= "baseline"
= "1.0.0"
= "Sensible governance defaults for any team: secret redaction, auto read mode, 90-day audit expectation"
[]
= "auto"
= 90
[]
# Private key blocks (PEM) — never context material.
= '-----BEGIN [A-Z ]*PRIVATE KEY-----'
# AWS access key ids.
= '\bAKIA[0-9A-Z]{16}\b'
# Generic credential assignments: api_key/secret/password/token = "value"
# (\x27 = single quote, kept out of the TOML literal string).
= '(?i)\b(api[_-]?key|secret|passwd|password|auth[_-]?token)\b\s*[:=]\s*["\x27][^"\x27]{8,}["\x27]'
# Bearer tokens in headers or curl snippets.
= '(?i)\bbearer\s+[a-z0-9_\-\.=]{20,}'