
+        ("payout to GB83" + "WEST12345698765432 failed", []),
+        ("payout to " + IBAN.lower(), []),
+        ("code AB12 short", []),
+    ],
+)
+def test_iban(text: str, expected: list[str]) -> None:
+    findings = IbanDetector().detect(item(text))
+    assert spans(findings, text) == expected
+    assert all(f.category == "pii.bank_account" for f in findings)
+
+
+def test_iban_valid_rejects_bad_lengths() -> None:
+    assert iban_valid(IBAN)
+    assert not iban_valid("GB82WEST")
+
+
+def test_new_detectors_suppress_phone_matches() -> None:
+    detectors = DetectorSet(DetectorSettings())
+    text = f"account {IBAN_SPACED} and 12-34-56-78-90-12"
+    ids = {f.detector for f in detectors.scan(item(text))}
+    assert "phone_pattern" not in ids and {"iban", "mac_address"} <= ids
+
+
+def test_new_detectors_can_be_disabled() -> None:
+    detectors = DetectorSet(DetectorSettings(disabled=["mac_address", "iban"]))
+    assert not detectors.scan(item(f"{IBAN} 00:1A:2B:3C:4D:5E"))
+
+
+@pytest.mark.parametrize("value", [IBAN, "00:1A:2B:3C:4D:5E"])
+def test_replacement_must_not_look_real(value: str) -> None:
+    assert unsafe_replacement_reason(value) is not None
+
+
+# ------------------------------------------------------------- encoded and env-style values
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        ("GET /users?mail=alice.test%40example.com 404", "alice.test%40example.com"),
+        ("redirect /v?a=Alice%40EXAMPLE.org&b=1", "Alice%40EXAMPLE.org"),
+    ],
+)
+def test_percent_encoded_email(text: str, expected: str) -> None:
+    assert spans(EmailDetector().detect(item(text)), text) == [expected]
+
+
+def test_percent_40_without_an_address_is_ignored() -> None:
+    assert not EmailDetector().detect(item("progress 100%40 done"))
+
+
+@pytest.mark.parametrize(
+    "name", ["PGPASSWORD", "pgpassword", "MYSQL_PWD", "DBPASSWORD", "ROOTPASSWORD", "UserPassword"]
+)
+def test_env_style_password_names(name: str) -> None:
+    text = f"{name}=TEST_ONLY_NOT_A_CREDENTIAL psql"
+    assert spans(SecretDetector().detect(item(text)), text) == ["TEST_ONLY_NOT_A_CREDENTIAL"]
+
+
+@pytest.mark.parametrize("name", ["nopassword", "haspassword", "password_reset_enabled"])
+def test_other_password_words_stay_unmatched(name: str) -> None:
+    assert not SecretDetector().detect(item(f"{name}=enabled"))

ciphergate_cli-0.9.0/tests/unit/test_policy_templates.py

@@ -0,0 +1,55 @@
+"""Packaged policy templates through the public Python API."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+import ciphergate
+from ciphergate import (
+    ContextInput,
+    RunStatus,
+    load_policy,
+    load_template,
+    sanitize_file,
+    template_names,
+)
+from ciphergate.errors import CipherGateError, UsageError
+from tests.conftest import EXAMPLES, POLICIES
+
+
+def test_public_exports() -> None:
+    for name in ("load_template", "template_names"):
+        assert name in ciphergate.__all__ and hasattr(ciphergate, name)
+
+
+def test_names_match_the_policy_files() -> None:
+    assert template_names() == sorted(p.stem for p in POLICIES.glob("*.yml"))
+
+
+@pytest.mark.parametrize("name", template_names())
+def test_load_template_matches_the_policy_file(name: str) -> None:
+    policy = load_template(name)
+    assert policy.name == load_policy(POLICIES / f"{name}.yml").name
+    assert policy.source_name == f"{name}.yml"
+
+
+@pytest.mark.parametrize("name", ["nope", "../pyproject", "dev_local.yml", ""])
+def test_unknown_template_is_rejected(name: str) -> None:
+    with pytest.raises(UsageError) as err:
+        load_template(name)
+    assert err.value.code == "unknown_policy_template"
+    assert isinstance(err.value, CipherGateError)
+
+
+def test_loaded_template_still_blocks_and_publishes_nothing(tmp_path: Path) -> None:
+    output = tmp_path / "out.log"
+    report = sanitize_file(
+        EXAMPLES / "sample.log",
+        output,
+        load_template("prd_external_ai"),
+        ContextInput(),
+    )
+    assert report.status == RunStatus.BLOCKED and report.exit_code == 1
+    assert not output.exists()