raxe 0.4.6__py3-none-any.whl

raxe/packs/core/v1.0.0/rules/pii/pii-3006@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3006
+family: PII
+sub_family: api_keys
+name: Anthropic API Key Detection
+description: Detects Anthropic Claude API keys (sk-ant- pattern)
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: \b(sk-ant-[A-Za-z0-9\-_]{95,})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "ANTHROPIC_API_KEY=sk-ant-api03-1234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklmnop"
+  - "claude_key: sk-ant-sid01-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+  should_not_match:
+  - "Anthropic keys start with sk-ant-"
+  - "How to get a Claude API key?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: ai_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3006-Anthropic-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3007@1.0.0.yaml

@@ -0,0 +1,37 @@
+version: 1.0.0
+rule_id: pii-3007
+family: PII
+sub_family: api_keys
+name: GitHub Personal Access Token Detection
+description: Detects GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_ patterns)
+severity: critical
+confidence: 0.98
+patterns:
+- pattern: \b(gh[pousr]_[A-Za-z0-9]{36,})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "GITHUB_TOKEN=ghp_1234567890abcdefghijklmnopqrstuvwxyzABCD"
+  - "oauth_token: gho_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+  - "user_token=ghu_abcdefghijklmnopqrstuvwxyz1234567890ABCD"
+  should_not_match:
+  - "GitHub tokens start with ghp_"
+  - "How to create a GitHub PAT?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+- T1528
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: vcs_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3007-Github-Personal-Access-Token

raxe/packs/core/v1.0.0/rules/pii/pii-3008@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3008
+family: PII
+sub_family: api_keys
+name: Slack Bot Token Detection
+description: Detects Slack bot and workspace tokens (xoxb-, xoxp-, xoxa-, xoxr- patterns)
+severity: high
+confidence: 0.97
+patterns:
+- pattern: \b(xox[bpra]-[0-9]{10,13}-[0-9]{10,13}-[A-Za-z0-9]{24,})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "SLACK_BOT_TOKEN=xoxb-1234567890123-1234567890123-abcdefghijklmnopqrstuvwx"
+  - "token: xoxp-1234567890-1234567890-1234567890-abc123def456ghi789jkl012mno345pqr"
+  should_not_match:
+  - "Slack tokens start with xox"
+  - "How to get a Slack bot token?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: collaboration_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3008-Slack-Bot-Token-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3009@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3009
+family: PII
+sub_family: api_keys
+name: Stripe API Key Detection
+description: Detects Stripe API keys (sk_live_, pk_live_, sk_test_, pk_test_ patterns)
+severity: critical
+confidence: 0.99
+patterns:
+- pattern: \b(sk_live_[0-9a-zA-Z]{24,})\b
+  flags: []
+  timeout: 5.0
+- pattern: \b(pk_live_[0-9a-zA-Z]{24,})\b
+  flags: []
+  timeout: 5.0
+- pattern: \b(sk_test_[0-9a-zA-Z]{24,})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "STRIPE_SECRET_KEY=sk_live_1234567890abcdefghijklmnopqrstuvwxyz"
+  - "publishable_key: pk_live_AAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+  - "test_key=sk_test_abcdefghijklmnopqrstuvwxyz1234567890"
+  should_not_match:
+  - "Stripe keys start with sk_live_ or pk_live_"
+  - "How to get Stripe API keys?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: payment_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3009-Stripe-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3010@1.0.0.yaml

@@ -0,0 +1,39 @@
+version: 1.0.0
+rule_id: pii-3010
+family: PII
+sub_family: api_keys
+name: Twilio API Key Detection
+description: Detects Twilio account SID and auth tokens
+severity: high
+confidence: 0.96
+patterns:
+- pattern: \b(AC[a-f0-9]{32})\b
+  flags: []
+  timeout: 5.0
+- pattern: (?i)twilio.{0,20}(?:auth|token).{0,20}['\"]([a-f0-9]{32})['\"]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "TWILIO_ACCOUNT_SID=ACabcdef1234567890abcdef1234567890"
+  - "twilio_auth_token='1234567890abcdef1234567890abcdef'"
+  should_not_match:
+  - "Twilio SIDs start with AC"
+  - "How to find my Twilio credentials?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: communication_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3010-Twilio-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3011@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3011
+family: PII
+sub_family: api_keys
+name: SendGrid API Key Detection
+description: Detects SendGrid API keys (SG. pattern)
+severity: high
+confidence: 0.97
+patterns:
+- pattern: \b(SG\.[A-Za-z0-9\-_]{22}\.[A-Za-z0-9\-_]{43})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "SENDGRID_API_KEY=SG.abcdefghijklmnopqrstuv.1234567890abcdefghijklmnopqrstuvwxyzABCDEFG"
+  - "api_key: SG.AAAAAAAAAAAAAAAAAAAAAA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+  should_not_match:
+  - "SendGrid keys start with SG."
+  - "How to create a SendGrid API key?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: email_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3011-Sendgrid-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3012@1.0.0.yaml

