ciphergate-cli 0.9.0__tar.gz → 0.10.0__tar.gz

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/CHANGELOG.md

@@ -6,6 +6,25 @@ versioning: [PEP 440](https://peps.python.org/pep-0440/) with SemVer meaning (pr
 
 ## [Unreleased]
 
+## [0.10.0] - 2026-10-30
+
+Fixes a password leak in nested values and detects more credentials and identifiers. A run that
+passed before can now redact, review or block, so re-check your policies before upgrading a gate.
+
+### Added
+
+- `ssn_pattern` detector for dashed US Social Security numbers (`pii.government_id`). They were
+  labelled `pii.phone`, so government-ID rules did not apply and a strict template can now block.
+
+### Fixed
+
+- `secret_pattern` no longer stops at `{` for nested values such as Actuator dumps, which left
+  the real value in the output.
+- `secret_pattern` now finds camelCase password names, `Cookie` and `Set-Cookie` headers, and
+  session and CSRF cookie values. `luhn_card` finds labelled CVV and CVC values.
+- Fewer false alarms: shell `PWD` paths, code such as `settings.X` or `request.Y` on the right of
+  an assignment, and an HTTP status followed by a byte count.
+
 ## [0.9.0] - 2026-10-30
 
 Detects more values. A run that passed before can now redact, review or block, so re-check your
@@ -296,7 +315,8 @@ Pre-release (alpha). Licensed under Apache-2.0. Not a final release: the securit
 See `docs/limitations.md`. Deferred: optional NER/Presidio detectors, stdin/stdout streaming,
 directory processing, structured log parsers, key files, reversible token vault, lossy decoding.
 
-[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.9.0...HEAD
+[Unreleased]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.10.0...HEAD
+[0.10.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.9.0...v0.10.0
 [0.9.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.1...v0.8.0
 [0.7.1]: https://github.com/aashishkumar-tech/ciphergate/compare/v0.7.0...v0.7.1

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ciphergate-cli
-Version: 0.9.0
+Version: 0.10.0
 Summary: Local-first, environment- and destination-aware inspection and sanitization of logs and test datasets.
 Project-URL: Homepage, https://github.com/aashishkumar-tech/ciphergate
 Project-URL: Source, https://github.com/aashishkumar-tech/ciphergate
@@ -50,7 +50,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.9.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.10.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/README.md

@@ -11,7 +11,7 @@ vendor ticket. CipherGate replaces that with a local, explainable, scriptable ga
 inspect  ->  plan  ->  sanitize --apply  ->  rescan
 ```
 
-> **Status: 0.9.0 (alpha).** No detector finds every sensitive value. A passing run means the
+> **Status: 0.10.0 (alpha).** No detector finds every sensitive value. A passing run means the
 > configured processing completed under the selected policy; it is **not** proof that the output
 > contains no sensitive information, and it is not a compliance (GDPR, HIPAA, PCI DSS, ...) or
 > anonymization guarantee. Policy templates must be reviewed before use.

