{
  "$schema": "./rules.schema.json",
  "version": "1.4.2",
  "product": "VeilGuard",
  "severities": [
    "low",
    "medium",
    "high",
    "critical"
  ],
  "categories": {
    "pii": {
      "label": "Personal data (PII)",
      "color": "#f59e0b"
    },
    "financial": {
      "label": "Financial data",
      "color": "#f97316"
    },
    "secret": {
      "label": "API keys & tokens",
      "color": "#ef4444"
    },
    "credential": {
      "label": "Passwords & credentials",
      "color": "#dc2626"
    },
    "crypto": {
      "label": "Crypto keys & wallets",
      "color": "#a855f7"
    },
    "network": {
      "label": "Network & infrastructure",
      "color": "#3b82f6"
    },
    "custom": {
      "label": "Custom rules",
      "color": "#64748b"
    },
    "identity": {
      "label": "Government & national IDs",
      "color": "#eab308"
    },
    "phi": {
      "label": "Patient health data (PHI)",
      "color": "#ec4899"
    },
    "confidential": {
      "label": "Contracts & confidential",
      "color": "#14b8a6"
    },
    "classified": {
      "label": "Classified & export-controlled",
      "color": "#be123c"
    }
  },
  "detectors": [
    {
      "id": "email",
      "category": "pii",
      "severity": "medium",
      "name": "Email address",
      "pattern": "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,24}\\b",
      "flags": "g",
      "mask": "partial",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "phone",
      "category": "pii",
      "severity": "medium",
      "name": "Phone number",
      "pattern": "(?<![\\w+])(?:\\+?1[ .-]?)?\\(?[2-9]\\d{2}\\)?[ .-]\\d{3}[ .-]\\d{4}\\b|(?<![\\w+])\\+(?:[2-9]\\d{0,2})[ .-]?\\d{2,4}[ .-]?\\d{3,4}[ .-]?\\d{3,4}\\b",
      "flags": "g",
      "mask": "partial",
      "pack": "core"
    },
    {
      "id": "phone_ctx",
      "category": "pii",
      "severity": "medium",
      "name": "Phone number (labelled)",
      "pattern": "(?<![A-Za-z0-9_])(?:phone|tel\\.?|telephone|mobile|cell(?:phone)?|whatsapp|my number|call me (?:at|on)|text me (?:at|on)|t(?:é|e)l(?:é|e)phone|portable|tel(?:é|e)fono|m(?:ó|o)vil|celular|telefon|handy(?:nummer)?|電話番号|電話|携帯)(?:\\s+(?:number|no\\.?|#|nr\\.?|num(?:é|e)ro|nummer))?(?:\\s+(?:is|was|es|est|ist))?\\s*[:#=]?\\s*(?:は\\s*)?(?<v>\\+?\\(?[0-9][0-9 ().-]{6,18}[0-9])(?![0-9])",
      "flags": "gi",
      "mask": "partial",
      "pack": "core"
    },
    {
      "id": "us_ssn",
      "category": "pii",
      "severity": "critical",
      "name": "US Social Security number",
      "pattern": "(?<![A-Za-z0-9_.-])(?!000|666|9[0-9][0-9])[0-9]{3}([- .])(?!00)[0-9]{2}\\1(?!0000)[0-9]{4}(?![A-Za-z0-9_-]|\\.[0-9])",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "us_ssn_ctx",
      "category": "pii",
      "severity": "critical",
      "name": "US SSN (labelled)",
      "pattern": "(?<![A-Za-z0-9_])(?:ssn|ss#|ss no\\.?|s\\.s\\.n\\.?|social security(?:\\s+(?:number|no\\.?|num|#))?|social|n(?:ú|u)mero de (?:la )?seguridad social|n(?:ú|u)mero de seguro social|seguro social)(?:\\s+(?:is|was|es|number|no\\.?|#))*\\s*[:#=]?\\s*(?<v>[0-9](?:[ .-]{0,3}[0-9]){8})(?![0-9])",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "ssn"
    },
    {
      "id": "uk_nino",
      "category": "pii",
      "severity": "high",
      "name": "UK National Insurance number",
      "pattern": "\\b(?!BG|GB|NK|KN|TN|NT|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] ?\\d{2} ?\\d{2} ?\\d{2} ?[A-D]\\b|(?<![A-Za-z0-9_])(?:[Nn]ational [Ii]nsurance(?: [Nn]umber| [Nn]o\\.?)?|NI(?: number| no\\.?)?|NINO|[Nn]ino)(?:\\s+is)?\\s*[:#=]?\\s*(?!bg|gb|nk|kn|tn|nt|zz)[a-ceghj-pr-tw-z][a-ceghj-npr-tw-z] ?[0-9]{2} ?[0-9]{2} ?[0-9]{2} ?[a-d](?![A-Za-z0-9])",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "passport_ctx",
      "category": "pii",
      "severity": "high",
      "name": "Passport number (labelled)",
      "pattern": "(?<![A-Za-z0-9_])(?:[Pp]assport|PASSPORT|[Rr]eisepass(?:nummer)?|REISEPASS|[Pp]asseport|PASSEPORT|[Pp]asaporte|PASAPORTE|パスポート)(?:\\s*(?:[Nn]umber|NUMBER|[Nn]o\\.?|NO\\.?|[Nn]r\\.?|#|[Nn]ummer|n[º°]|番号))?(?:\\s+(?:is|was|es|est|ist))?\\s*[:#=]?\\s*(?:は\\s*)?(?<v>(?=[A-Z0-9]*[0-9])[A-Z0-9]{6,9})(?![A-Za-z0-9])",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "drivers_license_ctx",
      "category": "pii",
      "severity": "high",
      "name": "Driver's licence (labelled)",
      "pattern": "(?<![A-Za-z0-9_])(?:(?:(?:driver'?s?|driving)\\s+licen[cs]e|f(?:ü|u)hrerschein(?:nummer)?|permis de conduire|licencia de conducir|運転免許証?)(?:\\s*(?:number|no\\.?|nr\\.?|#|nummer|番号))?(?:\\s+(?:is|was|es|est|ist))?\\s*[:#=]?\\s*(?:は\\s*)?|DL\\s*(?:number|no\\.?)?\\s*[:#=]\\s*)(?<v>(?=[A-Z0-9-]*[0-9])[A-Z0-9][A-Z0-9-]{4,15})(?![A-Za-z0-9-])",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "dob_ctx",
      "category": "pii",
      "severity": "medium",
      "name": "Date of birth",
      "pattern": "(?<![A-Za-z0-9_])(?:dob|d\\.o\\.b\\.?|date of birth|birth ?date|birthday|born(?: on)?|fecha de nacimiento|date de naissance|n(?:é|e)e? le|geb\\.?|geboren(?: am)?|geburtsdatum|生年月日|誕生日)(?:\\s+(?:is|was|es|est|ist))?\\s*[:=]?\\s*(?:は\\s*)?(?<v>[0-9]{1,2}[/.-][0-9]{1,2}[/.-][0-9]{2,4}|[0-9]{4}[/.-][0-9]{1,2}[/.-][0-9]{1,2}|[0-9]{4}年[0-9]{1,2}月[0-9]{1,2}日|[0-9]{1,2}(?:st|nd|rd|th)?\\s+(?:of\\s+)?[A-Za-z]{3,9}\\.?,?\\s+[0-9]{4}|[A-Za-z]{3,9}\\.?\\s+[0-9]{1,2}(?:st|nd|rd|th)?,?\\s+[0-9]{4})(?![0-9])",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "street_address",
      "category": "pii",
      "severity": "medium",
      "name": "Street address",
      "pattern": "\\b\\d{1,5}[A-Za-z]? (?:[A-Z][a-z]+ ){1,3}(?:Street|St|Avenue|Ave|Road|Rd|Boulevard|Blvd|Lane|Ln|Drive|Dr|Court|Ct|Way|Place|Pl|Close|Crescent|Terrace|Gardens|Grove|Mews|Square|Sq|Parkway|Pkwy|Highway|Hwy|Circle|Cir|Trail|Terr|Row|Hill)\\.?\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "credit_card",
      "category": "financial",
      "severity": "critical",
      "name": "Payment card number (Visa, Mastercard, Amex, Discover)",
      "pattern": "(?<!\\d)(?:\\d{4}[ -]\\d{6}[ -]\\d{4,5}|\\d{4}(?:[ -]\\d{4}){2,3}(?:[ -]\\d{1,4})?|\\d{12,19}|(?:\\d ){12,18}\\d(?! \\d))(?!\\d)",
      "flags": "g",
      "mask": "partial",
      "validator": "card:major",
      "dnr": true,
      "pack": "finance",
      "context": {
        "pattern": "(?:card|visa|master|amex|american express|discover|jcb|diners|union ?pay|maestro|credit|debit|\\bexp|cvv|cvc|\\bpan\\b|payment|\\bpay|\\bcc\\b|karte|carte|tarjeta|cart[aã]o|kaart)",
        "window": 64,
        "otherwiseSeverity": "high"
      }
    },
    {
      "id": "iban",
      "category": "financial",
      "severity": "high",
      "name": "IBAN bank account",
      "pattern": "\\b[A-Z]{2}\\d{2}(?:[ -]?[A-Z0-9]{4}){2,7}(?:[ -]?[A-Z0-9]{1,4})?\\b",
      "flags": "gi",
      "mask": "partial",
      "validator": "iban",
      "pack": "finance"
    },
    {
      "id": "us_bank_ctx",
      "category": "financial",
      "severity": "high",
      "name": "Bank account number",
      "pattern": "(?<![A-Za-z0-9_])(?:(?:bank|checking|savings|chequing|current)\\s+account|account|acct|a/c|kontonummer|konto|num(?:é|e)ro de compte|n(?:ú|u)mero de cuenta|口座番号)(?:\\s+(?:number|no\\.?|num|#|nr\\.?))?(?:\\s+(?:is|was|es|est|ist))?\\s*[:#=]?\\s*(?:は\\s*)?(?<v>[0-9]{6,17})(?![0-9])",
      "flags": "gi",
      "mask": "partial",
      "pack": "finance"
    },
    {
      "id": "aws_access_key",
      "category": "secret",
      "severity": "critical",
      "name": "AWS access key ID",
      "pattern": "\\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "aws_secret_key",
      "category": "secret",
      "severity": "critical",
      "name": "AWS secret access key",
      "pattern": "(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:aws_secret_access_key|aws_secret_key|aws_secret|secret_access_key|secretaccesskey)[\"']?\\s*[:=]\\s*[\"']?(?<v>[A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "aws_session_token",
      "category": "secret",
      "severity": "high",
      "name": "AWS session token",
      "pattern": "(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:aws_session_token|aws_security_token|session_?token|x-amz-security-token)[\"']?\\s*[:=]\\s*[\"']?(?<v>[A-Za-z0-9/+=]{100,})|\\b(?:IQoJb3JpZ2lu|FwoGZXIvYXdz)[A-Za-z0-9/+=]{60,}",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "aws_bedrock_key",
      "category": "secret",
      "severity": "critical",
      "name": "Amazon Bedrock API key",
      "pattern": "\\bABSK[A-Za-z0-9+/]{109,269}={0,2}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "github_token",
      "category": "secret",
      "severity": "critical",
      "name": "GitHub token",
      "pattern": "\\b(?:gh[pousr]_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255})\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "gitlab_token",
      "category": "secret",
      "severity": "critical",
