incognito-sql 0.0.5a1__tar.gz

incognito_sql-0.0.5a1/.gitignore

@@ -0,0 +1,11 @@
+.claude/settings.local.json
+.venv/
+__pycache__/
+.coverage
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+dist/
+fuzz-findings.yaml
+client-sessions.json
+mutants/

incognito_sql-0.0.5a1/CHANGELOG.md

@@ -0,0 +1,168 @@
+# Changelog
+
+All notable changes to incognito-sql are listed here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+0.0.1 and 0.0.2 were stages of development and were never released as packages; their dates
+are when the stage was finished. Numbers from the benchmark are in
+[docs/benchmark.md](docs/benchmark.md), not here.
+
+## [0.0.5a1] - 2026-11-03
+
+A test build for hands-on checks in agent harnesses before 0.0.5. It is installed only by
+its exact version (`incognito-sql==0.0.5a1`) and has had no cold review; findings go into
+0.0.5. It holds everything under [Unreleased] below and the setup steps of 0.0.5: `guide`
+for an agent, `setup` in the terminal, `secret` for a password typed outside the chat.
+
+## [Unreleased] (0.0.4)
+
+In progress: the items below may still change before the release.
+
+### Added
+
+- **Refusals tell the agent what to do next.** A refusal carries `retry` (`rewrite`,
+  `ask_user` or `stop`) and a fixed `hint` per reason; neither names a value, a column or
+  database text.
+- **Row rules** in the declaration (`row_rules`): hide rows or cells by a condition on
+  open columns, under every profile. A query that could fail on a hidden row is refused
+  (`hidden_rows`).
+- **`incognito-sql try --config <file> "<sql>"`**: the verdict on a query, the base
+  columns it reads and its output columns, without running it.
+- **`incognito-sql assess`**: judges what the model can learn about each column on your own
+  database and protection profile, and how long the literal budget makes a series of
+  probes wait.
+- **`incognito-sql report`**: a per-column report for a data protection officer: what the
+  model may learn of each column and what it asked.
+- **`incognito-sql diff <old> <new>`**: what a new declaration lets the model see or link
+  more (`WIDENED`) or less (`NARROWED`); with `--ci` it exits 1 on any widening.
+- **`incognito-sql demo`** writes an invented shop database to try the server on, and
+  **`incognito-sql connect <client>`** prints the MCP entry for Claude Code, Codex, Cursor
+  or OpenCode (`--write` adds it to the client's settings file); the entry names the DSN's
+  variable, never its value.
+- **`incognito-sql audit verify`**: the audit log is a hash chain, and `verify` names its
+  first break.
+- Each audit line names the base columns the query read, refused or not.
+- `limits.probe_budget` (default 100): probes of identifier values (`<`, `>`, `BETWEEN`,
+  `<>`, `LIKE`, sort keys, `MIN` / `MAX`, `length()`) per window of the installation.
+- `limits.query_rate` and `limits.query_window_s` (default 600 per 60 s): queries the
+  installation answers per window, refused ones included.
+
+### Changed
+
+- A configuration error names the place of a bad value and never repeats the text typed
+  there; a secret pasted into a command-line argument is refused and never echoed.
+
+## [0.0.3] (not yet released)
+
+### Added
+
+- **Protection profiles** for identifier columns: `strict`, `balanced` and `permissive`,
+  your own profiles under `protections`, and a profile per column under
+  `column_protection`. A profile names the operations an identifier admits; none of them
+  shows a value whole. `describe` tells the model which operations it may use.
+- Under `permissive`: `length()` of an identifier, sorting by it, `MIN` / `MAX` of it (as a
+  token), `<` `>` `BETWEEN`, `LIKE` and `<>` with a human literal. Each such literal spends
+  the literal budget and is written to the audit log as `?`.
+- `serve`, `service` and `check` warn when the profile in use admits more than `balanced`.
+- Query forms accepted under every profile: `INTERSECT` and `EXCEPT`, a table alias
+  repeated across their branches, a column outside `GROUP BY` when the whole non-null
+  primary key of its table is grouped, `SUM` / `AVG` over a `CASE` of small non-negative
+  integers, SQLite double-quoted strings, SQLite date functions and `instr` over open
+  columns, catalog names with spaces, parentheses or hyphens.
+- Under `permissive` only: window functions (never over an identifier), `SUM` / `AVG` over
+  any expression, grouping by a primary key that can hold NULL.
+- A cell of an open column that looks personal is masked as a link that shows the value to
+  a signed-in human only; the first time a column is masked, a warning names it and the
+  audit line lists it. `verified_open` lists columns checked by a human, whose values are
+  not masked.
+- `SECURITY.md`: how to report a way for a hidden value to reach the model.
+- The package is licensed under Apache-2.0, and a release workflow publishes a tagged
+  version to PyPI.