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/docs/detector-coverage.md

@@ -12,11 +12,12 @@ are engineering estimates mapped to bands (`low` < 0.5 <= `medium` < 0.8 <= `hig
 | `email_regex` | `pii.email` | `alice.test@example.com`, `alice.test%40example.com` | `a..b@example.com`, `user@localhost` | 0.9 | ASCII only; no IDN; obfuscated forms (`alice at example dot com`) missed; `%40` is the only percent-encoding recognised outside `accesslog` |
 | `phone_pattern` | `pii.phone` | `+1 202 555 0143` (high), `(202) 555-0143` (medium) | dates, IPs, card numbers, repeated digits, < 7 digits | 0.3 bare digits, 0.55–0.8 prefixed/formatted, +0.2 keyword | no numbering-plan validation; IDs can look like phones (low band) |
 | `ip_address` | `pii.ip_address` (global), `network.telemetry` (private/loopback/link-local) | `8.8.8.8`, `10.0.0.1`, `2606:4700::1111`, `fe80::1%eth0` | `256.1.1.1`, `std::vector`, `12:30:45` | 0.85 / 0.8 | version strings like `1.2.3.4` match; documentation ranges flagged with evidence |
-| `luhn_card` | `pii.payment_card` | `4111 1111 1111 1111` | Luhn-invalid, mixed separators, repeated digits | 0.4 Luhn-only, 0.8 issuer prefix, +0.15 keyword | random IDs pass Luhn ~10% (low band); cards split across fields missed |
+| `luhn_card` | `pii.payment_card` | `4111 1111 1111 1111` | Luhn-invalid, mixed separators, repeated digits | 0.4 Luhn-only, 0.8 issuer prefix, +0.15 keyword; labelled CVV/CVC values 0.85 | random IDs pass Luhn ~10% (low band); cards split across fields missed |
 | `mac_address` | `pii.device_identifier` | `00:1A:2B:3C:4D:5E`, `00-1a-2b-3c-4d-5e`, `001a.2b3c.4d5e` | all-zero, broadcast, mixed separators, `12:30:45` | 0.85, 0.6 when all digits | bare 12-hex values are missed; digit-only IDs in this shape are flagged |
 | `iban` | `pii.bank_account` | a mod-97-valid IBAN, compact or space-grouped | wrong check digits, lowercase | 0.9 | country length and national format are not checked; about 1 in 97 random strings of this shape pass; lowercase forms are missed |
+| `ssn_pattern` | `pii.government_id` | `219-09-9999` | never-issued areas (`000`, `666`, `9xx`), group `00`, serial `0000`, undashed | 0.8, 0.95 with a keyword | US only; undashed numbers are missed; other dashed IDs in this shape are flagged |
 | `date_pattern` | `pii.date_of_birth` with field/keyword evidence; `date.generic` if enabled | `dob: 1990-04-12`, field `birth_date` | `created 2026-01-05` (no DOB evidence), invalid dates | 0.85 / 0.6 | `DD/MM` vs `MM/DD` ambiguity flagged; free-text DOBs without keywords missed |
-| `secret_pattern` | `credential.secret` | PEM blocks, `Bearer ...`, `AKIA...`, `ghp_...`, `xox?-`, `sk_test_...`, `AIza...`, JWTs, `scheme://u:pw@`, `Password=...;`, `password=`, assignments to `PGPASSWORD` or `MYSQL_PWD`, `api_key:`, `token=` | `password=`, `password: null`, markers, `******` | 0.8–0.99 | base64/hex-wrapped, split, custom-format or high-entropy secrets without keywords are **missed**; prose like `password: required` is flagged |
+| `secret_pattern` | `credential.secret` | PEM blocks, `Bearer ...`, `AKIA...`, `ghp_...`, `xox?-`, `sk_test_...`, `AIza...`, JWTs, `scheme://u:pw@`, `Password=...;`, `password=`, assignments to `PGPASSWORD`, `MYSQL_PWD` or camelCase `...Password` names, `Cookie` and `Set-Cookie` headers, session and CSRF cookie values, `api_key:`, `token=` | `password=`, `password: null`, markers, `******` | 0.8–0.99 | base64/hex-wrapped, split, custom-format or high-entropy secrets without keywords are **missed**; prose like `password: required` is flagged |
 | `internal_host` | `network.telemetry` | `api-1.prod.internal`, `db.corp`, `localhost` | `example.com`, `a.internalx` | 0.75 | internal names without listed suffixes missed; configurable |
