cleansh-core 0.1.6

# Default rules for sensitive data detection
# This file defines regex patterns for detecting sensitive information.
# Each rule includes a name, regex pattern, replacement text, description,
# and flags for multiline handling, dot matching, and programmatic validation.
# Note: Some rules are opt-in due to high false positive risk.
# Use these rules to redact sensitive data in logs, code, and other text.
# Ensure to test and validate these patterns in your specific context.
# cleansh-core/config/default_rules.yaml
# License: MIT OR APACHE 2.0

rules:
  # ==== CONTACT INFO ====
  - name: "email"
    pattern: |-

      \b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,63}\b
    replace_with: "[EMAIL_REDACTED]"
    description: "Standard email address (supports TLDs up to 63 chars)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "phone_number"
    pattern: |-

      \b(\(?\+?\d{1,4}\)?[-.\s]?)?\(?(\d{3})\)?[-.\s]?(\d{3})[-.\s]?(\d{4})\b
    replace_with: "[PHONE_NUMBER_REDACTED]"
    description: "Common phone number formats including optional country code, area code, and separators."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  # ==== NETWORK IDENTIFIERS ====
  - name: "ipv4_address"
    pattern: |-

      \b((25[0-5]|2[0-4]\d|1?\d{1,2})\.){3}(25[0-5]|2[0-4]\d|1?\d{1,2})\b
    replace_with: "[IPV4_REDACTED]"
    description: "Strict IPv4 address with each octet in 0–255. Simpler regex than original."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "ipv6_address"
    pattern: |-

      \b(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}\b
    replace_with: "[IPV6_REDACTED]"
    description: "Uncompressed IPv6 address (8 groups of 1–4 hex digits). Compressed (::) forms not covered by default."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  # ==== AUTH TOKENS & KEYS ====
  - name: "jwt_token"
    pattern: |-

      \b(?:ey[a-zA-Z0-9-_=]+\.[A-Za-z0-9-_=]+\.[A-Za-z0-9-_=]+)\b
    replace_with: "[JWT_REDACTED]"
    description: "JSON Web Token (three Base64URL-encoded segments)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "github_pat"
    pattern: |-

      \bghp_[A-Za-z0-9]{36}\b
    replace_with: "[GITHUB_PAT_REDACTED]"
    description: "Classic GitHub PAT (40 chars, prefix ghp_)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "github_pat_fine_grained"
    pattern: |-

      \bgithub_pat_[A-Za-z0-9_]{72}\b
    replace_with: "[GITHUB_PAT_FINE_GRAINED_REDACTED]"
    description: "GitHub fine-grained PAT (72 chars, prefix github_pat_)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "stripe_secret"
    pattern: |-

      \b(?:sk_live_|sk_test_|rk_live_)[A-Za-z0-9]{24}\b
    replace_with: "[STRIPE_SECRET_REDACTED]"
    description: "Stripe keys (live/test/restricted), 24 alphanumeric chars."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "aws_access_key"
    pattern: |-

      \b(?:AKIA|ASIA)[0-9A-Z]{16}\b
    replace_with: "[AWS_ACCESS_KEY_REDACTED]"
    description: "AWS Access Key ID (20 chars, prefixes AKIA/ASIA)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "aws_secret_key"
    pattern: |-

      \b[A-Za-z0-9/+=]{40}\b
    replace_with: "[AWS_SECRET_KEY_REDACTED]"
    description: "AWS Secret Access Key (40-char Base64-style). **Opt-in only: High false positive risk.**"
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    opt_in: true
    programmatic_validation: false

  - name: "gcp_api_key"
    pattern: |-

      \bAIza[0-9A-Za-z-_]{35}\b
    replace_with: "[GCP_API_KEY_REDACTED]"
    description: "Google Cloud API Key (prefix AIza, 39 chars)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "google_oauth_token"
    pattern: |-

      \bya29\.[A-Za-z0-9_\-]{20,120}\b
    replace_with: "[GOOGLE_OAUTH_TOKEN_REDACTED]"
    description: "Google OAuth token (prefix ya29., 20–120 chars)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "ssh_private_key"
    pattern: |-

      (-----BEGIN (?:RSA|DSA|EC|OPENSSH) PRIVATE KEY-----.*?-----END (?:RSA|DSA|EC|OPENSSH) PRIVATE KEY-----)
    replace_with: "[SSH_PRIVATE_KEY_BLOCK_REDACTED]"
    description: "SSH private key block (RSA/DSA/EC/OpenSSH), multiline."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: false

  # ==== GENERIC SECRET PATTERNS ====
  - name: "generic_hex_secret_32"
    pattern: |-

      \b[0-9A-Fa-f]{32}\b
    replace_with: "[HEX_SECRET_32_REDACTED]"
    description: "32-char hex strings (MD5, etc.). **Opt-in only: High false positive risk.**"
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    opt_in: true
    programmatic_validation: false

  - name: "generic_hex_secret_64"
    pattern: |-

      \b[0-9A-Fa-f]{64}\b
    replace_with: "[HEX_SECRET_64_REDACTED]"
    description: "64-char hex strings (SHA-256, etc.). **Opt-in only: High false positive risk.**"
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    opt_in: true
    programmatic_validation: false