@@ -0,0 +1,35 @@
+version: 1.0.0
+rule_id: pii-3012
+family: PII
+sub_family: api_keys
+name: Mailgun API Key Detection
+description: Detects Mailgun API keys (key- pattern)
+severity: high
+confidence: 0.95
+patterns:
+- pattern: \b(key-[a-f0-9]{32})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "MAILGUN_API_KEY=key-1234567890abcdef1234567890abcdef"
+  - "mailgun_key: key-abcdef1234567890abcdef1234567890"
+  should_not_match:
+  - "Mailgun keys start with key-"
+  - "How to get a Mailgun API key?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: email_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3012-Mailgun-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3013@1.0.0.yaml

@@ -0,0 +1,36 @@
+version: 1.0.0
+rule_id: pii-3013
+family: PII
+sub_family: api_keys
+name: Datadog API Key Detection
+description: Detects Datadog API keys (32-character hex strings in context)
+severity: high
+confidence: 0.93
+patterns:
+- pattern: (?i)datadog.{0,20}(?:api|app).{0,20}key.{0,20}['\"]([a-f0-9]{32})['\"]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "DATADOG_API_KEY='1234567890abcdef1234567890abcdef'"
+  - "dd_app_key: 'abcdef1234567890abcdef1234567890'"
+  should_not_match:
+  - "Datadog API keys are 32 characters"
+  - "How to find my Datadog key?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: monitoring_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3013-Datadog-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3014@1.0.0.yaml

@@ -0,0 +1,36 @@
+version: 1.0.0
+rule_id: pii-3014
+family: PII
+sub_family: api_keys
+name: Heroku API Key Detection
+description: Detects Heroku API keys (UUID format in context)
+severity: high
+confidence: 0.94
+patterns:
+- pattern: (?i)heroku.{0,20}(?:api|token|key).{0,20}['\"]([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})['\"]
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "HEROKU_API_KEY='12345678-1234-1234-1234-123456789abc'"
+  - "heroku_token: 'abcdef12-3456-7890-abcd-ef1234567890'"
+  should_not_match:
+  - "Heroku uses UUID format for API keys"
+  - "How to get a Heroku API key?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.001
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: platform_credentials
+rule_hash: null
+risk_explanation: API key exposure in prompts, responses, or training data creates critical security vulnerabilities. Leaked API keys grant attackers access to cloud services, third-party platforms, and internal systems, potentially leading to data breaches, resource abuse, or financial fraud.
+remediation_advice: Scan all data sources for API keys before AI processing. Implement automated key rotation and revocation. Use secret detection tools in development and production pipelines. Never log or persist API keys. Apply access controls to prevent AI systems from accessing key stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3014-Heroku-Api-Key-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3015@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3015
+family: PII
+sub_family: identity_documents
+name: US Passport Number Detection
+description: Detects US passport numbers (9 digits or 1-2 letters + 8 digits)
+severity: high
+confidence: 0.92
+patterns:
+- pattern: (?i)(?:passport|pass\.?\s*(?:no|number|num|#)).{0,20}\b([A-Z]{1,2}[0-9]{8})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:passport|pass\.?\s*(?:no|number|num|#)).{0,20}\b([0-9]{9})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "My passport number is A12345678"
+  - "Passport No: 123456789"
+  - "Pass #: AB12345678"
+  should_not_match:
+  - "What is a passport number?"
+  - "US passports have 9 digits"
+  - "I need to renew my passport"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: identity_documents
+rule_hash: null
+risk_explanation: Identity document numbers (passports, driver licenses, national ID numbers) enable identity theft and fraud when exposed. Attackers can use these credentials to impersonate victims, open fraudulent accounts, or bypass authentication systems.
+remediation_advice: Implement strict access controls for identity document data. Use tokenization or anonymization when processing identity information. Deploy DLP controls that detect and block identity document leakage. Maintain audit logs of all access to identity data.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3015-Us-Passport-Number-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3016@1.0.0.yaml

