1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# Tier-B data: credential-context keywords for the entropy scanner.
#
# Schema:
# [credential_context_keywords]
# keywords = ["lowercase-keyword", ...]
#
# Semantics:
# - A high-entropy value whose surrounding line contains ANY of these keywords
# (matched CASE-INSENSITIVELY as a substring via `ci_find_nonempty`) is treated
# as credential-context by `entropy::scanner::keyword_context`: its minimum-length
# floor drops to CREDENTIAL_CONTEXT_MIN_LEN and, only when the MoE is the runtime
# precision authority, canonical-shape generation may lift it.
# - This is the SUBSTRING-anywhere companion to the EXACT assignment-keyword vocab
# (derived from the generic detector specs): the two are ORed. The exact table decides
# `key = value` assignment anchors; this list catches credential words embedded
# anywhere on the line (prose, compound identifiers, non-assignment syntax).
# - Because the match folds case, entries are stored lowercase. They are ASCII and
# may carry `_` or `-` separators, including LEADING separators (`_key`, `-key`,
# `_token`, `-token`, `_secret`, `-secret`) so a compound identifier like
# `access_token` or `db-secret` is recognised by its suffix without a bare `key`/
# `token`/`secret` also matching unrelated words.
# - Substring coverage is intentional: `secret` covers `client_secret`/`secretkey`,
# `token` covers `access_token`/`refresh_token`, and the `_key`/`-key` suffixes
# cover `access_key`/`private_key` without matching the English word "key".
[]
= [
"password",
"passwd",
"pwd",
"db_pass",
"db_password",
"api_key",
"apikey",
"api-key",
"auth",
"authorization",
"bearer",
"_key",
"-key",
"token",
"_token",
"-token",
"secret",
"_secret",
"-secret",
]