      "name": "GitLab token",
      "pattern": "\\b(?:gl(?:pat|dt|rt|ptt|soat|cbt|ffct|ft|imt|oas|agent)-[A-Za-z0-9_-]{20,}|GR1348941[A-Za-z0-9_-]{20})",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "openai_key",
      "category": "secret",
      "severity": "critical",
      "name": "OpenAI API key",
      "pattern": "\\bsk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\\b|\\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{40,}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "anthropic_key",
      "category": "secret",
      "severity": "critical",
      "name": "Anthropic API key or OAuth token",
      "pattern": "\\bsk-ant-(?:api|admin|oat|ort)\\d{2}-[A-Za-z0-9_-]{80,}",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "groq_key",
      "category": "secret",
      "severity": "critical",
      "name": "Groq API key",
      "pattern": "\\bgsk_[A-Za-z0-9]{52}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "xai_key",
      "category": "secret",
      "severity": "critical",
      "name": "xAI (Grok) API key",
      "pattern": "\\bxai-[A-Za-z0-9_]{80}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "perplexity_key",
      "category": "secret",
      "severity": "critical",
      "name": "Perplexity API key",
      "pattern": "\\bpplx-[A-Za-z0-9]{48}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "openrouter_key",
      "category": "secret",
      "severity": "critical",
      "name": "OpenRouter API key",
      "pattern": "\\bsk-or-v1-[a-f0-9]{64}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "replicate_token",
      "category": "secret",
      "severity": "critical",
      "name": "Replicate API token",
      "pattern": "\\br8_[A-Za-z0-9_-]{37}(?![A-Za-z0-9_-])",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "elevenlabs_key",
      "category": "secret",
      "severity": "critical",
      "name": "ElevenLabs API key",
      "pattern": "\\bsk_[a-f0-9]{48}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "langsmith_key",
      "category": "secret",
      "severity": "critical",
      "name": "LangSmith API key",
      "pattern": "\\blsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "pinecone_key",
      "category": "secret",
      "severity": "critical",
      "name": "Pinecone API key",
      "pattern": "\\bpcsk_[A-Za-z0-9]{5,6}_[A-Za-z0-9]{63}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "supabase_token",
      "category": "secret",
      "severity": "critical",
      "name": "Supabase access token or secret key",
      "pattern": "\\bsbp_[a-z0-9]{40}\\b|\\bsb_secret_[A-Za-z0-9_-]{20,}",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "vercel_token",
      "category": "secret",
      "severity": "high",
      "name": "Vercel token",
      "pattern": "\\bvc[pikar]_[A-Za-z0-9]{24,}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "entropy:3.0"
    },
    {
      "id": "stripe_webhook_secret",
      "category": "secret",
      "severity": "critical",
      "name": "Stripe webhook signing secret",
      "pattern": "\\bwhsec_[A-Za-z0-9+/=]{32,}",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "slack_app_token",
      "category": "secret",
      "severity": "critical",
      "name": "Slack app-level token",
      "pattern": "\\bxapp-\\d-[A-Za-z0-9]+-\\d+-[a-z0-9]+",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "discord_bot_token",
      "category": "secret",
      "severity": "high",
      "name": "Discord bot token",
      "pattern": "\\b[MNO][A-Za-z\\d_-]{23,25}\\.[A-Za-z\\d_-]{6}\\.[A-Za-z\\d_-]{27,38}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "pypi_token",
      "category": "secret",
      "severity": "critical",
      "name": "PyPI upload token",
      "pattern": "\\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "docker_pat",
      "category": "secret",
      "severity": "critical",
      "name": "Docker Hub access token",
      "pattern": "\\bdckr_(?:pat_[A-Za-z0-9_-]{27}|oat_[A-Za-z0-9_-]{32})(?![A-Za-z0-9_-])",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "azure_ad_client_secret",
      "category": "secret",
      "severity": "critical",
      "name": "Microsoft Entra ID (Azure AD) client secret",
      "pattern": "(?<![A-Za-z0-9_~.])[A-Za-z0-9_~.]{3}\\dQ~[A-Za-z0-9_~.-]{31,34}(?![A-Za-z0-9_~.-])",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "azure_sas",
      "category": "secret",
      "severity": "high",
      "name": "Azure shared access signature (SAS)",
      "pattern": "[?&]sv=\\d{4}-\\d{2}-\\d{2}&[^\\s\"'<>]{0,300}?\\bsig=[A-Za-z0-9%/+]{40,}(?:%3D|=){0,2}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "google_oauth_token",
      "category": "secret",
      "severity": "high",
      "name": "Google OAuth access token",
      "pattern": "\\bya29\\.[A-Za-z0-9_-]{50,}",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "age_secret_key",
      "category": "secret",
      "severity": "critical",
      "name": "age encryption secret key",
      "pattern": "AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "shopify_token",
      "category": "secret",
      "severity": "critical",
      "name": "Shopify access token or shared secret",
      "pattern": "\\bshp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "dnr": true
    },
    {
      "id": "databricks_token",
      "category": "secret",
      "severity": "critical",
      "name": "Databricks access token",
      "pattern": "\\bdapi[a-f0-9]{32}(?:-\\d)?\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "doppler_token",
      "category": "secret",
      "severity": "critical",
      "name": "Doppler token",
      "pattern": "\\bdp\\.pt\\.[A-Za-z0-9]{43}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "vault_token",
      "category": "secret",
      "severity": "critical",
      "name": "HashiCorp Vault token",
      "pattern": "\\bhv[sbr]\\.[A-Za-z0-9_-]{90,}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "pulumi_token",
      "category": "secret",
      "severity": "critical",
      "name": "Pulumi access token",
      "pattern": "\\bpul-[a-f0-9]{40}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "postman_key",
      "category": "secret",
      "severity": "critical",
      "name": "Postman API key",
      "pattern": "\\bPMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "linear_key",
      "category": "secret",
      "severity": "critical",
      "name": "Linear API key",
      "pattern": "\\blin_api_[A-Za-z0-9]{40}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "notion_token",
      "category": "secret",
      "severity": "critical",
      "name": "Notion integration token",
      "pattern": "\\bntn_\\d{11}[A-Za-z0-9]{35}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "onepassword_token",
      "category": "secret",
      "severity": "critical",
      "name": "1Password service account token",
      "pattern": "\\bops_eyJ[A-Za-z0-9+/]{250,}={0,3}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "mailgun_key",
      "category": "secret",
      "severity": "high",
      "name": "Mailgun API key",
      "pattern": "\\bmailgun[\\w.-]{0,30}[\"']?\\s*[:=,]\\s*[\"']?key-[a-f0-9]{32}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "google_api_key",
      "category": "secret",
      "severity": "high",
      "name": "Google API key",
      "pattern": "\\bAIza[0-9A-Za-z_-]{35}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "google_oauth_secret",
      "category": "secret",
      "severity": "critical",
      "name": "Google OAuth client secret",
      "pattern": "\\bGOCSPX-[A-Za-z0-9_-]{28}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "slack_token",
      "category": "secret",
      "severity": "critical",
      "name": "Slack token",
      "pattern": "\\bxox[abposre]-[A-Za-z0-9-]{10,}|\\bxoxe\\.xox[bp]-\\d-[A-Za-z0-9]{100,}",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "slack_webhook",
      "category": "secret",
      "severity": "high",
      "name": "Slack webhook URL",
      "pattern": "https://hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{20,}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "stripe_key",
      "category": "secret",
      "severity": "critical",
      "name": "Stripe secret key",
      "pattern": "\\b(?:sk|rk)_(?:live|prod)_[A-Za-z0-9]{20,}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "twilio_key",
      "category": "secret",
      "severity": "high",
      "name": "Twilio API key",
      "pattern": "\\bSK[0-9a-f]{32}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "sendgrid_key",
      "category": "secret",
      "severity": "critical",
      "name": "SendGrid API key",
      "pattern": "\\bSG\\.[A-Za-z0-9_-]{22}\\.[A-Za-z0-9_-]{43}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "huggingface_token",
      "category": "secret",
      "severity": "high",
      "name": "Hugging Face token",