@@ -0,0 +1,42 @@
+version: 1.0.0
+rule_id: pii-3016
+family: PII
+sub_family: identity_documents
+name: US Driver License Number Detection
+description: Detects US driver license numbers in various state formats
+severity: high
+confidence: 0.88
+patterns:
+- pattern: (?i)(?:driver.{0,5}license|DL|drivers?\s*lic).{0,20}(?:no|number|num|#).{0,10}\b([A-Z]{1,2}[0-9]{6,8})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: (?i)(?:driver.{0,5}license|DL|drivers?\s*lic).{0,20}(?:no|number|num|#).{0,10}\b([0-9]{7,9})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Driver License No: A1234567"
+  - "DL#: 12345678"
+  - "Drivers Lic Number: B12345678"
+  should_not_match:
+  - "What is a driver license number?"
+  - "How to get a DL?"
+  - "Driver license requirements"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: identity_documents
+rule_hash: null
+risk_explanation: Identity document numbers (passports, driver licenses, national ID numbers) enable identity theft and fraud when exposed. Attackers can use these credentials to impersonate victims, open fraudulent accounts, or bypass authentication systems.
+remediation_advice: Implement strict access controls for identity document data. Use tokenization or anonymization when processing identity information. Deploy DLP controls that detect and block identity document leakage. Maintain audit logs of all access to identity data.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3016-Us-Driver-License-Number

raxe/packs/core/v1.0.0/rules/pii/pii-3017@1.0.0.yaml

@@ -0,0 +1,40 @@
+version: 1.0.0
+rule_id: pii-3017
+family: PII
+sub_family: identity_documents
+name: UK National Insurance Number Detection
+description: Detects UK National Insurance Numbers (NINO) in format XX123456X
+severity: high
+confidence: 0.94
+patterns:
+- pattern: (?i)(?:national\s*insurance|NI|NINO).{0,20}(?:no|number|num).{0,10}\b([A-Z]{2}[0-9]{6}[A-Z])\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+- pattern: \b([A-Z]{2}\s*[0-9]{2}\s*[0-9]{2}\s*[0-9]{2}\s*[A-Z])\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "National Insurance Number: AB123456C"
+  - "NINO: QQ 12 34 56 C"
+  - "NI No: AB123456D"
+  should_not_match:
+  - "What is a National Insurance Number?"
+  - "How to apply for NINO?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: identity_documents
+rule_hash: null
+risk_explanation: Identity document numbers (passports, driver licenses, national ID numbers) enable identity theft and fraud when exposed. Attackers can use these credentials to impersonate victims, open fraudulent accounts, or bypass authentication systems.
+remediation_advice: Implement strict access controls for identity document data. Use tokenization or anonymization when processing identity information. Deploy DLP controls that detect and block identity document leakage. Maintain audit logs of all access to identity data.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3017-Uk-National-Insurance-Number

raxe/packs/core/v1.0.0/rules/pii/pii-3018@1.0.0.yaml

@@ -0,0 +1,38 @@
+version: 1.0.0
+rule_id: pii-3018
+family: PII
+sub_family: identity_documents
+name: Canadian Social Insurance Number Detection
+description: Detects Canadian Social Insurance Numbers (SIN) in format XXX-XXX-XXX
+severity: critical
+confidence: 0.93
+patterns:
+- pattern: (?i)(?:social\s*insurance|SIN).{0,20}(?:no|number|num).{0,10}\b([0-9]{3}[-\s]?[0-9]{3}[-\s]?[0-9]{3})\b
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "Social Insurance Number: 123-456-789"
+  - "SIN: 123 456 789"
+  - "SIN No: 123456789"
+  should_not_match:
+  - "What is a SIN?"
+  - "How to get a Social Insurance Number?"
+  - "My phone is 123-456-7890"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: identity_documents
+rule_hash: null
+risk_explanation: Identity document numbers (passports, driver licenses, national ID numbers) enable identity theft and fraud when exposed. Attackers can use these credentials to impersonate victims, open fraudulent accounts, or bypass authentication systems.
+remediation_advice: Implement strict access controls for identity document data. Use tokenization or anonymization when processing identity information. Deploy DLP controls that detect and block identity document leakage. Maintain audit logs of all access to identity data.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3018-Canadian-Social-Insurance-Number