 | `custom:<id>` | configured | | | configured | regex-safety checks are heuristics |
 | `presidio_ner` (optional, off by default) | Presidio entities -> mapped categories (default `PERSON` -> `pii.person_name`, `LOCATION` -> `location.coarse`) | `ticket opened by <a person's name>` | numbers, single characters, CipherGate markers/pseudonyms | Presidio score, filtered by `min_score` | statistical model: misses and false positives, language/model dependent, slow; requires `ciphergate-cli[ner]` plus a locally installed spaCy model |

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/docs/policy-schema.md

@@ -52,7 +52,7 @@ A pinned value combined with a different caller value fails with
 ## Detectors
 
 `disabled` (built-in IDs: `field_name`, `secret_pattern`, `luhn_card`, `ip_address`,
-`date_pattern`, `email_regex`, `internal_host`, `phone_pattern`, `mac_address`, `iban`),
+`date_pattern`, `email_regex`, `internal_host`, `phone_pattern`, `mac_address`, `iban`, `ssn_pattern`),
 `dates_emit_generic` (report
 non-DOB dates as `date.generic`), `internal_host_suffixes` (default `.internal .local .corp .lan
 .intranet .localdomain`), `custom` (list of `{id, category, pattern, confidence, ignore_case}`;

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/pyproject.toml

@@ -110,6 +110,8 @@ ignore = [
 [tool.ruff.lint.per-file-ignores]
 "tests/**" = ["S101", "S105", "S106", "S108", "S311", "PLC0415", "S607"]
 "scripts/**" = ["S607", "T201"]
+# Reproducible synthetic data, and optional tools that may not be installed.
+"scripts/benchmark/**" = ["S311", "PLC0415", "S607", "T201"]
 
 [tool.mypy]
 python_version = "3.11"

ciphergate_cli-0.10.0/scripts/benchmark/README.md

@@ -0,0 +1,39 @@
+# Detection benchmark
+
+Measures what CipherGate catches and flags wrongly on generated, labelled log lines, next to other
+local tools. It is an engineering aid for finding gaps. It is not part of the package, CI or the
+test suite, and it never contacts a service.
+
+## Do not use the results as a public claim
+
+- The corpus is written by the people who wrote the detectors, so it leans toward CipherGate.
+- The data is synthetic. Real logs behave differently.
+- Other tools run on default settings, and their results depend on versions and models.
+- A high score here does not show that sensitive data is gone from any file.
+
+## Run it
+
+Use a separate virtual environment, because these tools are not project dependencies:
+
+```bash
+python -m venv /path/outside/repo/venv
+# Activate it, then:
+python -m pip install . detect-secrets scrubadub presidio-analyzer
+python -m pip install en_core_web_sm  # see the spaCy docs for the model install command
+python scripts/benchmark/compare_tools.py --out /path/outside/repo/results
+```
+
+Only CipherGate is required. Any other tool that is not installed is skipped and listed under
+`not run`. To include gitleaks, install it yourself and pass `--gitleaks PATH`.
+
+`--out` must be outside the repository, because `corpus.jsonl` holds format-shaped fake
+credentials that must not be committed. The tool refuses a path inside the repository. Results
+are repeatable for the same `--seed` and tool versions.
+
+## Reading the output
+
+Each row is a data class, and each cell is caught/total. A positive counts only if the finding
+overlaps the planted value; for CipherGate, the value must be gone from the output. `NEGATIVE`
+counts false alarms on clean lines. `presidio@0.5` is Presidio with a 0.5 score threshold.
+
+Random 16-digit IDs pass the card checksum about 10% of the time, so `NEGATIVE` varies by seed.