      "pattern": "\\b(?:hf_[A-Za-z0-9]{34,}|api_org_[A-Za-z]{34})\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "npm_token",
      "category": "secret",
      "severity": "high",
      "name": "npm access token",
      "pattern": "\\bnpm_[A-Za-z0-9]{36}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "telegram_bot",
      "category": "secret",
      "severity": "high",
      "name": "Telegram bot token",
      "pattern": "\\b\\d{8,10}:AA[A-Za-z0-9_-]{33}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "discord_webhook",
      "category": "secret",
      "severity": "high",
      "name": "Discord webhook URL",
      "pattern": "https://(?:ptb\\.|canary\\.)?discord(?:app)?\\.com/api/webhooks/\\d+/[A-Za-z0-9_-]{50,}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "azure_conn_string",
      "category": "secret",
      "severity": "critical",
      "name": "Azure / SQL connection string with key or password",
      "pattern": "DefaultEndpointsProtocol=https?;AccountName=[^;\\s]+;AccountKey=[A-Za-z0-9+/=]{40,}|Endpoint=sb://[^;\\s]+;SharedAccessKeyName=[^;\\s]+;SharedAccessKey=[A-Za-z0-9+/=]{40,}|AccountEndpoint=https://[^;\\s]+;AccountKey=[A-Za-z0-9+/=]{40,}|\\b(?:Server|Data Source)=[^;\\n]{1,200};(?:[^;\\n]{0,200};){0,8}?\\s*(?:Password|Pwd)=[^;\\s]{4,}",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "jwt",
      "category": "secret",
      "severity": "high",
      "name": "JSON Web Token",
      "pattern": "\\beyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "core"
    },
    {
      "id": "bearer_token",
      "category": "secret",
      "severity": "high",
      "name": "Bearer token",
      "pattern": "\\b[Bb]earer\\s+[A-Za-z0-9._~+/-]{24,}=*",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "private_key_pem",
      "category": "secret",
      "severity": "critical",
      "name": "Private key (PEM / PuTTY), incl. truncated pastes",
      "pattern": "-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----(?:[\\s\\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----|(?:[A-Za-z0-9+/=: \\t\\r\\n-]|\\\\n)*)|PuTTY-User-Key-File-\\d+: [^\\n]+(?:\\r?\\n[^\\n]+)*",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "generic_api_key",
      "category": "secret",
      "severity": "high",
      "name": "Generic API key / secret assignment",
      "pattern": "(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:api[_-]?key|apikey|secret(?:[_-]?key)?|client[_-]?secret|access[_-]?token|auth[_-]?token|refresh[_-]?token|private[_-]?key|signing[_-]?key|webhook[_-]?secret|x-api-key|xi-api-key)[\"']?\\s*[:=]\\s*[\"'`]?(?<v>[A-Za-z0-9_\\-./+=~]{16,})",
      "flags": "gi",
      "mask": "full",
      "validator": "secret:3.0",
      "pack": "core"
    },
    {
      "id": "api_key_prose",
      "category": "secret",
      "severity": "high",
      "name": "API key or token written in a sentence",
      "pattern": "(?<![A-Za-z0-9_])(?:api[ _-]?keys?|apikeys?|api[ _-]?tokens?|secret[ _-]?keys?|access[ _-]?tokens?|auth[ _-]?tokens?|bearer[ _-]?tokens?|private[ _-]?keys?|(?:openai|open ai|anthropic|claude|gemini|google|aws|azure|gcp|github|gitlab|stripe|slack|twilio|sendgrid|mistral|groq|cohere|deepseek|hugging ?face|hf|perplexity|xai|grok|replicate|pinecone|supabase|vercel|cloudflare|heroku|npm|pypi|docker|discord|telegram|notion|linear|shopify|firebase|mapbox|openrouter)(?:[ _-]?api)?[ _-]?(?:keys?|tokens?|secrets?)|clave (?:de (?:la )?)?api|cl(?:é|e)s? (?:d'|de l'|de )?api|api[ -]?schl(?:ü|u)ssel|api ?キー|アクセストークン)(?:\\s+(?:is|was|for|of|here|my|our|the|new|test|prod|dev|staging|live|token|value|es|est|ist|de|la|el)){0,3}\\s*[:=]?\\s*[\"'`]?(?<v>(?=[A-Za-z0-9_\\-./+=~]*[0-9_\\-])[A-Za-z0-9][A-Za-z0-9_\\-./+=~]{11,})",
      "flags": "gi",
      "mask": "full",
      "validator": "secret:2.5",
      "pack": "core"
    },
    {
      "id": "secret_prose",
      "category": "secret",
      "severity": "high",
      "name": "Token or secret written in a sentence",
      "pattern": "(?<![A-Za-z0-9_])(?:tokens?|secrets?|client[ _-]?secret|credentials?|creds|passkey|licen[cs]e[ _-]?key|product[ _-]?key|recovery[ _-]?(?:key|code)|backup[ _-]?codes?|session[ _-]?(?:id|token|cookie))(?:\\s+(?:is|was|for|of|here|my|our|the|new|test|prod|dev|staging|live|token|value|es|est|ist|de|la|el)){0,3}\\s*[:=]?\\s*[\"'`]?(?<v>(?=[A-Za-z0-9_\\-./+=~]*[0-9])(?=[A-Za-z0-9_\\-./+=~]*[A-Za-z])[A-Za-z0-9][A-Za-z0-9_\\-./+=~]{7,})",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "secret:2.5"
    },
    {
      "id": "db_url_creds",
      "category": "credential",
      "severity": "critical",
      "name": "Database URL with password",
      "pattern": "\\b(?:postgres(?:ql)?|mysql|mongodb(?:\\+srv)?|redis|amqp|mssql|sqlserver)://[^\\s:/@]+:[^\\s@/]+@[^\\s/]+",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "url_basic_auth",
      "category": "credential",
      "severity": "high",
      "name": "Credentials embedded in URL",
      "pattern": "\\b(?:https?|ftps?|sftp|smtps?|ldaps?|ssh|rediss?|amqps?|jdbc:[a-z]+)://[^\\s:/@]+:[^\\s@/]{3,}@[^\\s/]+",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "password_assign",
      "category": "credential",
      "severity": "critical",
      "name": "Password",
      "pattern": "(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:password|passwd|pwd|passcode|pass_?phrase)[\"']?(?:\\s*[:=]\\s*[\"'`]?|\\s+is\\s+[\"'`])(?<v>(?!/)[^\\s\"'`,;]{6,})",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "password"
    },
    {
      "id": "password_prose",
      "category": "credential",
      "severity": "critical",
      "name": "Password (written in a sentence)",
      "pattern": "(?<![A-Za-z0-9_])(?:password|passwd|pwd|pw|pass|passcode|passphrase|passwort|kennwort|contrase(?:ñ|n)a|clave|mot de passe|mdp|パスワード)(?:\\s+(?:for|to|on|of|f(?:ü|u)r|para|pour|de|du)\\s+(?:(?:my|the|our|mi|la|el|mon|ma|le|mein|meine|das|die|der)\\s+)?[A-Za-z0-9._@-]{1,40})?(?:\\s*[:=]\\s*|\\s+(?:is|was|es|est|ist|lautet)\\s+(?:now\\s+)?|\\s*は\\s*|\\s+(?=[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]*[A-Za-z])(?=[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]*[0-9]))[\"'`]?(?<v>(?![$%{<(_./])(?=[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]*[0-9!#$%&*+=?@^~])[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]{6,64})",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "password"
    },
    {
      "id": "credentials_pair",
      "category": "credential",
      "severity": "critical",
      "name": "Username and password pair",
      "pattern": "(?<![A-Za-z0-9_])(?:creds|credentials|login(?:\\s*/\\s*pass(?:word)?)?|user(?:name)?\\s*/\\s*pass(?:word)?)\\s*[:=]\\s*[^\\s/:]{1,64}(?:\\s*/\\s*|:)[\"'`]?(?<v>(?![$%{<(_./])(?=[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]*[A-Za-z])(?=[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]*[0-9!#$%&*+=?@^~])[A-Za-z0-9!#$%&()*+./<=>?@^_{|}~\\[\\]\\\\-]{6,64})",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "password"
    },
    {
      "id": "pin_ctx",
      "category": "credential",
      "severity": "high",
      "name": "PIN or passcode",
      "pattern": "(?<![A-Za-z0-9_])(?:(?:pin|cvv2?|cvc)\\s*(?:[:=]|\\s(?:is|was|es|est|ist|lautet)\\s|は)\\s*|(?:passcode|pass code|pin[ -]?code|pin number|code pin|暗証番号|(?:my|bank|card|atm|debit|sim)\\s+pin)(?:\\s*(?:[:=]|\\s(?:is|was|es|est|ist|lautet)\\s|は)\\s*|\\s+))[\"']?(?<v>[0-9]{3,8})(?![0-9])",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "eth_private_key",
      "category": "crypto",
      "severity": "critical",
      "name": "Ethereum / EVM private key",
      "pattern": "\\b(?:0x)?[0-9a-fA-F]{64}\\b",
      "flags": "g",
      "mask": "full",
      "validator": "entropy:3.0",
      "context": {
        "pattern": "(?:0x|priv|private|secret|wallet|\\bpk\\b|mnemonic|seed|signer|keystore|keypair)",
        "window": 48,
        "otherwiseSeverity": "low"
      },
      "pack": "web3"
    },
    {
      "id": "btc_wif",
      "category": "crypto",
      "severity": "critical",
      "name": "Bitcoin WIF private key",
      "pattern": "\\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "web3",
      "validator": "base58check:wif"
    },
    {
      "id": "xprv",
      "category": "crypto",
      "severity": "critical",
      "name": "Extended private key (xprv)",
      "pattern": "\\b[xyzt]prv[1-9A-HJ-NP-Za-km-z]{100,112}\\b",
      "flags": "g",
      "mask": "full",
      "dnr": true,
      "pack": "web3",
      "validator": "base58check:xprv"
    },
    {
      "id": "nostr_nsec",
      "category": "crypto",
      "severity": "critical",
      "name": "Nostr private key (nsec)",
      "pattern": "\\bnsec1[02-9ac-hj-np-z]{58}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "web3",
      "dnr": true
    },
    {
      "id": "solana_private_key",
      "category": "crypto",
      "severity": "critical",
      "name": "Solana private key",
      "pattern": "\\b[1-9A-HJ-NP-Za-km-z]{86,88}\\b",
