name = "strict-redaction"
version = "1.0.0"
description = "Baseline plus aggressive secret/token coverage and compact context: for teams handling customer data"
extends = "baseline"

[context]
default_read_mode = "map"
audit_retention_days = 180

[redaction]
# JSON Web Tokens (three base64url segments).
jwt = '\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b'
# GitHub tokens (classic + fine-grained).
github_token = '\b(gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{60,})\b'
# GitLab personal access tokens.
gitlab_token = '\bglpat-[A-Za-z0-9_\-]{20,}\b'
# Slack bot/user/app tokens.
slack_token = '\bxox[baprs]-[A-Za-z0-9-]{10,}\b'
# OpenAI / Anthropic API keys.
openai_key = '\bsk-[A-Za-z0-9_-]{20,}\b'
anthropic_key = '\bsk-ant-[A-Za-z0-9_-]{20,}\b'
# Stripe live/test secret keys.
stripe_key = '\b[sr]k_(live|test)_[A-Za-z0-9]{16,}\b'
# AWS secret access keys assigned in config/env lines.
aws_secret = '(?i)\baws[_-]?secret[_-]?access[_-]?key\b\s*[:=]\s*\S{30,}'
# Database connection strings with inline credentials.
db_url_credentials = '(?i)\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis|amqp)://[^\s:@/]+:[^\s@/]+@'