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/src/ciphergate/__init__.py

@@ -24,7 +24,7 @@ Supported public API (everything else is internal and may change without notice)
     rescan_directory(root, policy, context=None, *, recursive=False, strict=None) -> BatchReport
 """
 
-__version__ = "0.9.0"
+__version__ = "0.10.0"
 
 from ciphergate.config import RuntimeSettings
 from ciphergate.constants import (

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/src/ciphergate/detectors/payment_card.py

@@ -12,6 +12,9 @@ from ciphergate.detectors.base import make_finding, preceding_context
 from ciphergate.models.finding import Finding, ScanItem
 
 _CARD_RE = re.compile(r"(?<![0-9A-Za-z_])(\d(?:[ -]?\d){12,18})(?![0-9A-Za-z_])")
+_CVV_RE = re.compile(
+    r"(?i)(?<![a-z0-9])(?:cvv2?|cvc2?)(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}(?:\\?[\"'])?(\d{3,4})(?!\d)"
+)
 _KEYWORDS = ("card", "visa", "mastercard", "amex", "pan", "cc", "credit", "debit", "payment")
 
 
@@ -45,9 +48,21 @@ class PaymentCardDetector:
 
     def detect(self, item: ScanItem) -> list[Finding]:
         text = item.text
-        if not text or sum(c.isdigit() for c in text) < 13:
+        if not text:
             return []
-        out: list[Finding] = []
+        out = [
+            make_finding(
+                item,
+                category="pii.payment_card",
+                detector=self.id,
+                confidence=0.85,
+                evidence=("pattern_match", "context_keyword"),
+                span=(m.start(1), m.end(1)),
+            )
+            for m in _CVV_RE.finditer(text)
+        ]
+        if sum(c.isdigit() for c in text) < 13:
+            return out
         for m in _CARD_RE.finditer(text):
             raw = m.group(1)
             digits = raw.replace(" ", "").replace("-", "")

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/src/ciphergate/detectors/phone.py

@@ -21,6 +21,7 @@ _PHONE_RE = re.compile(
 )
 _DATE_LIKE = re.compile(r"^\d{4}[-./]\d{1,2}[-./]\d{1,2}$|^\d{1,2}[-./]\d{1,2}[-./]\d{2,4}$")
 _SEPARATED = re.compile(r"^\(?\d{2,4}\)?[ .-]\d{2,5}[ .-]\d{2,5}(?:[ .-]\d{2,5})?$")
+_HTTP_STATUS_BYTES = re.compile(r"^[1-5]\d{2} \d{1,12}$")
 _KEYWORDS = ("phone", "tel", "mobile", "cell", "call", "fax", "sms", "whatsapp", "contact")
 
 
@@ -40,6 +41,9 @@ class PhoneDetector:
                 continue
             if _DATE_LIKE.match(core.strip()):
                 continue
+            context = preceding_context(text, m.start(), _KEYWORDS)
+            if _HTTP_STATUS_BYTES.match(core.strip()) and not context:
+                continue
             evidence = ["pattern_match"]
             if core.startswith("+"):
                 confidence = 0.8 if len(digits) >= 8 else 0.55
@@ -49,7 +53,7 @@ class PhoneDetector:
                 evidence.append("separator_layout")
             else:
                 confidence = 0.3
-            if preceding_context(text, m.start(), _KEYWORDS):
+            if context:
                 confidence += 0.2
                 evidence.append("context_keyword")
             if "x" in candidate.lower() or "ext" in candidate.lower():

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/src/ciphergate/detectors/registry.py

@@ -16,6 +16,7 @@ from ciphergate.detectors.network import InternalHostDetector
 from ciphergate.detectors.payment_card import PaymentCardDetector
 from ciphergate.detectors.phone import PhoneDetector
 from ciphergate.detectors.secrets import PEM_BEGIN_RE, PEM_END_RE, SecretDetector
+from ciphergate.detectors.ssn import SsnDetector
 from ciphergate.models.finding import Finding, ScanItem
 from ciphergate.models.policy import DetectorSettings, PolicyDocument
 
@@ -30,11 +31,20 @@ BUILTIN_DETECTOR_IDS: tuple[str, ...] = (
     "phone_pattern",
     "mac_address",
     "iban",
+    "ssn_pattern",
 )
 