      "flags": "g",
      "mask": "full",
      "validator": "entropy:4.5",
      "context": {
        "pattern": "(?:0x|priv|private|secret|wallet|\\bpk\\b|mnemonic|seed|signer|keystore|keypair)",
        "window": 48,
        "otherwiseSeverity": "low"
      },
      "pack": "web3"
    },
    {
      "id": "seed_phrase",
      "category": "crypto",
      "severity": "critical",
      "name": "Wallet recovery (seed) phrase (BIP-39, 10 languages)",
      "pattern": "\\b(?:[a-z]{3,8}\\s+){11,23}[a-z]{3,8}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "bip39",
      "pack": "web3"
    },
    {
      "id": "eth_address",
      "category": "crypto",
      "severity": "low",
      "name": "Crypto wallet address",
      "pattern": "\\b0x[0-9a-fA-F]{40}\\b|\\bbc1[02-9ac-hj-np-z]{25,62}\\b",
      "flags": "g",
      "mask": "partial",
      "pack": "web3"
    },
    {
      "id": "ipv4_private",
      "category": "network",
      "severity": "low",
      "name": "Internal IP address",
      "pattern": "\\b(?:10\\.(?:\\d{1,3}\\.){2}\\d{1,3}|192\\.168\\.\\d{1,3}\\.\\d{1,3}|172\\.(?:1[6-9]|2\\d|3[01])\\.\\d{1,3}\\.\\d{1,3})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "internal_hostname",
      "category": "network",
      "severity": "low",
      "name": "Internal hostname",
      "pattern": "\\b[a-z0-9-]+(?:\\.[a-z0-9-]+)*\\.(?:internal|corp|local|lan|intranet)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "credit_card_other",
      "category": "financial",
      "severity": "critical",
      "name": "Payment card number (JCB, Diners, UnionPay, Maestro, Mir)",
      "pattern": "(?<!\\d)(?:\\d{4}[ -]\\d{6}[ -]\\d{4,5}|\\d{4}(?:[ -]\\d{4}){2,3}(?:[ -]\\d{1,4})?|\\d{12,19}|(?:\\d ){12,18}\\d(?! \\d))(?!\\d)",
      "flags": "g",
      "mask": "partial",
      "validator": "card:other",
      "pack": "finance",
      "context": {
        "pattern": "(?:card|visa|master|amex|american express|discover|jcb|diners|union ?pay|maestro|credit|debit|\\bexp|cvv|cvc|\\bpan\\b|payment|\\bpay|\\bcc\\b|karte|carte|tarjeta|cart[aã]o|kaart)",
        "window": 64,
        "otherwiseSeverity": "high"
      }
    },
    {
      "id": "card_track_data",
      "category": "financial",
      "severity": "critical",
      "name": "Card magnetic-stripe (track) data",
      "pattern": "%B\\d{13,19}\\^[^^]{2,26}\\^\\d{4}|;\\d{13,19}=\\d{4}\\d*\\?",
      "flags": "g",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "card_expiry",
      "category": "financial",
      "severity": "medium",
      "name": "Card expiry date",
      "pattern": "\\b(?:exp(?:iry|iration)?(?: date)?|valid (?:thru|through)|expires)\\s*[:=]?\\s*(?:0[1-9]|1[0-2])\\s*/\\s*(?:\\d{2}|20\\d{2})\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "swift_bic",
      "category": "financial",
      "severity": "high",
      "name": "SWIFT / BIC code",
      "pattern": "\\b(?:[Ss][Ww][Ii][Ff][Tt]|[Bb][Ii][Cc])(?: [Cc][Oo][Dd][Ee])?\\s*[:#=]?\\s*(?<v>[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\\b",
      "flags": "g",
      "mask": "full",
      "pack": "finance",
      "validator": "bic"
    },
    {
      "id": "aba_routing",
      "category": "financial",
      "severity": "high",
      "name": "US bank routing number (ABA)",
      "pattern": "(?<![A-Za-z0-9_])(?:routing|aba|rtn)(?: number| no\\.?| #)?(?:\\s+(?:is|was))?\\s*[:#=]?\\s*[0-9]{9}(?![0-9])",
      "flags": "gi",
      "mask": "partial",
      "validator": "aba",
      "pack": "finance"
    },
    {
      "id": "uk_sort_code",
      "category": "financial",
      "severity": "high",
      "name": "UK sort code & account",
      "pattern": "\\bsort ?code\\s*[:#=]?\\s*\\d{2}-?\\d{2}-?\\d{2}(?:[,;\\s]+(?:a/?c|account)(?: no\\.?| number)?\\s*[:#=]?\\s*\\d{8})?",
      "flags": "gi",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "us_ein",
      "category": "financial",
      "severity": "high",
      "name": "US employer tax ID (EIN)",
      "pattern": "\\b(?:ein|fein|tax id|tin|employer id(?:entification)?(?: number)?)\\s*[:#=]?\\s*\\d{2}-\\d{7}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "vat_number",
      "category": "financial",
      "severity": "medium",
      "name": "VAT registration number",
      "pattern": "\\b[Vv][Aa][Tt](?: [Rr][Ee][Gg](?:[Ii][Ss][Tt][Rr][Aa][Tt][Ii][Oo][Nn])?)?(?: [Nn][Oo]\\.?| [Nn][Uu][Mm][Bb][Ee][Rr]| [Ii][Dd])?\\s*[:#=]?\\s*(?<v>[A-Z]{2}(?=[A-Z0-9]*\\d)[A-Z0-9]{8,12})\\b",
      "flags": "g",
      "mask": "partial",
      "pack": "finance"
    },
    {
      "id": "salary_comp",
      "category": "financial",
      "severity": "medium",
      "name": "Salary / compensation figure",
      "pattern": "\\b(?:salary|annual comp(?:ensation)?|base pay|total comp|bonus|payroll)\\b[^\\n.]{0,30}?[$£€]\\s?\\d{1,3}(?:,\\d{3})+(?:\\.\\d{2})?",
      "flags": "gi",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "invoice_bank_change",
      "category": "financial",
      "severity": "high",
      "name": "Payment instruction change (BEC risk)",
      "pattern": "\\b(?:updated?|new|changed?)\\s+(?:bank(?:ing)?|wire|remittance|payment)\\s+(?:details|instructions|account)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "finance"
    },
    {
      "id": "us_itin",
      "category": "identity",
      "severity": "critical",
      "name": "US ITIN",
      "pattern": "(?<![A-Za-z0-9_-])9[0-9]{2}([- ])(?:5[0-9]|6[0-5]|7[0-9]|8[0-8]|9[0-24-9])\\1[0-9]{4}(?![A-Za-z0-9_-])|(?<![A-Za-z0-9_])(?:itin|individual taxpayer identification number)(?:\\s+(?:is|was|number|no\\.?|#))*\\s*[:#=]?\\s*9[0-9]{2}[- ]?(?:5[0-9]|6[0-5]|7[0-9]|8[0-8]|9[0-24-9])[- ]?[0-9]{4}(?![0-9])",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "canada_sin",
      "category": "identity",
      "severity": "critical",
      "name": "Canadian Social Insurance Number",
      "pattern": "(?<![A-Za-z0-9_])(?:sin|social insurance(?: number| no\\.?)?|num(?:é|e)ro d'assurance sociale|nas)(?:\\s+(?:is|was|est))?\\s*[:#=]?\\s*[0-9]{3}[ -]?[0-9]{3}[ -]?[0-9]{3}(?![0-9])",
      "flags": "gi",
      "mask": "full",
      "validator": "sin",
      "pack": "core"
    },
    {
      "id": "aus_tfn",
      "category": "identity",
      "severity": "critical",
      "name": "Australian Tax File Number",
      "pattern": "\\b(?:tfn|tax file(?: number| no\\.?)?)\\s*[:#=]?\\s*\\d{3}[ -]?\\d{3}[ -]?\\d{2,3}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "au_tfn"
    },
    {
      "id": "india_aadhaar",
      "category": "identity",
      "severity": "critical",
      "name": "Aadhaar number",
      "pattern": "\\baadhaa?r(?: no\\.?| number)?\\s*[:#=]?\\s*[2-9]\\d{3}\\s?\\d{4}\\s?\\d{4}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "core",
      "validator": "verhoeff"
    },
    {
      "id": "national_id_ctx",
      "category": "identity",
      "severity": "high",
      "name": "National ID number (labelled)",
      "pattern": "\\b(?:[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd]|[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy]|[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Ff][Ii][Cc][Aa][Tt][Ii][Oo][Nn]|[Ii][Dd] [Cc][Aa][Rr][Dd]|[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Cc][Aa][Rr][Dd]|[Cc][Ii][Tt][Ii][Zz][Ee][Nn] [Ii][Dd]|[Cc][Oo][Dd][Ii][Cc][Ee] [Ff][Ii][Ss][Cc][Aa][Ll][Ee])(?: [Nn][Oo]\\.?| [Nn][Uu][Mm][Bb][Ee][Rr]| #)?\\s*[:#=]\\s*(?<v>(?=[A-Z0-9 .-]*\\d)[A-Z0-9][A-Z0-9 .-]{5,18}[A-Z0-9])\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "passport_mrz",
      "category": "identity",
      "severity": "critical",
      "name": "Passport machine-readable zone",
      "pattern": "\\bP[A-Z<][A-Z]{3}[A-Z<]{30,39}\\s*[A-Z0-9<]{9}\\d[A-Z]{3}\\d{6}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "de_steuer_id",
      "category": "identity",
      "severity": "critical",
      "name": "German tax ID (Steuer-ID)",
      "pattern": "\\b(?:steuer-?id(?:entifikationsnummer)?|steuerliche identifikationsnummer|identifikationsnummer|steuer-?identnummer|idnr|tax id(?:entification number)?|tin)\\.?(?: ?nr\\.?| no\\.?| number)?\\s*[:#=]?\\s*[1-9]\\d ?\\d{3} ?\\d{3} ?\\d{3}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "de_steuerid",
      "pack": "core"
    },
    {
      "id": "fr_nir",
      "category": "identity",
      "severity": "critical",
      "name": "French social security number (NIR)",
      "pattern": "\\b[12] ?\\d{2} ?(?:0[1-9]|1[0-2]|[2-9]\\d) ?(?:\\d{2}|2[AB]) ?\\d{3} ?\\d{3} ?\\d{2}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "fr_nir",
      "pack": "core"
    },
    {
      "id": "es_dni",
      "category": "identity",
      "severity": "critical",
      "name": "Spanish DNI",
      "pattern": "\\b\\d{8}-?[A-Z]\\b",
      "flags": "g",
      "mask": "full",
      "validator": "es_dni",
      "pack": "core"
    },
    {
      "id": "es_nie",
      "category": "identity",
      "severity": "critical",
      "name": "Spanish foreigner ID (NIE)",