+- The benchmark runs on sets we did not write (Spider, BIRD Mini-Dev, SecureSQL), takes
+  more tools of the same kind, and judges every tool by levels of disclosure (a value
+  whole, a piece of it, a fact about it) against what that tool claims.
+  [docs/competitors.md](docs/competitors.md) describes how the other tools work.
+
+### Changed
+
+- **The default protection profile is `permissive`, which admits more than 0.0.2 did.**
+  `strict` admits exactly what 0.0.2 admitted; set `protection: strict` or
+  `protection: balanced` to keep the narrower behaviour.
+- **`strict` now refuses some queries it used to answer**, closing what was left of the
+  scan-order channel: `SUM` / `AVG` over float columns (`float_aggregate`); expressions
+  that can fail on some rows inside `EXISTS`, `IN (SELECT ...)`, a scalar subquery or a
+  `WITH` query (`fallible_subquery`); and, on MySQL and SQL Server, `GROUP BY`,
+  `DISTINCT`, `MIN` / `MAX` and `UNION` over open text columns (`equal_spellings`).
+  `strict` also prints a number one way whatever its type (`1.0` as `1`).
+- The card sign-in lasts 8 hours by default (`session_ttl_s`).
+- A query refused after the literal budget (a limit, a database error) has spent its
+  literals; the README says so.
+- `MIN` / `MAX` of an identifier counts as a place of its value under every profile, and a
+  `RANGE` window frame with an offset over an identifier sort key is refused.
+
+### Fixed
+
+- The service (`incognito-sql service`) counted the literal budget of all its clients as
+  one connection with no time window, so after `literal_budget` distinct literals it
+  refused every new one for good, even after a restart. It now counts by the
+  installation window only.
+- Honest queries no longer refused: the query forms listed under Added, `CAST` of an open
+  column, and a literal left of `IN` against an identifier, which now matches the value's
+  spellings.
+
+## [0.0.2] - 2026-10-31 (not published)
+
+The strength of the protection is tested beyond the attack corpus.
+
+### Added
+
+- Differential fuzzing: random queries go through the server on all five DBMS, and any
+  disagreement between the parser and the database is recorded.
+- Red-team campaigns and honest questions through a real MCP client (Claude Code), run
+  locally before a release.
+- Mutation testing of the protective modules, weekly in CI.
+- A demo database of invented data for those runs.
+
+### Security
+
+- A cell holding more candidate e-mails or card numbers than the detector examines is
+  masked instead of passed.
+
+## [0.0.1] - 2026-10-31 (not published)
+
+The first version: safe to run on your own machine.
+
+### Added
+
+- An MCP server with two read-only tools: `query` runs one SQL `SELECT`, `describe` names
+  the DBMS and lists the usable tables and columns with their classes, the number of
+  hidden columns, and each table of people's `person_key`.
+- A YAML declaration of every column: `identifier`, `quasi`, `free_text`, `secret` or
+  `open`; a column it does not list is hidden. `entities` names the tables whose rows are
+  people.
+- Query checks: parser limits, an allowlist of syntax nodes, column lineage through
+  aliases, subqueries and set operations, and a default-deny policy for identifier
+  columns; system catalogs, `EXPLAIN` and several statements are refused.
+- Only SQL regenerated from the checked tree runs, with literals and tokens as bind
+  parameters, on a read-only session where the DBMS has one; a refusal or a database error
+  reaches the model as a reason from a fixed list, never with a bound value.
+- Tokens: each identifier value becomes a random `tk_...` token shared by its spellings,
+  living 24 hours by default, kept in an encrypted store whose key lives in the OS
+  keyring or in `INCOGNITO_SQL_KEY`. Labels mode (`web_enabled: false`) gives labels local
+  to one answer instead.
+- Local web cards that show a value or a person to a signed-in human, with a one-time
+  sign-in link (`login`) and `web` to serve them alone.
+- Output shaping: rows shuffled unless the query has `ORDER BY`, ties in random order,
+  computed floats rounded, and cells of open columns that look personal masked.
+- A literal budget: distinct human literals compared with identifiers, per connection and
+  per window of the installation.
+- An audit log with literals replaced by tokens; result rows are never logged.
+- `init` writes a declaration scaffold with every column hidden and lists columns that
+  look personal.
+- PostgreSQL, MySQL, SQL Server, SQLite and DuckDB, with a statement time limit on each.
+- The closed installation profile: `incognito-sql service` runs as its own OS user and
+  serves MCP over HTTP on `127.0.0.1` behind a token; `--env-file`; `check` tells which
+  profile an agent's account is in. [docs/deployment.md](docs/deployment.md) sets it up.
+- A leakage benchmark: an attack corpus, an oracle that shares no code with the server,
+  and other tools of the same kind on the same attacks.