 # Phone matching is the least specific pattern; drop phone spans that overlap these detectors.
 _PHONE_SUPPRESSORS = frozenset(
-    {"luhn_card", "ip_address", "date_pattern", "secret_pattern", "mac_address", "iban"}
+    {
+        "luhn_card",
+        "ip_address",
+        "date_pattern",
+        "secret_pattern",
+        "mac_address",
+        "iban",
+        "ssn_pattern",
+    }
 )
 
 
@@ -67,6 +77,7 @@ class DetectorSet:
             "phone_pattern": PhoneDetector(),
             "mac_address": MacAddressDetector(),
             "iban": IbanDetector(),
+            "ssn_pattern": SsnDetector(),
         }
         for detector_id in BUILTIN_DETECTOR_IDS:
             if detector_id not in disabled:
@@ -185,6 +196,8 @@ def unsafe_replacement_reason(value: str) -> str | None:
         return "looks like a real IBAN"
     if MacAddressDetector().detect(probe):
         return "looks like a real MAC address"
+    if SsnDetector().detect(probe):
+        return "looks like a real government identifier"
     for f in EmailDetector().detect(probe):
         if "reserved_domain" not in f.evidence:
             return "email replacements must use a reserved domain such as example.invalid"

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/src/ciphergate/detectors/secrets.py

@@ -69,17 +69,68 @@ _PATTERNS: tuple[_Pattern, ...] = (
             r"api[_-]?key|apikey|access[_-]?token|"
             r"refresh[_-]?token|auth[_-]?token|client[_-]?secret|secret[_-]?key|private[_-]?key|"
             r"access[_-]?key|token|credentials?)"
+            r"(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}"
+            # Spring Actuator and similar dumps nest the value in an object.
+            r"(?:\{\s{0,3}\\?[\"']value\\?[\"']\s{0,3}:\s{0,3})?(?:\\?[\"'])?"
+            r"([^\s\"'\\,;&}]{1,512})"
+        ),
+        1,
+        0.8,
+    ),
+    _Pattern(
+        "camel_case_password",
+        re.compile(
+            r"(?<![A-Za-z0-9])[a-z][A-Za-z0-9]{0,40}Password"
             r"(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}(?:\\?[\"'])?"
             r"([^\s\"'\\,;&}]{1,512})"
         ),
         1,
         0.8,
     ),
+    _Pattern(
+        "cookie_header",
+        re.compile(
+            r"(?i)(?<![a-z0-9_-])(?:set-)?cookie(?:\\?[\"'])?\s{0,3}:\s{0,3}(?:\\?[\"'])?"
+            r"([^\s=;\"']{1,128}=[^\r\n\"']{1,2048})"
+        ),
+        1,
+        0.85,
+    ),
+    _Pattern(
+        "session_cookie",
+        re.compile(
+            r"(?i)(?<![a-z0-9_-])(?:(?:sessionid|jsessionid|phpsessid|connect\.sid|csrftoken|"
+            r"csrfmiddlewaretoken|xsrf-token)(?:\\?[\"'])?\s{0,3}[:=]\s{0,3}|session=)"
+            r"(?:\\?[\"'])?([^\s\"'\\,;&}]{8,512})"
+        ),
+        1,
+        0.8,
+    ),
 )
 
 _PLACEHOLDER_VALUES = frozenset(
-    {"", "null", "none", "nil", "undefined", "true", "false", "redacted", "***", "******", "xxx"}
+    {
+        "",
+        "null",
+        "none",
+        "nil",
+        "undefined",
+        "true",
+        "false",
+        "redacted",
+        "***",
+        "******",
+        "xxx",
+        "{",
+        "[",
+    }
 )
+# Code that reads a secret, not the secret. Only well-known names, because a dotted value can
+# itself be a password.