      "pattern": "\\b[XYZ]-?\\d{7}-?[A-Z]\\b",
      "flags": "g",
      "mask": "full",
      "validator": "es_dni",
      "pack": "core"
    },
    {
      "id": "it_codice_fiscale",
      "category": "identity",
      "severity": "critical",
      "name": "Italian tax code (codice fiscale)",
      "pattern": "\\b[A-Z]{6}[0-9LMNP-V]{2}[A-EHLMPR-T][0-9LMNP-V]{2}[A-Z][0-9LMNP-V]{3}[A-Z]\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "it_cf",
      "pack": "core"
    },
    {
      "id": "nl_bsn",
      "category": "identity",
      "severity": "critical",
      "name": "Dutch citizen service number (BSN)",
      "pattern": "\\b(?:bsn|burger ?service ?nummer|sofi-?nummer|citizen service number)(?: ?nr\\.?| no\\.?| number| nummer)?\\s*[:#=]?\\s*(?:\\d{9}|\\d{4}\\.\\d{2}\\.\\d{3}|\\d{3} \\d{3} \\d{3})\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "nl_bsn",
      "pack": "core"
    },
    {
      "id": "pl_pesel",
      "category": "identity",
      "severity": "critical",
      "name": "Polish PESEL number",
      "pattern": "\\bpesel(?: ?nr\\.?| no\\.?| number)?\\s*[:#=]?\\s*\\d{11}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "pl_pesel",
      "pack": "core"
    },
    {
      "id": "br_cpf",
      "category": "identity",
      "severity": "critical",
      "name": "Brazilian CPF",
      "pattern": "\\b\\d{3}\\.\\d{3}\\.\\d{3}-\\d{2}\\b|\\bcpf(?: n[º°o]\\.?| number| no\\.?)?\\s*[:#=]?\\s*\\d{11}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "br_cpf",
      "pack": "core"
    },
    {
      "id": "br_cnpj",
      "category": "financial",
      "severity": "high",
      "name": "Brazilian company ID (CNPJ)",
      "pattern": "\\b[0-9A-Z]{2}\\.[0-9A-Z]{3}\\.[0-9A-Z]{3}/[0-9A-Z]{4}-\\d{2}\\b|\\bcnpj(?: n[º°o]\\.?| number| no\\.?)?\\s*[:#=]?\\s*[0-9A-Z]{12}\\d{2}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "br_cnpj",
      "pack": "finance"
    },
    {
      "id": "mx_curp",
      "category": "identity",
      "severity": "critical",
      "name": "Mexican CURP",
      "pattern": "\\b[A-Z][AEIOUX][A-Z]{2}\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])[HMX](?:AS|BC|BS|CC|CL|CM|CS|CH|DF|DG|GT|GR|HG|JC|MC|MN|MS|NT|NL|OC|PL|QT|QR|SP|SL|SR|TC|TS|TL|VZ|YN|ZS|NE)[B-DF-HJ-NP-TV-Z]{3}[A-Z\\d]\\d\\b",
      "flags": "g",
      "mask": "full",
      "validator": "mx_curp",
      "pack": "core"
    },
    {
      "id": "sg_nric",
      "category": "identity",
      "severity": "critical",
      "name": "Singapore NRIC / FIN",
      "pattern": "\\b[STFGM]\\d{7}[A-Z]\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "sg_nric",
      "pack": "core"
    },
    {
      "id": "jp_my_number",
      "category": "identity",
      "severity": "critical",
      "name": "Japanese My Number",
      "pattern": "(?:\\bmy ?number|マイナンバー|個人番号|\\bindividual number)(?: card|カード)?(?: no\\.?| number|番号)?(?:\\s+is|は)?\\s*[:#=：]?\\s*\\d{4}[ -]?\\d{4}[ -]?\\d{4}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "jp_mynumber",
      "pack": "core"
    },
    {
      "id": "kr_rrn",
      "category": "identity",
      "severity": "critical",
      "name": "Korean resident registration number",
      "pattern": "\\b\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])-[1-8]\\d{6}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "kr_rrn",
      "pack": "core"
    },
    {
      "id": "kr_rrn_ctx",
      "category": "identity",
      "severity": "critical",
      "name": "Korean resident registration number (labelled)",
      "pattern": "(?:주민등록번호|주민번호|\\brrn|\\bresident registration(?: number| no\\.?)?)\\s*[:#=]?\\s*\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])-?[1-8]\\d{6}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "il_teudat_zehut",
      "category": "identity",
      "severity": "critical",
      "name": "Israeli ID number (Teudat Zehut)",
      "pattern": "(?:ת[.\"״']?ז\\.?|תעודת זהות|מספר זהות|\\bteudat zehut|\\bisraeli? id(?:entity)?(?: card)?(?: number| no\\.?)?)\\s*[:#=]?\\s*\\d{8,9}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "il_tz",
      "pack": "core"
    },
    {
      "id": "za_id",
      "category": "identity",
      "severity": "critical",
      "name": "South African ID number",
      "pattern": "\\b(?:(?:south african|sa|rsa) )?id(?:entity)?(?: number| no\\.?| #)?\\s*[:#=]?\\s*\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])\\d{4}[012]\\d{2}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "za_id",
      "pack": "core"
    },
    {
      "id": "nz_ird",
      "category": "identity",
      "severity": "critical",
      "name": "New Zealand IRD number",
      "pattern": "\\b(?:ird|inland revenue(?: department)?|nz tax(?: file)?)(?: number| no\\.?| #)?\\s*[:#=]?\\s*\\d{2,3}[ -]?\\d{3}[ -]?\\d{3}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "nz_ird",
      "pack": "core"
    },
    {
      "id": "cn_resident_id",
      "category": "identity",
      "severity": "critical",
      "name": "China resident identity card number",
      "pattern": "(?<![0-9A-Za-z])[1-9]\\d{5}(?:18|19|20)\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])\\d{3}[\\dXx](?![0-9A-Za-z])",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "cn_rid"
    },
    {
      "id": "hk_id",
      "category": "identity",
      "severity": "critical",
      "name": "Hong Kong identity card number",
      "pattern": "(?:\\b(?:HKID|HK ID|[Hh][Oo][Nn][Gg] [Kk][Oo][Nn][Gg] (?:ID|[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Cc][Aa][Rr][Dd])(?: [Nn][Oo]\\.?| [Nn][Uu][Mm][Bb][Ee][Rr])?)\\s*[:#=]?\\s*|香港身份證(?:號碼)?\\s*[:#=：]?\\s*|(?<![A-Za-z0-9])(?=[A-Z]{1,2}\\d{6}\\([0-9A]\\)))(?<v>[A-Z]{1,2}\\d{6}\\(?[0-9A]\\)?)(?![A-Za-z0-9])",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "hk_id"
    },
    {
      "id": "in_pan",
      "category": "identity",
      "severity": "high",
      "name": "India PAN (Permanent Account Number)",
      "pattern": "\\b(?:PAN|[Pp][Ee][Rr][Mm][Aa][Nn][Ee][Nn][Tt] [Aa][Cc][Cc][Oo][Uu][Nn][Tt] [Nn][Uu][Mm][Bb][Ee][Rr]|[Pp][Aa][Nn] [Cc][Aa][Rr][Dd]|[Pp][Aa][Nn] [Nn][Oo]\\.?|[Ii][Nn][Cc][Oo][Mm][Ee] [Tt][Aa][Xx](?: [Pp][Aa][Nn])?)(?: [Nn][Oo]\\.?| [Nn][Uu][Mm][Bb][Ee][Rr])?\\s*[:#=-]?\\s*(?<v>[A-Z]{3}[ABCFGHLJPT][A-Z]\\d{4}[A-Z])\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "mx_rfc",
      "category": "identity",
      "severity": "high",
      "name": "Mexico RFC (tax ID)",
      "pattern": "(?<![A-Za-z0-9Ñ&])[A-ZÑ&]{3,4}\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])[A-Z0-9]{2}[0-9A](?![A-Za-z0-9])",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "mx_rfc"
    },
    {
      "id": "se_personnummer",
      "category": "identity",
      "severity": "critical",
      "name": "Sweden personnummer",
      "pattern": "(?:\\b(?:[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Uu][Mm][Mm][Ee][Rr]|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Rr]|[Ss][Aa][Mm][Oo][Rr][Dd][Nn][Ii][Nn][Gg][Ss][Nn][Uu][Mm][Mm][Ee][Rr]|PNR|[Ss][Ww][Ee][Dd][Ii][Ss][Hh] [Pp][Ee][Rr][Ss][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Nn][Uu][Mm][Bb][Ee][Rr])\\.?\\s*[:#=]?\\s*)(?<v>(?:19|20)?\\d{2}(?:0[1-9]|1[0-2])\\d{2}[-+]?\\d{4})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "se_pnr"
    },
    {
      "id": "no_fodselsnummer",
      "category": "identity",
      "severity": "critical",
      "name": "Norway fødselsnummer",
      "pattern": "\\b(?:[Ff]ø[Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]|[Ff][Oo][Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]|[Ff][Oo][Ee][Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Uu][Mm][Mm][Ee][Rr]|[Ff]\\.[Nn][Rr]\\.?|[Ff][Nn][Rr]\\.?|[Nn][Oo][Rr][Ww][Ee][Gg][Ii][Aa][Nn] [Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Nn][Uu][Mm][Bb][Ee][Rr])\\s*[:#=]?\\s*(?<v>\\d{6} ?\\d{5})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "no_fnr"
    },
    {
      "id": "dk_cpr",
      "category": "identity",
      "severity": "critical",
      "name": "Denmark CPR number",
      "pattern": "\\b[Cc][Pp][Rr](?:-?[Nn][Rr]\\.?|-?[Nn][Uu][Mm][Mm][Ee][Rr]| [Nn][Uu][Mm][Bb][Ee][Rr])?\\s*[:#=]?\\s*(?<v>(?:0[1-9]|[12]\\d|3[01])(?:0[1-9]|1[0-2])\\d{2}-?\\d{4})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "dk_cpr"
    },
    {
      "id": "fi_hetu",
      "category": "identity",
      "severity": "critical",
      "name": "Finland personal identity code (HETU)",
      "pattern": "\\b(?:0[1-9]|[12]\\d|3[01])(?:0[1-9]|1[0-2])\\d{2}[-+A-FU-Y]\\d{3}[0-9A-FHJ-NPR-Y]\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "fi_hetu"
    },
    {
      "id": "ch_ahv",
      "category": "identity",
      "severity": "critical",
      "name": "Switzerland AHV/AVS number",
      "pattern": "\\b756[. ]?\\d{4}[. ]?\\d{4}[. ]?\\d{2}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "ch_ahv"
    },
    {
      "id": "ie_ppsn",
      "category": "identity",
      "severity": "critical",
      "name": "Ireland PPS number",
