[env]
exact_keys = [
  "PGPASSWORD",
  "MYSQL_PWD",
  "DB_URL",
  "DB_URI",
  "DATABASE_URI",
  "DATABASE_DSN",
  "SQLALCHEMY_DATABASE_URI",
  "REDIS_URL",
  "MONGO_URL",
  "MONGO_URI",
  "MONGODB_URI",
  "POSTGRES_URL",
  "POSTGRESQL_URL",
  "MYSQL_URL",
  "MARIADB_URL",
  "SMTP_URL",
  "AMQP_URL",
  "RABBITMQ_URL",
  "CELERY_BROKER_URL",
  "SLACK_WEBHOOK_URL",
  "DISCORD_WEBHOOK_URL",
  "TEAMS_WEBHOOK_URL",
  "MICROSOFT_TEAMS_WEBHOOK_URL",
  "KUBE_CONFIG_DATA",
  "KUBECONFIG_DATA",
  "AUTH_SECRET",
  "NEXTAUTH_SECRET",
  "DJANGO_SECRET_KEY",
  "RAILS_MASTER_KEY",
  "SECRET_KEY_BASE",
  "APP_KEY",
  "COOKIE_SECRET",
  "CSRF_SECRET",
  "DB_PASSWORD",
  "SMTP_PASSWORD",
  "MAIL_PASSWORD",
  "KAFKA_SASL_PASSWORD",
  "TWINE_PASSWORD",
  "SUPABASE_SERVICE_ROLE_KEY",
  "GOOGLE_APPLICATION_CREDENTIALS_JSON",
  "GCP_SERVICE_ACCOUNT_KEY",
  "CF_API_KEY",
  "CF_API_TOKEN",
  "CLOUDFLARE_API_KEY",
  "CLOUDFLARE_API_TOKEN",
  "CLOUDFLARE_GLOBAL_API_KEY",
  "CLOUDFLARE_ZONE_API_TOKEN",
  "CLOUDFLARE_DNS_API_TOKEN",
  "CLOUDFLARE_R2_SECRET_ACCESS_KEY",
]

key_markers = [
  "API_KEY",
  "ACCESS_KEY",
  "ACCESS_TOKEN",
  "AUTH_TOKEN",
  "BEARER_TOKEN",
  "REFRESH_TOKEN",
  "ID_TOKEN",
  "CLIENT_SECRET",
  "CONSUMER_SECRET",
  "SIGNING_SECRET",
  "WEBHOOK_SECRET",
  "SESSION_SECRET",
  "JWT_SECRET",
  "ENCRYPTION_KEY",
  "PRIVATE_KEY",
  "SECRET_KEY",
  "SECRET_TOKEN",
  "KEY",
  "TOKEN",
  "SECRET",
  "PASSWORD",
  "PASS",
  "AUTH",
  "PRIVATE",
  "CERT",
  "DATABASE_URL",
  "CONNECTION_STRING",
]

common_values = [
  "true",
  "false",
  "null",
  "none",
  "undefined",
  "nil",
  "debug",
  "dev",
  "development",
  "staging",
  "production",
  "test",
  "local",
  "localhost",
  "127.0.0.1",
  "::1",
  "example",
  "sample",
  "dummy",
  "changeme",
  "change_me",
  "change-me",
  "replace_me",
  "replace-me",
  "your_api_key_here",
  "your-api-key",
  "your_api_key",
  "your-token-here",
  "your_token_here",
  "your-secret-here",
  "your_secret_here",
  "your_auth_token",
  "dummy-secret",
  "example-secret",
  "sample-secret",
  "test-secret",
  "fake-secret",
  "placeholder-secret",
  "replace_with_your_api_key",
  "insert_your_api_key_here",
]

min_value_len = 12
min_entropy = 3.0

# High-confidence provider or structural patterns are auto-registered as
# transient in-memory secrets and replaced with placeholders before forwarding.

