systemprompt_security/policy/secrets/
patterns.rs

1//! The built-in secret-pattern table, split from the scanner so each stays
2//! under the file-size ceiling.
3//!
4//! Copyright (c) systemprompt.io — Business Source License 1.1.
5//! See <https://systemprompt.io> for licensing details.
6
7/// One built-in plaintext-credential pattern.
8///
9/// `id` is the persistent referent written into
10/// `governance_decisions.evaluated_rules.pattern_id` and used by dashboards /
11/// SQL aggregations — it must never change. `name` is the human-readable label
12/// rendered in deny messages. `expr` is an anchored regular expression seeded
13/// from the gitleaks (MIT) ruleset: a bare vendor prefix in prose passes, a
14/// full-length credential denies.
15#[derive(Debug, Clone, Copy)]
16pub struct SecretPattern {
17    pub id: &'static str,
18    pub name: &'static str,
19    pub expr: &'static str,
20}
21
22pub const SECRET_PATTERNS: &[SecretPattern] = &[
23    SecretPattern {
24        id: "aws-access-key",
25        name: "AWS Access Key",
26        expr: r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b",
27    },
28    SecretPattern {
29        id: "aws-secret-key",
30        name: "AWS Secret Key",
31        expr: r"(?i)aws_secret_access_key",
32    },
33    SecretPattern {
34        id: "github-token-classic",
35        name: "GitHub Token (classic)",
36        expr: r"\bghp_[A-Za-z0-9]{36,}",
37    },
38    SecretPattern {
39        id: "github-token-fine-grained",
40        name: "GitHub Token (fine-grained)",
41        expr: r"\bgithub_pat_[A-Za-z0-9_]{22,}",
42    },
43    SecretPattern {
44        id: "github-oauth",
45        name: "GitHub OAuth",
46        expr: r"\bgho_[A-Za-z0-9]{36,}",
47    },
48    SecretPattern {
49        id: "github-app-user-to-server",
50        name: "GitHub App User-to-Server",
51        expr: r"\bghu_[A-Za-z0-9]{36,}",
52    },
53    SecretPattern {
54        id: "github-app-server-to-server",
55        name: "GitHub App Server-to-Server",
56        expr: r"\bghs_[A-Za-z0-9]{36,}",
57    },
58    SecretPattern {
59        id: "github-app-refresh",
60        name: "GitHub App Refresh",
61        expr: r"\bghr_[A-Za-z0-9]{36,}",
62    },
63    SecretPattern {
64        id: "gitlab-token",
65        name: "GitLab Token",
66        expr: r"\bglpat-[A-Za-z0-9_\-]{20,}",
67    },
68    SecretPattern {
69        id: "slack-bot-token",
70        name: "Slack Bot Token",
71        expr: r"\bxoxb-[0-9A-Za-z\-]{10,}",
72    },
73    SecretPattern {
74        id: "slack-user-token",
75        name: "Slack User Token",
76        expr: r"\bxoxp-[0-9A-Za-z\-]{10,}",
77    },
78    SecretPattern {
79        id: "slack-webhook",
80        name: "Slack Webhook",
81        expr: r"hooks\.slack\.com/services/T[0-9A-Za-z_]+/B[0-9A-Za-z_]+/[0-9A-Za-z_]+",
82    },
83    SecretPattern {
84        id: "stripe-secret-key",
85        name: "Stripe Secret Key",
86        expr: r"\bsk_live_[A-Za-z0-9]{16,}",
87    },
88    SecretPattern {
89        id: "stripe-restricted-key",
90        name: "Stripe Restricted Key",
91        expr: r"\brk_live_[A-Za-z0-9]{16,}",
92    },
93    SecretPattern {
94        id: "google-api-key",
95        name: "Google API Key",
96        expr: r"\bAIza[0-9A-Za-z_\-]{35}",
97    },
98    SecretPattern {
99        id: "anthropic-api-key",
100        name: "Anthropic API Key",
101        expr: r"\bsk-ant-[A-Za-z0-9_\-]{20,}",
102    },
103    SecretPattern {
104        id: "openai-api-key",
105        name: "OpenAI API Key",
106        expr: r"\bsk-proj-[A-Za-z0-9_\-]{20,}",
107    },
108    SecretPattern {
109        id: "twilio-auth-token",
110        name: "Twilio Auth Token",
111        expr: r"(?i)twilio_auth_token",
112    },
113    SecretPattern {
114        id: "sendgrid-api-key",
115        name: "SendGrid API Key",
116        expr: r"\bSG\.[A-Za-z0-9_\-]{16,}\.[A-Za-z0-9_\-]{16,}",
117    },
118    SecretPattern {
119        id: "mailgun-api-key",
120        name: "Mailgun API Key",
121        expr: r"\bkey-[a-f0-9]{32}\b",
122    },
123    SecretPattern {
124        id: "heroku-api-key",
125        name: "Heroku API Key",
126        expr: r"(?i)heroku_api_key",
127    },
128    SecretPattern {
129        id: "pem-private-key-rsa",
130        name: "RSA Private Key",
131        expr: r"-----BEGIN RSA PRIVATE KEY-----",
132    },
133    SecretPattern {
134        id: "pem-private-key-ec",
135        name: "EC Private Key",
136        expr: r"-----BEGIN EC PRIVATE KEY-----",
137    },
138    SecretPattern {
139        id: "pem-private-key",
140        name: "PEM Private Key",
141        expr: r"-----BEGIN PRIVATE KEY-----",
142    },
143    SecretPattern {
144        id: "generic-password-field",
145        name: "Generic password field",
146        expr: r#"(?i)\bpassword=[^\s&"']+"#,
147    },
148    SecretPattern {
149        id: "generic-secret-field",
150        name: "Generic secret field",
151        expr: r#"(?i)\bsecret=[^\s&"']+"#,
152    },
153    SecretPattern {
154        id: "bearer-token-jwt",
155        name: "Bearer token (JWT)",
156        expr: r"Bearer eyJ[A-Za-z0-9_\-]+",
157    },
158    SecretPattern {
159        id: "jwt-raw",
160        name: "JWT token (raw)",
161        expr: r"\beyJhbGciOi[A-Za-z0-9_\-]+",
162    },
163    SecretPattern {
164        id: "postgres-url-with-password",
165        name: "Postgres URL with password",
166        expr: r"\bpostgres(?:ql)?://[^\s:@/]+:[^\s@/]+@",
167    },
168    SecretPattern {
169        id: "mysql-url-with-password",
170        name: "MySQL URL with password",
171        expr: r"\bmysql://[^\s:@/]+:[^\s@/]+@",
172    },
173    SecretPattern {
174        id: "mongodb-srv-url",
175        name: "MongoDB connection string",
176        expr: r"\bmongodb\+srv://[^\s:@/]+:[^\s@/]+@",
177    },
178    SecretPattern {
179        id: "redis-url-with-auth",
180        name: "Redis URL with auth",
181        expr: r"\bredis://[^\s:@/]+:[^\s@/]+@",
182    },
183];
184
185pub(super) const HIGH_ENTROPY_PATTERN: SecretPattern = SecretPattern {
186    id: "high-entropy-token",
187    name: "High-entropy token (possible credential)",
188    expr: "",
189};
systemprompt_security/policy/secrets/patterns.rs

systemprompt_security/policy/secrets/
patterns.rs