      "pattern": "\\b(?:PPSN?|[Pp][Pp][Ss] [Nn][Oo]\\.?|[Pp][Pp][Ss] [Nn][Uu][Mm][Bb][Ee][Rr]|[Pp][Ee][Rr][Ss][Oo][Nn][Aa][Ll] [Pp][Uu][Bb][Ll][Ii][Cc] [Ss][Ee][Rr][Vv][Ii][Cc][Ee] [Nn][Uu][Mm][Bb][Ee][Rr])\\s*[:#=]?\\s*(?<v>\\d{7}[A-W][A-IW]?)\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "ie_ppsn"
    },
    {
      "id": "tr_tckn",
      "category": "identity",
      "severity": "critical",
      "name": "Turkey T.C. Kimlik number",
      "pattern": "(?:\\b(?:T\\.?C\\.? ?[Kk][Ii][Mm][Ll][Ii][Kk](?: [Nn][Oo]\\.?| [Nn][Uu][Mm][Aa][Rr][Aa][Ss]ı| [Nn][Uu][Mm][Aa][Rr][Aa][Ss][Ii])?|TCKN|TC [Nn][Oo]\\.?|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Oo]\\.?|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Uu][Mm][Aa][Rr][Aa][Ss]ı|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Uu][Mm][Aa][Rr][Aa][Ss][Ii]|[Tt][Uu][Rr][Kk][Ii][Ss][Hh] [Ii][Dd] [Nn][Uu][Mm][Bb][Ee][Rr]))\\s*[:#=]?\\s*(?<v>[1-9]\\d{10})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "tr_tckn"
    },
    {
      "id": "ae_emirates_id",
      "category": "identity",
      "severity": "critical",
      "name": "UAE Emirates ID number",
      "pattern": "\\b784[- ]?\\d{4}[- ]?\\d{7}[- ]?\\d\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core",
      "validator": "ae_eid"
    },
    {
      "id": "au_medicare",
      "category": "phi",
      "severity": "critical",
      "name": "Australian Medicare number",
      "pattern": "\\bmedicare(?: card)?(?: number| no\\.?| #)?\\s*[:#=]?\\s*[2-6]\\d{3} ?\\d{5} ?\\d(?:[ /-]?\\d)?\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "au_medicare",
      "pack": "healthcare"
    },
    {
      "id": "medical_record",
      "category": "phi",
      "severity": "critical",
      "name": "Medical record number (MRN)",
      "pattern": "\\b(?:[Mm][Rr][Nn]|[Mm][Ee][Dd][Ii][Cc][Aa][Ll] [Rr][Ee][Cc][Oo][Rr][Dd](?: [Nn][Uu][Mm][Bb][Ee][Rr]| [Nn][Oo]\\.?| #)?|[Pp][Aa][Tt][Ii][Ee][Nn][Tt] (?:[Ii][Dd]|[Nn][Uu][Mm][Bb][Ee][Rr]|[Nn][Oo]\\.?)|[Cc][Hh][Aa][Rr][Tt] (?:[Nn][Oo]\\.?|[Nn][Uu][Mm][Bb][Ee][Rr]))\\s*[:#=]?\\s*(?<v>(?=[A-Z0-9-]*\\d)[A-Z0-9][A-Z0-9-]{4,14})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "healthcare"
    },
    {
      "id": "npi_number",
      "category": "phi",
      "severity": "high",
      "name": "US National Provider Identifier (NPI)",
      "pattern": "\\bnpi(?: number| no\\.?| #)?\\s*[:#=]?\\s*\\d{10}\\b",
      "flags": "gi",
      "mask": "partial",
      "validator": "npi",
      "pack": "healthcare"
    },
    {
      "id": "dea_number",
      "category": "phi",
      "severity": "high",
      "name": "DEA registration number",
      "pattern": "\\b[ABCDEFGHJKLMPRSTUX][A-Z9]\\d{7}\\b",
      "flags": "g",
      "mask": "full",
      "validator": "dea",
      "pack": "healthcare",
      "context": {
        "pattern": "(?:dea|prescriber|prescribing|\\brx\\b|registration|controlled substance|physician|pharmac)",
        "window": 48,
        "otherwiseSeverity": "low"
      }
    },
    {
      "id": "medicare_mbi",
      "category": "phi",
      "severity": "critical",
      "name": "Medicare Beneficiary Identifier",
      "pattern": "\\b[1-9][AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y0-9]\\d[AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y0-9]\\d[AC-HJKMNP-RT-Y]{2}\\d{2}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "healthcare"
    },
    {
      "id": "nhs_number",
      "category": "phi",
      "severity": "critical",
      "name": "NHS number",
      "pattern": "\\bnhs(?: number| no\\.?| #)?\\s*[:#=]?\\s*\\d{3}[ -]?\\d{3}[ -]?\\d{4}\\b",
      "flags": "gi",
      "mask": "full",
      "validator": "nhs",
      "pack": "healthcare"
    },
    {
      "id": "health_plan_id",
      "category": "phi",
      "severity": "high",
      "name": "Health insurance member / policy ID",
      "pattern": "\\b(?:[Mm][Ee][Mm][Bb][Ee][Rr] [Ii][Dd]|[Ss][Uu][Bb][Ss][Cc][Rr][Ii][Bb][Ee][Rr] [Ii][Dd]|[Pp][Oo][Ll][Ii][Cc][Yy] (?:[Nn][Oo]\\.?|[Nn][Uu][Mm][Bb][Ee][Rr])|[Ii][Nn][Ss][Uu][Rr][Aa][Nn][Cc][Ee] [Ii][Dd]|[Hh][Ee][Aa][Ll][Tt][Hh] [Pp][Ll][Aa][Nn] (?:[Ii][Dd]|[Nn][Oo]\\.?)|[Gg][Rr][Oo][Uu][Pp] (?:[Nn][Oo]\\.?|[Nn][Uu][Mm][Bb][Ee][Rr]))\\s*[:#=]?\\s*(?<v>(?=[A-Z0-9-]*\\d)[A-Z0-9][A-Z0-9-]{5,19})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "healthcare"
    },
    {
      "id": "icd10_dx",
      "category": "phi",
      "severity": "high",
      "name": "Diagnosis code (ICD-10)",
      "pattern": "\\b(?:diagnos(?:is|ed)|dx|icd-?10(?:-cm)?)\\s*(?:code)?\\s*[:#=]?\\s*[A-TV-Z]\\d[0-9AB](?:\\.[0-9A-TV-Z]{1,4})?\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "healthcare"
    },
    {
      "id": "phi_clinical",
      "category": "phi",
      "severity": "high",
      "name": "Patient clinical details",
      "pattern": "\\bpatient\\b[^.\\n]{0,80}\\b(?:diagnosed with|prescribed|presents with|history of|positive for|admitted (?:for|with)|hiv|cancer|diabetes|pregnan\\w*|psychiatric|overdose|dementia|schizophreni\\w*|opioid)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "healthcare"
    },
    {
      "id": "confidential_marker",
      "category": "confidential",
      "severity": "medium",
      "name": "Confidentiality marking",
      "pattern": "\\b(?:strictly confidential|highly confidential|proprietary (?:and|&) confidential|company confidential|internal use only|do not (?:distribute|forward|share)|confidential(?:ity)? notice|not for (?:external|public) (?:distribution|release))\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "legal"
    },
    {
      "id": "privileged_legal",
      "category": "confidential",
      "severity": "high",
      "name": "Attorney-client privileged",
      "pattern": "\\b(?:attorney[- ]client privileged?|privileged (?:&|and) confidential|attorney work[- ]product|legally privileged)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "legal"
    },
    {
      "id": "contract_text",
      "category": "confidential",
      "severity": "high",
      "name": "Contract / agreement text",
      "pattern": "\\b(?:this (?:agreement|contract|amendment)|master (?:services|subscription) agreement|statement of work|non-disclosure agreement|mutual nda|term sheet|letter of intent|share purchase agreement|asset purchase agreement|employment agreement|settlement agreement)\\b[\\s\\S]{0,600}?\\b(?:hereinafter|whereas|governing law|indemnif\\w+|limitation of liability|the parties|effective date)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "legal"
    },
    {
      "id": "mnpi",
      "category": "confidential",
      "severity": "high",
      "name": "Material non-public information",
      "pattern": "\\b(?:material non-?public information|mnpi|under embargo|embargoed until|pre-?release (?:earnings|results)|insider information|draft (?:earnings|10-?[kq]) (?:release|filing)|pending (?:acquisition|merger) of)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "legal"
    },
    {
      "id": "person_name",
      "category": "pii",
      "severity": "medium",
      "name": "Person name",
      "pattern": "\\b[A-Z][a-z]{1,14}(?: [A-Z]\\.?)? [A-Z][a-z]{1,19}(?:-[A-Z][a-z]{1,19})?\\b",
      "flags": "g",
      "mask": "full",
      "validator": "personname",
      "pack": "core"
    },
    {
      "id": "person_name_ctx",
      "category": "pii",
      "severity": "medium",
      "name": "Person name (labelled)",
      "pattern": "\\b(?:[Ff][Uu][Ll][Ll] [Nn][Aa][Mm][Ee]|[Ff][Ii][Rr][Ss][Tt] [Nn][Aa][Mm][Ee]|[Ll][Aa][Ss][Tt] [Nn][Aa][Mm][Ee]|[Ss][Uu][Rr][Nn][Aa][Mm][Ee]|[Nn][Aa][Mm][Ee]|[Pp][Aa][Tt][Ii][Ee][Nn][Tt]|[Ee][Mm][Pp][Ll][Oo][Yy][Ee][Ee]|[Ss][Tt][Uu][Dd][Ee][Nn][Tt]|[Cc][Uu][Ss][Tt][Oo][Mm][Ee][Rr]|[Cc][Ll][Ii][Ee][Nn][Tt]|[Aa][Pp][Pp][Ll][Ii][Cc][Aa][Nn][Tt]|[Cc][Aa][Nn][Dd][Ii][Dd][Aa][Tt][Ee]|[Tt][Ee][Nn][Aa][Nn][Tt]|[Bb][Ee][Nn][Ee][Ff][Ii][Cc][Ii][Aa][Rr][Yy]|[Cc][Ll][Aa][Ii][Mm][Aa][Nn][Tt]|[Aa][Cc][Cc][Oo][Uu][Nn][Tt] [Hh][Oo][Ll][Dd][Ee][Rr]|[Cc][Aa][Rr][Dd][Hh][Oo][Ll][Dd][Ee][Rr])\\s*[:=]\\s*(?!(?:Null|None|String|Name|True|False|Undefined|This|Self)\\b)[A-Z][a-zA-Z'-]{1,20}(?:[ ,]+[A-Z][a-zA-Z'-]{1,20}){0,3}",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "person_salutation",
      "category": "pii",
      "severity": "medium",
      "name": "Person name (title)",
      "pattern": "\\b(?:Mr|Mrs|Ms|Miss|Mx|Dr|Prof)\\.? [A-Z][a-z]{1,14}(?: [A-Z][a-z]{1,19}){0,2}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "uk_postcode",
      "category": "pii",
      "severity": "low",
      "name": "UK postcode",
      "pattern": "\\b(?:[A-Z]{1,2}\\d[A-Z\\d]?) ?\\d[A-Z]{2}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "address_ctx",
      "category": "pii",
      "severity": "medium",
      "name": "Home address (labelled)",
      "pattern": "\\b(?:home address|address|addr|residence|lives at|mailing address)\\s*[:=]\\s*\\d{1,5}[A-Za-z]? [A-Za-z0-9 .,'-]{4,80}",
      "flags": "gi",
      "mask": "full",
