Struct PatternSpec 

pub struct PatternSpec {
    pub regex: String,
    pub description: Option<String>,
    pub group: Option<usize>,
    pub required_literals: Vec<String>,
    pub client_safe: bool,
    pub weak_anchor: bool,
    pub structural_password_slot: bool,
}

A regex pattern with optional capture group and description.

Fields

regex: String

Regular expression string (Rust flavor). The owning detector TOML defines its exact separator and quantifier semantics; loading never rewrites the expression.

description: Option<String>

Optional context description.

group: Option<usize>

Optional capture group index containing the secret.

required_literals: Vec<String>

ASCII literals used only for candidate routing. Every full regex match must contain at least one declared literal; detector validation proves that OR-condition from the regex AST before the corpus can load.

client_safe: bool

When true, a match against THIS pattern downgrades the finding to Severity::ClientSafe (regardless of the detector’s nominal severity). Used by services that intentionally ship public-facing keys in client bundles:

• Sentry DSN (the https://<key>@ URL is meant for the browser)
• Stripe pk_live_ / pk_test_ (publishable, sk_ is secret)
• Mapbox pk. (public, sk. is secret)
• Firebase Web API key, Google Maps browser key
• PostHog / Mixpanel / Algolia search / Datadog browser RUM

Per-pattern (not per-detector) so detectors that fire on both the public and the secret prefix can tag only the public one.

Case sensitivity: keyhog compiles every regex case_insensitive(true), so to make a single pattern case-SENSITIVE (AWS AKIA is uppercase, GCP/Snowflake ids are lowercase) prefix its regex with the inline flag (?-i) in the TOML - no schema field needed.

weak_anchor: bool

Keep generic shape and entropy gates active for matches from this pattern. Declare this beside the regex so policy cannot drift when a detector’s patterns are reordered. Detector-level weak_anchor = true applies the same policy to every pattern.

structural_password_slot: bool

Treat matches from this exact regex as syntactically proven password slots. Unlike the detector-level flag, this does not exempt generic keyword-bridge candidates or sibling patterns from Tier-B shape gates.

Implementations

impl PatternSpec

pub fn validate_required_literals(&self) -> Result<(), String>

Validate that the declared routing literals are a necessary OR-condition of every regex match. The proof is conservative: declarations that span optional or structurally ambiguous AST nodes are rejected.

Trait Implementations

impl Clone for PatternSpec

fn clone(&self) -> PatternSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PatternSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for PatternSpec

fn default() -> PatternSpec

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for PatternSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for PatternSpec

fn eq(&self, other: &PatternSpec) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for PatternSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PatternSpec