1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# Tier-B credential-keyword vocabulary for the entropy compact-assignment check.
#
# `compact` = the broad credential words a `KEYWORD=<value>` assignment can
# carry (matched byte-exact against the normalized compact form).
# `key_material` = the explicit cryptographic key-material words. This list is the
# SINGLE OWNER shared by BOTH the compact credential-keyword
# membership check (entropy/keywords.rs) AND the entropy
# canonical-shape lift anchors (entropy/scanner.rs
# `KEY_MATERIAL_ANCHORS`), so a new key-material word reaches both
# gates from one place. Drop a word here to extend detection.
#
# Extending either list is Tier-B: add the keyword, rebuild (no code change).
# Both lists MUST stay non-empty (a build-time panic guards that).
= [
"password",
"passwd",
"pwd",
"passphrase",
"token",
"secret",
"credential",
"bearer",
"authorization",
"apikey",
"accesskey",
"authkey",
"clientsecret",
"appsecret",
]
= [
"privatekey",
"signingkey",
"encryptionkey",
"masterkey",
"secretkey",
"sessionkey",
"hmacsalt",
"hmacseed",
"passwordsalt",
"salt",
"nonce",
"seed",
]
# `shape_needles` = the narrow credential-word set the suppression shape gates
# scan for inside a candidate value (TypeScript non-null identifier, dotted
# source identifier). Distinct from `compact` because shape detection needs
# only the words that appear inside identifier names, not the broad assignment
# vocabulary. SINGLE OWNER shared by `looks_like_ts_non_null_identifier` and
# `looks_like_dotted_source_identifier` in suppression::shape.
= [
"token",
"secret",
"key",
"password",
"passwd",
"auth",
"credential",
]