      "pack": "core"
    },
    {
      "id": "card_cvv_ctx",
      "category": "financial",
      "severity": "critical",
      "name": "Card security code (CVV)",
      "pattern": "\\b(?:cvv2?|cvc2?|cid|card security code|security code)\\s*[:=#]?\\s*\\d{3,4}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "banking"
    },
    {
      "id": "loan_account_ctx",
      "category": "financial",
      "severity": "high",
      "name": "Loan / mortgage account number",
      "pattern": "\\b(?:loan|mortgage|credit line|heloc)(?: account)?(?: number| no\\.?| #| id)?\\s*[:#=]\\s*[A-Z0-9-]{6,20}\\b",
      "flags": "gi",
      "mask": "partial",
      "pack": "banking"
    },
    {
      "id": "brokerage_account_ctx",
      "category": "financial",
      "severity": "high",
      "name": "Brokerage / investment account",
      "pattern": "\\b(?:brokerage|investment|trading|isa|401\\(k\\)|ira|pension)(?: account)?(?: number| no\\.?| #)?\\s*[:#=]\\s*[A-Z0-9-]{6,17}\\b",
      "flags": "gi",
      "mask": "partial",
      "pack": "banking"
    },
    {
      "id": "swift_mt_message",
      "category": "financial",
      "severity": "high",
      "name": "SWIFT payment message fields",
      "pattern": "(?:^|\\n):(?:20|32A|50K|59|57A|52A):[^\\n]{3,}",
      "flags": "g",
      "mask": "full",
      "pack": "banking"
    },
    {
      "id": "kyc_marker",
      "category": "financial",
      "severity": "medium",
      "name": "KYC / AML case material",
      "pattern": "\\b(?:suspicious activity report|\\bSAR\\b filing|know your customer|KYC (?:file|record|review)|AML (?:alert|case|investigation)|sanctions (?:hit|match|screening result))\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "banking"
    },
    {
      "id": "gov_classification",
      "category": "classified",
      "severity": "critical",
      "name": "Government classification marking",
      "pattern": "\\b(?:TOP SECRET(?://[A-Z/ ,-]+)?|SECRET//[A-Z/ ,-]+|CONFIDENTIAL//[A-Z/ ,-]+|\\(TS\\)|\\(S//NF\\)|\\(S\\)//|NOFORN|ORCON|REL TO [A-Z, ]{3,})",
      "flags": "g",
      "mask": "full",
      "pack": "government"
    },
    {
      "id": "cui_marking",
      "category": "classified",
      "severity": "high",
      "name": "Controlled Unclassified Information (CUI)",
      "pattern": "\\b(?:CUI(?://[A-Z-]+)?|CONTROLLED UNCLASSIFIED INFORMATION|FOUO|FOR OFFICIAL USE ONLY|LAW ENFORCEMENT SENSITIVE|SENSITIVE BUT UNCLASSIFIED|LIMITED OFFICIAL USE)\\b",
      "flags": "g",
      "mask": "full",
      "pack": "government"
    },
    {
      "id": "uk_gov_marking",
      "category": "classified",
      "severity": "high",
      "name": "UK government security marking",
      "pattern": "\\b(?:OFFICIAL[- ]SENSITIVE|UK OFFICIAL[- ]SENSITIVE|UK SECRET|UK TOP SECRET|UK EYES ONLY)\\b",
      "flags": "g",
      "mask": "full",
      "pack": "government"
    },
    {
      "id": "gov_case_ref",
      "category": "identity",
      "severity": "medium",
      "name": "Government case / benefits reference",
      "pattern": "\\b(?:case (?:number|no\\.?|ref(?:erence)?)|benefits? (?:claim )?(?:number|reference)|alien (?:registration )?number|a-number|uscis (?:number|#)|visa (?:number|no\\.?)|immigration (?:reference|case))\\s*[:#=]?\\s*[A-Z]{0,3}[0-9][A-Z0-9-]{5,15}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "government"
    },
    {
      "id": "us_medicaid_ctx",
      "category": "identity",
      "severity": "high",
      "name": "Medicaid / benefits ID (labelled)",
      "pattern": "\\b(?:[Mm][Ee][Dd][Ii][Cc][Aa][Ii][Dd]|[Ss][Nn][Aa][Pp]|[Ee][Bb][Tt]|[Ww][Ii][Cc]) (?:[Ii][Dd]|[Nn][Uu][Mm][Bb][Ee][Rr]|[Cc][Aa][Rr][Dd])(?: [Nn][Oo]\\.?| #)?\\s*[:#=]?\\s*(?<v>(?=[A-Z0-9]*\\d)[A-Z0-9]{8,14})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "government"
    },
    {
      "id": "nato_marking",
      "category": "classified",
      "severity": "critical",
      "name": "NATO / allied classification",
      "pattern": "\\b(?:COSMIC TOP SECRET|NATO SECRET|NATO CONFIDENTIAL|NATO RESTRICTED|ATOMAL|FVEY|FIVE EYES ONLY)\\b",
      "flags": "g",
      "mask": "full",
      "pack": "defense"
    },
    {
      "id": "export_control",
      "category": "classified",
      "severity": "high",
      "name": "Export-controlled (ITAR / EAR)",
      "pattern": "\\b(?:ITAR[- ](?:controlled|restricted|technical data)|subject to (?:the )?(?:ITAR|EAR)|export controlled|EAR99|ECCN\\s*[:#]?\\s*\\d[A-E]\\d{3}|USML Category [IVXL]+|22 CFR 120)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "defense"
    },
    {
      "id": "dod_id",
      "category": "identity",
      "severity": "high",
      "name": "DoD ID / EDIPI (labelled)",
      "pattern": "\\b(?:dod id|edipi|cac (?:id|number)|service number|military id)(?: no\\.?| #)?\\s*[:#=]?\\s*\\d{10}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "defense"
    },
    {
      "id": "nsn",
      "category": "confidential",
      "severity": "medium",
      "name": "NATO Stock Number (NSN)",
      "pattern": "\\b\\d{4}-\\d{2}-\\d{3}-\\d{4}\\b",
      "flags": "g",
      "mask": "full",
      "context": {
        "pattern": "(?:nsn|stock|part|nato|item|niin)",
        "window": 48,
        "otherwiseSeverity": "low"
      },
      "pack": "defense"
    },
    {
      "id": "mgrs_coordinate",
      "category": "classified",
      "severity": "high",
      "name": "Military grid coordinates (MGRS)",
      "pattern": "\\b\\d{1,2}[C-HJ-NP-X] ?[A-HJ-NP-Z]{2} ?\\d{4,5} ?\\d{4,5}\\b",
      "flags": "g",
      "mask": "full",
      "pack": "defense"
    },
    {
      "id": "cage_code",
      "category": "confidential",
      "severity": "low",
      "name": "CAGE code (labelled)",
      "pattern": "\\bcage(?: code)?\\s*[:#=]\\s*[A-Z0-9]{5}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "defense"
    },
    {
      "id": "student_id_ctx",
      "category": "pii",
      "severity": "high",
      "name": "Student ID (labelled)",
      "pattern": "\\b(?:[Ss][Tt][Uu][Dd][Ee][Nn][Tt]|[Pp][Uu][Pp][Ii][Ll]|[Ll][Ee][Aa][Rr][Nn][Ee][Rr]|[Ee][Nn][Rr][Oo][Ll][Mm][Ee][Nn][Tt]|[Ee][Nn][Rr][Oo][Ll][Ll][Mm][Ee][Nn][Tt])(?: [Ii][Dd]| [Nn][Uu][Mm][Bb][Ee][Rr]| [Nn][Oo]\\.?| #)\\s*[:#=]?\\s*(?<v>(?=[A-Z0-9-]*\\d)[A-Z0-9-]{5,15})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "education"
    },
    {
      "id": "uk_upn",
      "category": "pii",
      "severity": "high",
      "name": "UK Unique Pupil Number (UPN)",
      "pattern": "\\b[A-HJ-NP-RTV-Z]\\d{11}[0-9A-HJ-NP-RTV-Z]\\b",
      "flags": "g",
      "mask": "full",
      "context": {
        "pattern": "(?:upn|pupil)",
        "window": 48,
        "otherwiseSeverity": "low"
      },
      "pack": "education"
    },
    {
      "id": "education_record",
      "category": "pii",
      "severity": "medium",
      "name": "Education record (grades, SEN, discipline)",
      "pattern": "\\b(?:gpa\\s*[:=]\\s*\\d\\.\\d{1,2}|transcript for|report card|iep\\b|individuali[sz]ed education (?:plan|program)|special educational needs|sen(?:d)? (?:status|support)|ehcp|504 plan|disciplinary record|exclusion record|safeguarding (?:concern|referral)|ferpa)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "education"
    },
    {
      "id": "insurance_policy_ctx",
      "category": "financial",
      "severity": "high",
      "name": "Insurance policy / claim number",
      "pattern": "\\b(?:policy|claim|member|subscriber)(?: number| no\\.?| #| id)\\s*[:#=]?\\s*[A-Z]{0,4}[0-9][A-Z0-9-]{5,18}\\b",
      "flags": "gi",
      "mask": "partial",
      "pack": "insurance_hr"
    },
    {
      "id": "employee_id_ctx",
      "category": "pii",
      "severity": "medium",
      "name": "Employee ID (labelled)",
      "pattern": "\\b(?:[Ee][Mm][Pp][Ll][Oo][Yy][Ee][Ee]|[Ss][Tt][Aa][Ff][Ff]|[Pp][Aa][Yy][Rr][Oo][Ll][Ll]|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Ee][Ll]|[Bb][Aa][Dd][Gg][Ee])(?: [Ii][Dd]| [Nn][Uu][Mm][Bb][Ee][Rr]| [Nn][Oo]\\.?| #)\\s*[:#=]?\\s*(?<v>(?=[A-Z0-9-]*\\d)[A-Z0-9-]{4,12})\\b",
      "flags": "g",
      "mask": "full",
      "pack": "insurance_hr"
    },
    {
      "id": "hr_sensitive",
      "category": "confidential",
      "severity": "high",
      "name": "HR-sensitive matter",
      "pattern": "\\b(?:performance improvement plan|disciplinary (?:hearing|action|meeting)|grievance (?:hearing|investigation)|termination (?:letter|meeting|of employment)|redundancy (?:list|selection)|severance (?:agreement|package)|sick(?:ness)? absence record|fit note|occupational health report|background check result|right to work check)\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "insurance_hr"
    },
    {
      "id": "imei",
      "category": "identity",
      "severity": "medium",
      "name": "Device IMEI",
      "pattern": "\\b\\d{15}\\b",
      "flags": "g",
      "mask": "full",
      "validator": "luhn",
      "context": {
        "pattern": "(?:imei|device|handset|serial)",