[[credential_patterns]]
id = "github_token"
description = "GitHub token-like value"
regex = '''\bgh[pousr]_[A-Za-z0-9_]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "github_fine_grained_pat"
description = "GitHub fine-grained personal access token-like value"
regex = '''\bgithub_pat_[A-Za-z0-9_]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "openai_modern_key"
description = "OpenAI project, service account, or admin API key-like value"
regex = '''\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "anthropic_key"
description = "Anthropic API key-like value"
regex = '''\bsk-ant-(?:api[0-9]{2}-|admin)[A-Za-z0-9_-]{16,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "slack_token"
description = "Slack token-like value"
regex = '''\b(?:xox[abprs]-|xapp-|xwfp-)[A-Za-z0-9-]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "stripe_secret_or_restricted_key"
description = "Stripe secret or restricted API key-like value"
regex = '''\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "stripe_webhook_secret"
description = "Stripe webhook signing secret-like value"
regex = '''\bwhsec_[A-Za-z0-9]{16,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "npm_access_token"
description = "npm access token-like value"
regex = '''\bnpm_[A-Za-z0-9]{36,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "pypi_api_token"
description = "PyPI API token-like value"
regex = '''\bpypi-[A-Za-z0-9_-]{85,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "huggingface_token"
description = "Hugging Face user access token-like value"
regex = '''\bhf_[A-Za-z0-9]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "linear_token"
description = "Linear API or OAuth token-like value"
regex = '''\blin_(?:api|oauth)_[A-Za-z0-9]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "sentry_auth_token"
description = "Sentry auth token-like value"
regex = '''\bsntry[us]_[A-Za-z0-9_-]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "sendgrid_api_key"
description = "Twilio SendGrid API key-like value"
regex = '''\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "supabase_secret_key"
description = "Supabase secret API key-like value"
regex = '''\bsb_secret_[A-Za-z0-9_-]{20,}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "cloudflare_api_credential_assignment"
description = "Cloudflare API key or token assignment-like value"
regex = '''(?i)\b(?:CF|CLOUDFLARE)(?:_[A-Z0-9]+)*_(?:API_)?(?:KEY|TOKEN)\s*[:=]\s*['"]?[A-Za-z0-9_-]{32,80}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "cloudflare_user_token"
description = "Cloudflare cfut user token-like value"
regex = '''\bcfut_[A-Za-z0-9_-]{32,128}\b'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "cloudflare_api_credential_context"
description = "Cloudflare API key or token mentioned with a nearby opaque credential value"
regex = '''(?i)\b(?:cloudflare|cf)\b[\s\S]{0,80}\b(?:api\s*)?(?:key|token)\b[\s\S]{0,40}\b[A-Za-z0-9_-]{32,80}\b'''
on_unregistered_match = "require_explicit_secret"

[[credential_patterns]]
id = "private_key_block"
description = "PEM private key block marker"
regex = '''(?s)-----BEGIN (?:[A-Z0-9 ]+ )?PRIVATE KEY-----[A-Za-z0-9+/=\r\n -]{32,}-----END (?:[A-Z0-9 ]+ )?PRIVATE KEY-----'''
on_unregistered_match = "auto_redact"

[[credential_patterns]]
id = "credentialed_database_url"
description = "Database URL containing username and password-like credentials"
regex = '''\b(?:postgres(?:ql)?|mysql2?|mariadb|mongodb(?:\+srv)?|redis|rediss|amqps?|sqlserver|mssql)://[^/\s:@]+:[^@\s/]{12,}@'''
on_unregistered_match = "auto_redact"

# Ambiguous identifiers or client-visible keys are tracked but do not block.

[[credential_patterns]]
id = "openai_legacy_key"
description = "Legacy OpenAI-style sk key-like value"
regex = '''\bsk-[A-Za-z0-9]{20,}\b'''
on_unregistered_match = "allow"

[[credential_patterns]]
id = "aws_access_key_id"
description = "AWS access key id-like value; identifier only without secret key context"
regex = '''\b(?:AKIA|ASIA)[0-9A-Z]{16}\b'''
on_unregistered_match = "allow"

[[credential_patterns]]
id = "stripe_publishable_key"
description = "Stripe publishable API key-like value"
regex = '''\bpk_(?:live|test)_[A-Za-z0-9]{16,}\b'''
on_unregistered_match = "allow"

[[credential_patterns]]
id = "google_api_key"
description = "Google or Firebase API key-like value"
regex = '''\bAIza[0-9A-Za-z_-]{35}\b'''
on_unregistered_match = "allow"

[[credential_patterns]]
id = "supabase_publishable_key"
description = "Supabase publishable API key-like value"
regex = '''\bsb_publishable_[A-Za-z0-9_-]{20,}\b'''
on_unregistered_match = "allow"

[[credential_patterns]]
id = "twilio_sid_identifier"
description = "Twilio Account SID or API Key SID-like identifier"
regex = '''\b(?:AC|SK)[0-9a-fA-F]{32}\b'''
on_unregistered_match = "allow"