+_CODE_REFERENCE_RE = re.compile(
+    r"(?:settings|config|request|self|this|args|params|env|os\.environ|process\.env)[.\[]"
+)
+_PATH_VALUE_RE = re.compile(r"(?:/|~/|[A-Za-z]:\\)")
 
 
 def _is_placeholder(value: str) -> bool:
@@ -110,7 +161,7 @@ class SecretDetector:
             for m in pattern.regex.finditer(text):
                 start, end = m.start(pattern.group), m.end(pattern.group)
                 value = m.group(pattern.group)
-                if _is_placeholder(value):
+                if _is_placeholder(value) or self._is_reference(pattern.name, m, value):
                     continue
                 if any(s <= start and end <= e for s, e in covered):
                     continue
@@ -118,6 +169,15 @@ class SecretDetector:
                 out.append(self._finding(item, (start, end), pattern.name, pattern.confidence))
         return out
 
+    @staticmethod
+    def _is_reference(family: str, match: re.Match[str], value: str) -> bool:
+        if family not in ("assignment", "connection_string_password"):
+            return False
+        if _CODE_REFERENCE_RE.match(value):
+            return True
+        # PWD is also the shell's working directory.
+        return match.group(0)[:3].lower() == "pwd" and bool(_PATH_VALUE_RE.match(value))
+
     def _finding(
         self, item: ScanItem, span: tuple[int, int], family: str, confidence: float
     ) -> Finding:

ciphergate_cli-0.10.0/src/ciphergate/detectors/ssn.py

@@ -0,0 +1,45 @@
+"""US Social Security number detector: dashed form, with the never-issued ranges excluded.
+
+Bare nine-digit runs are not matched because they are indistinguishable from other identifiers.
+Other countries' identifiers are not covered.
+"""
+
+from __future__ import annotations
+
+import re
+
+from ciphergate.detectors.base import make_finding, preceding_context
+from ciphergate.models.finding import Finding, ScanItem
+
+_SSN_RE = re.compile(r"(?<![\d-])(\d{3})-(\d{2})-(\d{4})(?![\d-])")
+_KEYWORDS = ("ssn", "social", "tax", "tin")
+
+
+class SsnDetector:
+    id = "ssn_pattern"
+
+    def detect(self, item: ScanItem) -> list[Finding]:
+        text = item.text
+        if not text or len(text) < 11:
+            return []
+        out: list[Finding] = []
+        for m in _SSN_RE.finditer(text):
+            area, group, serial = m.groups()
+            if area in ("000", "666") or area[0] == "9" or group == "00" or serial == "0000":
+                continue
+            evidence = ["pattern_match"]
+            confidence = 0.8
+            if preceding_context(text, m.start(), _KEYWORDS):
+                confidence = 0.95
+                evidence.append("context_keyword")
+            out.append(
+                make_finding(
+                    item,
+                    category="pii.government_id",
+                    detector=self.id,
+                    confidence=confidence,
+                    evidence=tuple(evidence),
+                    span=(m.start(), m.end()),
+                )
+            )
+        return out

ciphergate_cli-0.10.0/tests/tooling/test_benchmark.py

@@ -0,0 +1,76 @@
+"""The detection benchmark: repeatable corpus, valid labels, results kept out of the repository."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from ciphergate import load_policy
+from ciphergate.detectors.iban import iban_valid
+from ciphergate.detectors.payment_card import luhn_valid
+from tests.conftest import ROOT
+
+sys.path.insert(0, str(ROOT / "scripts" / "benchmark"))
+
+import compare_tools
+
+
+def test_corpus_is_repeatable_for_a_seed() -> None:
+    assert compare_tools.Corpus(1).build(3) == compare_tools.Corpus(1).build(3)