incognito_sql-0.0.5a1/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

incognito_sql-0.0.5a1/NOTICE

@@ -0,0 +1,176 @@
+incognito-sql
+=============
+
+Copyright 2026 Alexander Khodos. Licensed under the Apache License, Version 2.0
+(see LICENSE).
+
+The attack corpus under bench/corpus/ includes test data taken from the projects
+below. Only test data was taken (case names and SQL strings, grouped by their
+categories), rewritten against the invented bench world (bench/world.py); no code
+from these projects is included. Expected outcomes are our own.
+
+
+sql-safe-mcp
+------------
+Repository: https://github.com/proprock/sql-safe-mcp
+Commit:     9dd2a696318f03b01e1f4c44d422ce6bc4214fe7
+Files:      tests/security/corpus/{pii,structure,syntax,resources}.yaml
+Taken:      300 cases -> bench/corpus/sql_safe_mcp_{pii,structure,syntax,resources}.yaml
+License:    MIT
+
+  MIT License
+
+  Copyright (c) 2026 Anton Padapryhara
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
+
+DataCharter (govbench-v1)
+-------------------------
+Repository: https://github.com/datacharter/datacharter
+Commit:     a7cb14e538d86eb16ad639a9d0799e9206cabfcf (tag v0.44.0)
+Files:      src/datacharter/agent/govbench_v1.json
+            (SHA-256 bf135e5d3a22be733b7f27da5e5c3292fc549fc4ae1a52ddce6794f5c6744131),
+            docs/govbench.md
+Taken:      the 28 attack queries of govbench-v1 and their ids -> bench/corpus/govbench.yaml,
+            adapted: their tables and columns rewritten against the bench world, the
+            expected outcomes our own. No code is included. The repository has no NOTICE
+            file at that commit.
+License:    Apache License, Version 2.0 (the same text as LICENSE in this repository)
+
+
+sanitized-db-mcp
+----------------
+Repository: https://github.com/evvy-bio/sanitized-db-mcp
+Commit:     c1144d8e80bb00727bedf4a39f9630da7dba1d3c
+Files:      sanitized_db_mcp/tests/test_pentest.py (PT_* categories)
+Taken:      90 cases with SQL -> bench/corpus/sanitized_db_mcp.yaml
+            (PT_CONN and PT_AUD inspect that project's code and carry no SQL)
+License:    MIT
+
+  MIT License
+
+  Copyright (c) 2026 ruminaider
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
+
+Article
+-------
+Yevhen Piotrovskyi, "Controlling PII Disclosure in Database MCP Connectors",
+American Impact Review (2026), doi:10.66308/air.e2026067,
+https://americanimpactreview.com/article/e2026067
+
+The article does not publish its attack list. bench/corpus/article.yaml is our
+reconstruction of a 17-attack suite from the techniques the article names (section
+5.3), written as our own cases; it is not the article's attack list, and no text of
+the article is reproduced. The leak oracle (bench/oracle.py) follows the article's
+design: an oracle sharing no code with the gateway, matching canaries in
