tirith-core 0.2.11

Terminal security analysis engine - homograph attacks, pipe-to-shell, ANSI injection
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

# Credential detection patterns — single source of truth.
#
# This file drives three consumers (no drift possible):
#   1. build.rs  — generates tier-1 gate fragments
#   2. credential.rs — runtime pattern matching
#   3. redact.rs — evidence redaction
#
# Provider patterns sourced from:
#   - gitleaks (MIT, Copyright 2019 Zachary Rice)
#   - ripsecrets (MIT, Copyright 2021 ripsecrets contributors)

# ── Cloud Providers ──────────────────────────────────────────────────────

[[pattern]]
id = "aws_access_key"
name = "AWS Access Key"
regex = '(?:\bA3T[A-Z0-9]|\bAKIA|\bASIA|\bABIA|\bACCA)[A-Z2-7]{16}\b'
tier1_fragment = '(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z2-7]'
redact_prefix_len = 4
severity = "high"

[[pattern]]
id = "gcp_api_key"
name = "GCP API Key"
regex = '\bAIzaSy[0-9A-Za-z_-]{33}\b'
tier1_fragment = 'AIzaSy'
redact_prefix_len = 6
severity = "high"

# ── Source Control ────────────────────────────────────────────────────────

[[pattern]]
id = "github_pat"
name = "GitHub PAT"
regex = '\bgh[oprsu]_[0-9a-zA-Z]{36}\b'
tier1_fragment = 'gh[oprsu]_[0-9a-zA-Z]'
redact_prefix_len = 4
severity = "high"

[[pattern]]
id = "github_fine_grained_pat"
name = "GitHub Fine-Grained PAT"
regex = '\bgithub_pat_\w{82}\b'
tier1_fragment = 'github_pat_'
redact_prefix_len = 11
severity = "high"

[[pattern]]
id = "gitlab_pat"
name = "GitLab PAT"
regex = '\bglpat-[0-9A-Za-z_=-]{20,22}\b'
tier1_fragment = 'glpat-'
redact_prefix_len = 6
severity = "high"

# ── AI Providers ──────────────────────────────────────────────────────────

[[pattern]]
id = "anthropic_api_key"
name = "Anthropic API Key"
regex = '\bsk-ant-api03-[a-zA-Z0-9_-]{93}AA\b'
tier1_fragment = 'sk-ant-'
redact_prefix_len = 7
severity = "high"

# ── Messaging / Communication ────────────────────────────────────────────

[[pattern]]
id = "slack_token"
name = "Slack Token"
regex = '\bxox[aboprs]-(?:\d+-){2,}[A-Za-z0-9]*[A-Za-z][A-Za-z0-9]*\b'
tier1_fragment = 'xox[aboprs]-'
redact_prefix_len = 5
severity = "high"

[[pattern]]
id = "sendgrid_api_key"
name = "SendGrid API Key"
regex = '\bSG\.[a-zA-Z0-9=_-]{66}\b'
tier1_fragment = 'SG\.'
redact_prefix_len = 3
severity = "high"

[[pattern]]
id = "twilio_api_key"
name = "Twilio API Key"
regex = '\b(?:AC|SK)[0-9a-f]{32}\b'
tier1_fragment = '(?:AC|SK)[0-9a-f]{32}'
redact_prefix_len = 2
severity = "high"

# ── Payment Processing ───────────────────────────────────────────────────

[[pattern]]
id = "stripe_key"
name = "Stripe Key"
regex = '\b(?:sk|rk)_(?:test|live|prod)_[A-Za-z0-9]{16,}\b'
tier1_fragment = '(?:sk|rk)_(?:test|live|prod)_'
redact_prefix_len = 8
severity = "high"

# ── Package Registries ───────────────────────────────────────────────────

[[pattern]]
id = "npm_token"
name = "npm Token"
regex = '\bnpm_[0-9A-Za-z]{36}\b'
tier1_fragment = 'npm_[0-9A-Za-z]'
redact_prefix_len = 4
severity = "high"

# ── Encryption ───────────────────────────────────────────────────────────

[[pattern]]
id = "age_secret_key"
name = "age Secret Key"
regex = '\bAGE-SECRET-KEY-1[0-9A-Z]{58}\b'
tier1_fragment = 'AGE-SECRET-KEY-'
redact_prefix_len = 15
severity = "high"

# ── Private Keys (separate RuleId: PrivateKeyExposed) ────────────────────

[[private_key_pattern]]
id = "private_key"
name = "Private Key Block"
regex = '-----BEGIN\s[A-Z0-9 ]*PRIVATE KEY-----'
tier1_fragment = '-----BEGIN\s'
# Full PEM block regex for redaction (header + base64 body + footer).
# Detection only needs the header; redaction must scrub the entire block.
redact_regex = '-----BEGIN\s[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END\s[A-Z0-9 ]*PRIVATE KEY-----'
severity = "critical"