+    assert compare_tools.Corpus(1).build(3) != compare_tools.Corpus(2).build(3)
+
+
+def test_every_class_has_templates_and_labels_are_present_in_the_text() -> None:
+    corpus = compare_tools.Corpus(1)
+    assert set(corpus.generators) == set(compare_tools.TEMPLATES)
+    for case in corpus.build(4):
+        assert case["value"] is None or case["value"] in case["text"]
+
+
+def test_negatives_carry_no_label() -> None:
+    negatives = [c for c in compare_tools.Corpus(1).build(2) if c["cls"] == "NEGATIVE"]
+    assert len(negatives) == 2 * compare_tools.NEGATIVE_FACTOR
+    assert all(c["value"] is None for c in negatives)
+
+
+def test_generated_values_pass_their_own_checks() -> None:
+    corpus = compare_tools.Corpus(1)
+    for _ in range(50):
+        assert iban_valid(corpus.iban())
+        assert luhn_valid(corpus.luhn("4"))
+
+
+def test_benchmark_policy_is_valid() -> None:
+    assert load_policy(compare_tools.POLICY).name == "benchmark-redact-everything"
+
+
+def test_ciphergate_scoring_on_a_small_corpus(tmp_path: Path) -> None:
+    cases = compare_tools.Corpus(1).build(1)
+    hits, _ = compare_tools.run_ciphergate(cases, tmp_path)
+    scored = {c["cls"]: hit for c, hit in zip(cases, hits, strict=True) if c["value"]}
+    assert scored["email"] and scored["iban"] and scored["private_key_pem"]
+    assert not scored["person_name"]  # a known gap without NER; the score must be able to say so
+
+
+@pytest.mark.parametrize("inside", [ROOT, ROOT / "build" / "bench"])
+def test_refuses_to_write_inside_the_repository(inside: Path) -> None:
+    assert compare_tools.is_inside_repo(inside)
+    assert compare_tools.main(["--out", str(inside), "--per-class", "1"]) == 2
+
+
+def test_output_outside_the_repository_is_allowed(tmp_path: Path) -> None:
+    assert not compare_tools.is_inside_repo(tmp_path)
+
+
+def test_results_are_not_tracked() -> None:
+    tracked = subprocess.run(
+        ["git", "ls-files", "scripts/benchmark"],
+        cwd=ROOT,
+        capture_output=True,
+        text=True,
+        check=True,
+    ).stdout.split()
+    assert not [f for f in tracked if f.endswith((".jsonl", ".json"))]

{ciphergate_cli-0.9.0 → ciphergate_cli-0.10.0}/tests/unit/test_detectors.py

@@ -22,6 +22,7 @@ from ciphergate.detectors.phone import PhoneDetector
 from ciphergate.detectors.regex_safety import regex_problems
 from ciphergate.detectors.registry import DetectorSet, TextBlockState, unsafe_replacement_reason
 from ciphergate.detectors.secrets import SecretDetector
+from ciphergate.detectors.ssn import SsnDetector
 from ciphergate.models.finding import ScanItem
 from ciphergate.models.policy import Classification, CustomDetector, DetectorSettings
 
@@ -493,3 +494,141 @@ def test_env_style_password_names(name: str) -> None:
 @pytest.mark.parametrize("name", ["nopassword", "haspassword", "password_reset_enabled"])
 def test_other_password_words_stay_unmatched(name: str) -> None:
     assert not SecretDetector().detect(item(f"{name}=enabled"))
+
+
+# ------------------------------------------------- bugs found by simulated developer runs
+
+
+TEST_ONLY = "TEST_ONLY_NOT_A_CREDENTIAL"
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        ("ssn 219-09-9999 failed", ["219-09-9999"]),
+        ("078-05-1120", ["078-05-1120"]),
+        ("area 000-12-3456", []),
+        ("area 666-12-3456", []),
+        ("area 912-12-3456", []),
+        ("group 219-00-9999", []),
+        ("serial 219-09-0000", []),
+        ("long 1219-09-99991", []),
+        ("undashed 219099999", []),
+    ],
+)
+def test_ssn(text: str, expected: list[str]) -> None:
+    findings = SsnDetector().detect(item(text))
