{"ok":true,"engineVersion":"1.3.0","count":50,"rules":[{"id":"CREDIT_CARD","label":"Credit / debit card number (PAN)","severity":"critical","redact":"tail","defaultOn":true,"hint":"Luhn-validated. Never send a PAN to a third-party API or into a prompt.","context":["card","visa","mastercard","amex","american express","discover"]},{"id":"CVV","label":"Card security code (CVV/CVC)","severity":"critical","redact":"all","defaultOn":true},{"id":"IBAN","label":"International bank account number (IBAN)","severity":"high","redact":"tail","defaultOn":true,"context":["iban","bank","account","bic","swift","transfer"]},{"id":"TELEGRAM_BOT_TOKEN","label":"Telegram bot token","severity":"critical","redact":"key","defaultOn":true},{"id":"ABA_ROUTING","label":"US bank routing number (ABA)","severity":"high","redact":"tail","defaultOn":true,"context":["routing","aba","bank","account","ach","wire"]},{"id":"CRYPTO_WALLET","label":"Crypto wallet address","severity":"high","redact":"tail","defaultOn":true,"hint":"Wallet addresses are pseudonymous but permanently linkable.","context":["wallet","address","btc","eth","usdc","transfer"]},{"id":"SSN","label":"US Social Security number","severity":"critical","redact":"all","defaultOn":true,"hint":"An SSN in an outbound API call is a reportable breach in most regimes.","context":["ssn","social security","social sec","tax id","tin"]},{"id":"SSN_KEYWORD","label":"SSN disclosed with keyword (any format)","severity":"critical","redact":"all","defaultOn":true},{"id":"CANADA_SIN","label":"Canadian Social Insurance Number","severity":"critical","redact":"all","defaultOn":true,"context":["sin","social insurance","canada"]},{"id":"UK_NINO","label":"UK National Insurance number","severity":"critical","redact":"all","defaultOn":true,"context":["nino","national insurance","ni number","uk"]},{"id":"US_PASSPORT","label":"US passport number","severity":"high","redact":"all","defaultOn":true,"context":["passport","passport number","travel doc"]},{"id":"NATIONAL_ID","label":"National ID / tax identifier (keyworded)","severity":"high","redact":"tail","defaultOn":true},{"id":"DRIVERS_LICENSE","label":"Driver's licence number (keyworded)","severity":"high","redact":"tail","defaultOn":true},{"id":"EMAIL","label":"Email address","severity":"high","redact":"domain","defaultOn":true},{"id":"PHONE_US","label":"US / CA phone number","severity":"high","redact":"tail","defaultOn":true},{"id":"PHONE_INTL","label":"International phone number","severity":"medium","redact":"tail","defaultOn":true},{"id":"ADDRESS_POSTAL","label":"Postal / ZIP code (keyworded)","severity":"medium","redact":"tail","defaultOn":true},{"id":"STREET_ADDRESS","label":"Street address (keyworded)","severity":"medium","redact":"all","defaultOn":false},{"id":"DOB","label":"Date of birth","severity":"high","redact":"all","defaultOn":true},{"id":"IPV4","label":"IPv4 address","severity":"medium","redact":"ip","defaultOn":true,"hint":"Client IPs are personal data under GDPR. Often the single most common accidental leak."},{"id":"IPV6","label":"IPv6 address","severity":"medium","redact":"ip","defaultOn":false},{"id":"MAC_ADDRESS","label":"MAC / hardware address","severity":"medium","redact":"tail","defaultOn":true},{"id":"PRIVATE_KEY_BLOCK","label":"Private key material (PEM/OpenSSH block)","severity":"critical","redact":"all","defaultOn":true,"hint":"Rotate this key immediately. Detection here is not remediation."},{"id":"AWS_ACCESS_KEY","label":"AWS access key ID","severity":"critical","redact":"key","defaultOn":true},{"id":"AWS_SECRET_KEY","label":"AWS secret access key (keyworded)","severity":"critical","redact":"key","defaultOn":true},{"id":"GITHUB_TOKEN","label":"GitHub token","severity":"critical","redact":"key","defaultOn":true},{"id":"OPENAI_KEY","label":"OpenAI / Anthropic-style API key","severity":"critical","redact":"key","defaultOn":true},{"id":"STRIPE_KEY","label":"Stripe secret / restricted key","severity":"critical","redact":"key","defaultOn":true},{"id":"SLACK_TOKEN","label":"Slack token / webhook","severity":"critical","redact":"key","defaultOn":true},{"id":"GOOGLE_API_KEY","label":"Google API key","severity":"critical","redact":"key","defaultOn":true},{"id":"TWILIO_KEY","label":"Twilio credential","severity":"critical","redact":"key","defaultOn":false},{"id":"HUGGINGFACE_TOKEN","label":"Hugging Face access token","severity":"critical","redact":"key","defaultOn":true},{"id":"SENDGRID_KEY","label":"SendGrid API key","severity":"critical","redact":"key","defaultOn":true},{"id":"NPM_TOKEN","label":"npm access token","severity":"critical","redact":"key","defaultOn":true,"hint":"An npm token is supply-chain root: it can publish malicious versions of your packages."},{"id":"PYPI_TOKEN","label":"PyPI API token","severity":"critical","redact":"key","defaultOn":true},{"id":"GITLAB_TOKEN","label":"GitLab personal/project access token","severity":"critical","redact":"key","defaultOn":true},{"id":"MAILGUN_KEY","label":"Mailgun API key","severity":"critical","redact":"key","defaultOn":true},{"id":"DISCORD_BOT_TOKEN","label":"Discord bot token","severity":"critical","redact":"key","defaultOn":true},{"id":"AZURE_ACCOUNT_KEY","label":"Azure storage AccountKey credential","severity":"critical","redact":"key","defaultOn":true},{"id":"SUPABASE_SECRET","label":"Supabase secret key","severity":"critical","redact":"key","defaultOn":true,"hint":"The sb_publishable_ key is safe to expose; sb_secret_ bypasses RLS entirely."},{"id":"GCP_SERVICE_ACCOUNT","label":"GCP service-account key file","severity":"critical","redact":"all","defaultOn":true},{"id":"CLOUDFLARE_API_TOKEN","label":"Cloudflare API token (keyworded)","severity":"critical","redact":"key","defaultOn":true},{"id":"JWT","label":"JSON Web Token","severity":"critical","redact":"key","defaultOn":true,"hint":"A JWT is a bearer credential. Forwarding it leaks the whole session."},{"id":"BEARER_TOKEN","label":"Bearer / Authorization token","severity":"critical","redact":"key","defaultOn":true},{"id":"CONNECTION_STRING","label":"Database connection string","severity":"critical","redact":"key","defaultOn":true},{"id":"BASIC_AUTH","label":"HTTP Basic credentials in URL","severity":"critical","redact":"key","defaultOn":true,"hint":"user:pass@host in a URL is logged by every proxy it passes through."},{"id":"PASSWORD_KV","label":"Password / secret assignment (keyword blacklist)","severity":"critical","redact":"key","defaultOn":true},{"id":"GENERIC_SECRET","label":"Generic long high-entropy token (keyworded)","severity":"high","redact":"key","defaultOn":true},{"id":"MEDICAL_RECORD","label":"Medical record number","severity":"high","redact":"tail","defaultOn":true},{"id":"SWIFT_BIC","label":"SWIFT / BIC code","severity":"low","redact":"tail","defaultOn":false,"context":["swift","bic","bank code"]}]}