raxe/packs/core/v1.0.0/rules/pii/pii-3019@1.0.0.yaml

@@ -0,0 +1,40 @@
+version: 1.0.0
+rule_id: pii-3019
+family: PII
+sub_family: financial
+name: IBAN Detection
+description: Detects International Bank Account Numbers (IBAN) - European standard
+severity: high
+confidence: 0.95
+patterns:
+- pattern: \b([A-Z]{2}[0-9]{2}[A-Z0-9]{11,30})\b
+  flags: []
+  timeout: 5.0
+- pattern: (?i)iban.{0,10}[:\s]+([A-Z]{2}[0-9]{2}[\s]?[A-Z0-9]{4}[\s]?[A-Z0-9]{4}[\s]?[A-Z0-9]{4}[\s]?[A-Z0-9]{0,18})
+  flags:
+  - IGNORECASE
+  timeout: 5.0
+examples:
+  should_match:
+  - "IBAN: GB82 WEST 1234 5698 7654 32"
+  - "Account: DE89370400440532013000"
+  - "IBAN FR1420041010050500013M02606"
+  should_not_match:
+  - "What is an IBAN?"
+  - "IBAN format for UK banks"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: financial
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3019-Iban-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3020@1.0.0.yaml

@@ -0,0 +1,40 @@
+version: 1.0.0
+rule_id: pii-3020
+family: PII
+sub_family: financial
+name: SWIFT/BIC Code Detection
+description: Detects SWIFT/BIC codes for international wire transfers
+severity: medium
+confidence: 0.91
+patterns:
+- pattern: \b(?:SWIFT|BIC)\b.{0,10}(?:code|no|number)?.{0,10}\b([A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?)\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "SWIFT Code: DEUTDEFF500"
+  - "BIC: CHASUS33"
+  - "Bank SWIFT: BNPAFRPP"
+  should_not_match:
+  - "What is a SWIFT code?"
+  - "How to find BIC code?"
+  - "How do I handle authentication in a Swift application?"
+  - "Can you help me debug this Swift function?"
+  - "I'm learning Swift programming"
+  - "What are Swift best practices?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-20'
+  author: raxe-ce
+  category: financial
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3020-Swift/Bic-Code-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3021@1.0.0.yaml

@@ -0,0 +1,39 @@
+version: 1.0.0
+rule_id: pii-3021
+family: PII
+sub_family: financial
+name: Bitcoin Wallet Address Detection
+description: Detects Bitcoin (BTC) wallet addresses (P2PKH, P2SH, Bech32 formats)
+severity: high
+confidence: 0.96
+patterns:
+- pattern: \b(bc1[a-z0-9]{39,59})\b
+  flags: []
+  timeout: 5.0
+- pattern: \b([13][a-km-zA-HJ-NP-Z1-9]{25,34})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "Send BTC to: bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq"
+  - "Wallet: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
+  - "Address: 3J98t1WpEZ73CNmYviecrnyiWrnqRhWNLy"
+  should_not_match:
+  - "Bitcoin addresses start with 1, 3, or bc1"
+  - "How to create a BTC wallet?"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: cryptocurrency
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3021-Bitcoin-Wallet-Address-Detection

raxe/packs/core/v1.0.0/rules/pii/pii-3022@1.0.0.yaml

@@ -0,0 +1,36 @@
+version: 1.0.0
+rule_id: pii-3022
+family: PII
+sub_family: financial
+name: Ethereum Wallet Address Detection
+description: Detects Ethereum (ETH) wallet addresses (0x followed by 40 hex characters)
+severity: high
+confidence: 0.97
+patterns:
+- pattern: \b(0x[a-fA-F0-9]{40})\b
+  flags: []
+  timeout: 5.0
+examples:
+  should_match:
+  - "ETH wallet: 0x742d35Cc6634C0532925a3b844Bc9e7595f0bEb0"
+  - "Send to 0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed"
+  should_not_match:
+  - "Ethereum addresses start with 0x"
+  - "How to create an ETH wallet?"
+  - "0x prefix for hexadecimal"
+metrics:
+  precision: null
+  recall: null
+  f1_score: null
+  last_evaluated: null
+mitre_attack:
+- T1552.004
+metadata:
+  created: '2025-11-16'
+  updated: '2025-11-16'
+  author: raxe-ce
+  category: cryptocurrency
+rule_hash: null
+risk_explanation: Financial credential exposure (account numbers, routing numbers, cryptocurrency addresses) enables direct financial fraud and theft. Attackers can initiate unauthorized transactions, drain accounts, or conduct money laundering operations.
+remediation_advice: Apply PCI DSS and financial data security standards. Use encryption and tokenization for financial data. Implement transaction monitoring and fraud detection. Restrict AI access to financial systems and data stores.
+docs_url: https://github.com/raxe-ai/raxe-ce/wiki/PII-3022-Ethereum-Wallet-Address-Detection