+    assert spans(findings, text) == expected
+    assert all(f.category == "pii.government_id" for f in findings)
+
+
+def test_ssn_is_not_reported_as_a_phone_number() -> None:
+    categories = {f.category for f in DetectorSet(DetectorSettings()).scan(item("id 219-09-9999"))}
+    assert categories == {"pii.government_id"}
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        f'{{"spring.datasource.password":{{"value":"{TEST_ONLY}"}}}}',
+        f'{{"password": {{ "value": "{TEST_ONLY}" }}}}',
+    ],
+)
+def test_nested_value_is_found_not_the_brace(text: str) -> None:
+    assert spans(SecretDetector().detect(item(text)), text) == [TEST_ONLY]
+
+
+def test_lone_brace_is_not_a_secret() -> None:
+    assert not SecretDetector().detect(item('{"password":{"rotated":true}}'))
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        f"-Djavax.net.ssl.keyStorePassword={TEST_ONLY}",
+        f"trustStorePassword: {TEST_ONLY}",
+        f'{{"dbPassword":"{TEST_ONLY}"}}',
+    ],
+)
+def test_camel_case_password_names(text: str) -> None:
+    assert spans(SecretDetector().detect(item(text)), text) == [TEST_ONLY]
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        (
+            f"Cookie: sessionid={TEST_ONLY}; csrftoken={TEST_ONLY}",
+            f"sessionid={TEST_ONLY}; csrftoken={TEST_ONLY}",
+        ),
+        (f"Set-Cookie: sid={TEST_ONLY}; Path=/", f"sid={TEST_ONLY}; Path=/"),
+        (f"'sessionid': '{TEST_ONLY}'", TEST_ONLY),
+        (f"csrfmiddlewaretoken={TEST_ONLY}&next=/", TEST_ONLY),
+        (f"JSESSIONID={TEST_ONLY}", TEST_ONLY),
+        (f"session={TEST_ONLY}", TEST_ONLY),
+    ],
+)
+def test_cookies_and_session_values(text: str, expected: str) -> None:
+    assert spans(SecretDetector().detect(item(text)), text) == [expected]
+
+
+@pytest.mark.parametrize(
+    "text",
+    ["cookie: required", "session: established", "session=short", "sessionid=abc"],
+)
+def test_cookie_prose_is_not_a_secret(text: str) -> None:
+    assert not SecretDetector().detect(item(text))
+
+
+@pytest.mark.parametrize(
+    "text",
+    [
+        "PWD=/home/heidi",
+        "pwd=~/project",
+        "PWD=C:\\Users\\heidi",
+        'token=request.POST["card_token"]',
+        "api_key=settings.CRM_KEY",
+        "secret=os.environ['SIGNING']",
+        "password=config.db_password",
+    ],
+)
+def test_paths_and_code_references_are_not_secrets(text: str) -> None:
+    assert not SecretDetector().detect(item(text))
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        (f"Password={TEST_ONLY};Server=db", TEST_ONLY),
+        (f"PWD={TEST_ONLY}", TEST_ONLY),
+        ("password=/TEST_ONLY_slash", "/TEST_ONLY_slash"),
+        ("api_key=settingsTEST_ONLY", "settingsTEST_ONLY"),
+    ],
+)
+def test_real_values_near_those_exceptions_stay_found(text: str, expected: str) -> None:
+    assert spans(SecretDetector().detect(item(text)), text) == [expected]
+
+
+@pytest.mark.parametrize(
+    ("text", "expected"),
+    [
+        ("cvv=123", ["123"]),
+        ('{"cvc": "1234"}', ["1234"]),
+        ("CVV2: 123", ["123"]),
+        ("cvv=12", []),
+        ("cvv=12345", []),
+        ("cvv=enabled", []),
+    ],
+)
+def test_labelled_cvv(text: str, expected: list[str]) -> None:
+    findings = PaymentCardDetector().detect(item(text))
+    assert spans(findings, text) == expected
+    assert all(f.category == "pii.payment_card" for f in findings)
+
+
+def test_http_status_and_bytes_are_not_a_phone() -> None:
+    assert not PhoneDetector().detect(item('GET /x 200 1024 "-"'))
+
+
+def test_a_number_after_a_phone_keyword_is_still_a_phone() -> None:
+    assert PhoneDetector().detect(item("phone 202 5550143"))