+5-character windows after hex and base64 decoding.
+
+
+mcp-db-results-anonymizer
+-------------------------
+Repository: https://github.com/dnjfr/mcp-db-results-anonymizer
+Tag:        v1.0.1 (commit 6aa6ae33467d4a0b4deda544540ea7c645756eee)
+Files:      config.example.yaml
+Taken:      the column-name pattern lists of its `detection` section ->
+            bench/adapters/config/db_results_anonymizer.yaml, as its docs tell users
+            to copy that template; no code is included.
+License:    Apache-2.0 (https://www.apache.org/licenses/LICENSE-2.0)
+
+
+mcp-server-conceal
+------------------
+Repository: https://github.com/gbrigandi/mcp-server-conceal
+Tag:        v0.1.0 (commit d98466772c7d686ddeb979f3d130a07aa3a30090)
+Files:      README.md, section "Configuration"
+Taken:      the regular expressions of its `[detection.patterns]` table ->
+            bench/adapters/config/conceal.toml, as its README gives them for users'
+            configuration files; no code is included.
+License:    MIT
+
+  MIT License
+
+  Copyright (c) 2025 Gianluca Brigandi
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in all
+  copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
+
+Independent sets (bench/external/)
+----------------------------------
+
+The independent-sets benchmark (`uv run poe bench-external`) downloads the sets below
+at run time into a local cache, by a pinned address and SHA-256 (bench/external/
+sources.py). None of their questions, queries or data is in this repository. Our
+markings (bench/external/decl/*.yaml) name the sets' databases, tables and columns, and
+quote SecureSQL's security conditions verbatim to match its samples; the markings
+themselves are ours.
+
+Spider 1.0
+  Tao Yu et al., "Spider: A Large-Scale Human-Labeled Dataset for Complex and
+  Cross-Domain Semantic Parsing and Text-to-SQL Task", EMNLP 2018.
+  https://yale-lily.github.io/spider (spider_data.zip, dev set and its databases)
+  License: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
+
+BIRD Mini-Dev
+  Jinyang Li et al., "Can LLM Already Serve as A Database Interface? A BIg Bench for
+  Large-Scale Database Grounded Text-to-SQLs", NeurIPS 2023.
+  https://github.com/bird-bench/mini_dev (minidev.zip, SQLite questions and databases)
+  License: CC BY-SA 4.0, https://creativecommons.org/licenses/by-sa/4.0/
+
+SecureSQL
+  Yanqi Song et al., "SecureSQL: Evaluating Data Leakage of Large Language Models as
+  Natural Language Interfaces to Databases", Findings of EMNLP 2024.
+  Repository: https://github.com/JacobiSong/SecureSQL
+  Commit:     f00ba46378e43373fcbbfcdc9f8eca7299228845 (data.json)
+  Taken:      the security conditions quoted in bench/external/decl/*.yaml
+  License:    Apache License, Version 2.0 (the same text as LICENSE in this repository)