  - name: "generic_token"
    pattern: |-

      \b[A-Za-z0-9\-_]{16,}\b
    replace_with: "[GENERIC_TOKEN_REDACTED]"
    description: "Generic token pattern (e.g. access_token_12345, TOKENXYZ, long alphanumeric strings). **Opt-in only: High false positive risk.**"
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    opt_in: true
    programmatic_validation: false
  
  - name: "password"
    pattern: |-

      \b(?:password|passwd|pwd|pass|secret|token|apikey)[^'"]*['"]([^\s'"]+)['"]
    replace_with: "[PASSWORD_REDACTED]"
    description: "Common key=value patterns for passwords, secrets, and API keys. **Opt-in only: High false positive risk.**"
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    opt_in: true
    programmatic_validation: false


  # ==== IDENTIFIERS & FINANCIAL ====
  - name: "visa_card"
    pattern: "\\b4\\d{3}(?:[- ]?\\d{4}){3}\\b"
    replace_with: "[VISA_REDACTED]"
    description: "Visa credit card numbers (13 or 16 digits, starts with 4), with Luhn check."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: true

  - name: "mastercard_card"
    pattern: "\\b5[1-5]\\d{2}(?:[- ]?\\d{4}){3}\\b"
    replace_with: "[MASTERCARD_REDACTED]"
    description: "Mastercard credit card numbers (16 digits, starts with 51-55), with Luhn check."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: true

  - name: "amex_card"
    pattern: "\\b3[47]\\d{2}[- ]?\\d{6}[- ]?\\d{5}\\b"
    replace_with: "[AMEX_REDACTED]"
    description: "American Express card numbers (15 digits, starts with 34 or 37), with Luhn check."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: true

  - name: "discover_card"
    pattern: "\\b6(?:011|5\\d{2})(?:[- ]?\\d{4}){3}\\b"
    replace_with: "[DISCOVER_REDACTED]"
    description: "Discover card numbers (16 digits, starts with 6011 or 65), with Luhn check."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: true

  - name: "credit_card"
    pattern: "\\b(?:4\\d{3}(?:[- ]?\\d{4}){3}|5[1-5]\\d{2}(?:[- ]?\\d{4}){3}|6(?:011|5\\d{2})(?:[- ]?\\d{4}){3}|3[47]\\d{2}[- ]?\\d{6}[- ]?\\d{5})\\b"
    replace_with: "[CREDIT_CARD_NUMBER_REDACTED]"
    description: "13-16 digit credit card numbers with optional spaces or hyphens (Visa, MasterCard, Amex, Discover - no Luhn check)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: true
    dot_matches_new_line: true
    programmatic_validation: false

  - name: "us_ssn"
    pattern: |-

      \b\d{3}-\d{2}-\d{4}\b
    replace_with: "[US_SSN_REDACTED]"
    description: "US SSN (XXX-XX-XXXX) format. Stricter validation handled in code."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: true

  - name: "uk_nino"
    pattern: |-

      \b[A-CEGHJ-NPR-TW-Z]{2}\s?\d{2}\s?\d{2}\s?\d{2}\s?[A-D]\b
    replace_with: "[UK_NINO_REDACTED]"
    description: "UK National Insurance Number (two letters, six digits, one letter, with optional spaces)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: true
    opt_in: true

  - name: "sa_id"
    pattern: |-

      \b\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\d|3[01])\d{4}[0-1]\d{2}\b
    replace_with: "[SA_ID_REDACTED]"
    description: "South African ID (13 digits: YYMMDDSSSCCZ, format only, no Luhn check)."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  # ==== DEVICE & FILE PATHS ====
  - name: "absolute_linux_path"
    pattern: |-

      /home/[A-Za-z0-9_.-]+((?:/[A-Za-z0-9_.-]+)*)
    replace_with: "~$1"
    description: "Linux absolute path under /home/username."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "absolute_macos_path"
    pattern: |-

      /Users/[A-Za-z0-9_.-]+((?:/[A-Za-z0-9_.-]+)*)
    replace_with: "~$1"
    description: "macOS absolute path under /Users/username."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  - name: "windows_path"
    pattern: |-

      \b(?:[A-Za-z]:\\(?:[^\\\s<>:"/|?*]+\\)*[^\\\s<>:"/|?*]+)\b
    replace_with: "[WINDOWS_PATH_REDACTED]"
    description: "Absolute Windows path with drive letter and subdirectories."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  # ==== Slack Webhook URLs ====
  - name: "slack_webhook_url"
    pattern: |-

      https://hooks.slack.com/services/T[0-9A-Z]{8,}/B[0-9A-Z]{8,}/[a-zA-Z0-9]{24,}
    replace_with: "[SLACK_WEBHOOK_REDACTED]"
    description: "Slack webhook URL token."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false

  # ==== Basic Auth Headers ====
  - name: "http_basic_auth"
    pattern: |-

      Authorization: Basic [A-Za-z0-9+/=]+
    replace_with: "Authorization: Basic [BASIC_AUTH_REDACTED]"
    description: "Base64-encoded HTTP Basic Auth header."
    pattern_type: "regex"
    version: "0.1.8"
    author: "Relay Team"
    created_at: "2025-06-12T00:00:00Z"
    updated_at: "2025-08-11T00:00:00Z"
    multiline: false
    dot_matches_new_line: false
    programmatic_validation: false