Package com.tnsai.redaction

Class CredentialPatterns

java.lang.Object
com.tnsai.redaction.CredentialPatterns
public final class CredentialPatterns extends Object
The one definition of the well-known credential shapes, shared by Masker.hidingOutside(java.nio.file.Path) and the default catalog of tnsai-quality's PatternRedactor.

tnsai-quality's catalog has no Slack pattern, so SLACK_TOKEN and SLACK_WEBHOOK are the masker's alone.

Each pattern favours precision: a false positive rewrites ordinary text. PII patterns (e-mail, phone, card numbers, national ids) are not credentials and stay in tnsai-quality.

Since:
0.18.6

  • Field Details

    • OPENAI_API_KEY

      public static final Pattern OPENAI_API_KEY
      OpenAI project (sk-proj-…) and classic (sk-…) keys, not Anthropic's.

    • ANTHROPIC_API_KEY

      public static final Pattern ANTHROPIC_API_KEY
      Anthropic keys (sk-ant-…).

    • GITHUB_PAT

      public static final Pattern GITHUB_PAT
      GitHub fine-grained (github_pat_…), classic (ghp_…), OAuth and app tokens.

    • AWS_ACCESS_KEY

      public static final Pattern AWS_ACCESS_KEY
      AWS access key ids (AKIA…).

    • JWT

      public static final Pattern JWT
      JSON Web Tokens: a header and a payload long enough to look real, then the signature, which an unsigned ("alg":"none") token leaves empty.

    • BEARER_TOKEN

      public static final Pattern BEARER_TOKEN
      Bearer header values, case-insensitive.

    • PRIVATE_KEY_BLOCK

      public static final Pattern PRIVATE_KEY_BLOCK
      PEM (RSA, EC, OPENSSH, PKCS #8 PRIVATE KEY, …) and PGP (PGP PRIVATE KEY BLOCK) private keys, BEGIN to END across lines. A block cut off before its END line runs to the end of the text.

    • SLACK_TOKEN

      public static final Pattern SLACK_TOKEN
      Slack tokens: bot, user and other xox?- tokens, and app-level xapp- tokens.

    • SLACK_WEBHOOK

      public static final Pattern SLACK_WEBHOOK
      Slack incoming-webhook URLs, whose path is the secret.