        "window": 40,
        "otherwiseSeverity": "low"
      },
      "pack": "telecom"
    },
    {
      "id": "iccid",
      "category": "identity",
      "severity": "medium",
      "name": "SIM card number (ICCID)",
      "pattern": "\\b89\\d{17,18}\\b",
      "flags": "g",
      "mask": "full",
      "validator": "luhn",
      "pack": "telecom"
    },
    {
      "id": "imsi_ctx",
      "category": "identity",
      "severity": "medium",
      "name": "Subscriber identity (IMSI)",
      "pattern": "\\bimsi\\s*[:#=]?\\s*\\d{14,15}\\b",
      "flags": "gi",
      "mask": "full",
      "pack": "telecom"
    }
  ],
  "brands": [
    {
      "name": "Microsoft",
      "keywords": [
        "microsoft",
        "office 365",
        "microsoft 365",
        "outlook",
        "onedrive",
        "sharepoint",
        "copilot"
      ],
      "domains": [
        "microsoft.com",
        "live.com",
        "office.com",
        "microsoftonline.com",
        "outlook.com",
        "sharepoint.com",
        "onedrive.com",
        "bing.com",
        "copilot.microsoft.com",
        "msn.com",
        "azure.com",
        "github.com",
        "linkedin.com",
        "skype.com",
        "windows.net"
      ]
    },
    {
      "name": "Google",
      "keywords": [
        "google",
        "gmail",
        "google drive",
        "gemini"
      ],
      "domains": [
        "google.com",
        "gmail.com",
        "youtube.com",
        "googleusercontent.com",
        "gstatic.com",
        "gemini.google.com",
        "withgoogle.com"
      ]
    },
    {
      "name": "OpenAI / ChatGPT",
      "keywords": [
        "openai",
        "chatgpt"
      ],
      "domains": [
        "openai.com",
        "chatgpt.com",
        "oaistatic.com",
        "oaiusercontent.com"
      ]
    },
    {
      "name": "Anthropic / Claude",
      "keywords": [
        "anthropic",
        "claude"
      ],
      "domains": [
        "anthropic.com",
        "claude.ai",
        "claude.com"
      ]
    },
    {
      "name": "xAI / Grok",
      "keywords": [
        "grok",
        "xai"
      ],
      "domains": [
        "x.ai",
        "grok.com",
        "x.com",
        "twitter.com"
      ]
    },
    {
      "name": "ElevenLabs",
      "keywords": [
        "elevenlabs"
      ],
      "domains": [
        "elevenlabs.io"
      ]
    },
    {
      "name": "Cursor",
      "keywords": [
        "cursor ai",
        "cursor.sh"
      ],
      "domains": [
        "cursor.com",
        "cursor.sh"
      ]
    },
    {
      "name": "Perplexity",
      "keywords": [
        "perplexity"
      ],
      "domains": [
        "perplexity.ai"
      ]
    },
    {
      "name": "PayPal",
      "keywords": [
        "paypal"
      ],
      "domains": [
        "paypal.com",
        "paypal.me",
        "paypalobjects.com"
      ]
    },
    {
      "name": "Apple",
      "keywords": [
        "apple id",
        "icloud",
        "apple account"
      ],
      "domains": [
        "apple.com",
        "icloud.com"
      ]
    },
    {
      "name": "Amazon",
      "keywords": [
        "amazon",
        "aws"
      ],
      "domains": [
        "amazon.com",
        "amazon.co.uk",
        "amazon.de",
        "amazon.ca",
        "amazon.in",
        "amazon.fr",
        "aws.amazon.com",
        "amazonaws.com",
        "a2z.com"
      ]
    },
    {
      "name": "Meta",
      "keywords": [
        "facebook",
        "instagram",
        "whatsapp",
        "meta account"
      ],
      "domains": [
        "facebook.com",
        "instagram.com",
        "whatsapp.com",
        "meta.com",
        "fb.com",
        "messenger.com"
      ]
    },
    {
      "name": "MetaMask",
      "keywords": [
        "metamask"
      ],
      "domains": [
        "metamask.io"
      ],
      "web3": true
    },
    {
      "name": "Coinbase",
      "keywords": [
        "coinbase"
      ],
      "domains": [
        "coinbase.com"
      ],
      "web3": true
    },
    {
      "name": "Binance",
      "keywords": [
        "binance"
      ],
      "domains": [
        "binance.com",
        "binance.us"
      ],
      "web3": true
    },
    {
      "name": "Ledger",
      "keywords": [
        "ledger live",
        "ledger wallet"
      ],
      "domains": [
        "ledger.com"
      ],
      "web3": true
    },
    {
      "name": "Netflix",
      "keywords": [
        "netflix"
      ],
      "domains": [
        "netflix.com"
      ]
    },
    {
      "name": "DocuSign",
      "keywords": [
        "docusign"
      ],
      "domains": [
        "docusign.com",
        "docusign.net"
      ]
    },
    {
      "name": "Dropbox",
      "keywords": [
        "dropbox"
      ],
      "domains": [
        "dropbox.com"
      ]
    },
    {
      "name": "Bank of America",
      "keywords": [
        "bank of america"
      ],
      "domains": [
        "bankofamerica.com"
      ]
    },
    {
      "name": "Chase",
      "keywords": [
        "chase bank",
        "jpmorgan chase"
      ],
      "domains": [
        "chase.com"
      ]
    },
    {
      "name": "Wells Fargo",
      "keywords": [
        "wells fargo"
      ],
      "domains": [
        "wellsfargo.com"
      ]
    },
    {
      "name": "Kraken",
      "keywords": [
        "kraken"
      ],
      "domains": [
        "kraken.com"
      ],
      "web3": true
    },
    {
      "name": "OKX",
      "keywords": [
        "okx"
      ],
      "domains": [
        "okx.com"
      ],
      "web3": true
    },
    {
      "name": "Bybit",
      "keywords": [
        "bybit"
      ],
      "domains": [
        "bybit.com"
      ],
      "web3": true
    },
    {
      "name": "KuCoin",
      "keywords": [
        "kucoin"
      ],
      "domains": [
        "kucoin.com"
      ],
      "web3": true
    },
    {
      "name": "Bitfinex",
      "keywords": [
        "bitfinex"
      ],
      "domains": [
        "bitfinex.com"
      ],
      "web3": true
    },
    {
      "name": "Gemini Exchange",
      "keywords": [
        "gemini exchange",
        "gemini trust"
      ],
      "domains": [
        "gemini.com"
      ],
      "web3": true
    },
    {
      "name": "Crypto.com",
      "keywords": [
        "crypto.com"
      ],
      "domains": [
        "crypto.com"
      ],
      "web3": true
    },
    {
      "name": "Bitstamp",
      "keywords": [
        "bitstamp"
      ],
      "domains": [
        "bitstamp.net"
      ],
      "web3": true
    },
    {
      "name": "Uniswap",
      "keywords": [
        "uniswap"
      ],
      "domains": [
        "uniswap.org",
        "app.uniswap.org"
      ],
      "web3": true
    },
    {
      "name": "PancakeSwap",
      "keywords": [
        "pancakeswap"
      ],
      "domains": [
        "pancakeswap.finance"
      ],
      "web3": true
    },
    {
      "name": "OpenSea",
      "keywords": [
        "opensea"
      ],
      "domains": [
        "opensea.io"
      ],
      "web3": true
    },
    {
      "name": "Blur",
      "keywords": [
        "blur.io",
        "blur marketplace"
      ],
      "domains": [
        "blur.io"
      ],
      "web3": true
    },
    {
      "name": "Phantom",
      "keywords": [
        "phantom wallet",
        "phantom"
      ],
      "domains": [
        "phantom.app",
        "phantom.com"
      ],
      "web3": true
    },
    {
      "name": "Trust Wallet",
      "keywords": [
        "trust wallet"
      ],
      "domains": [
        "trustwallet.com"
      ],
      "web3": true
    },
    {
      "name": "Trezor",
      "keywords": [
        "trezor"
      ],
      "domains": [
        "trezor.io"
      ],
      "web3": true
    },
    {
      "name": "Rabby",
      "keywords": [
        "rabby"
      ],
      "domains": [
        "rabby.io"
      ],
      "web3": true
    },
    {
      "name": "Lido",
      "keywords": [
        "lido finance",
        "lido staking"
      ],
      "domains": [
        "lido.fi"
      ],
      "web3": true
    },
    {
      "name": "Aave",
      "keywords": [
        "aave"
      ],
      "domains": [
        "aave.com"
      ],
      "web3": true
    },
    {
      "name": "1inch",
      "keywords": [
        "1inch"
      ],
      "domains": [
        "1inch.io",
        "1inch.com"
      ],
      "web3": true
    },
    {
      "name": "Jupiter",
      "keywords": [
        "jupiter exchange",
        "jup.ag"
      ],
      "domains": [
        "jup.ag"
      ],
      "web3": true
    },
    {
      "name": "Raydium",
      "keywords": [
        "raydium"
      ],
      "domains": [
        "raydium.io"
      ],
      "web3": true
    },
    {
      "name": "Magic Eden",
      "keywords": [
        "magic eden"
      ],
      "domains": [
        "magiceden.io"
      ],
      "web3": true
    },
    {
      "name": "Etherscan",
      "keywords": [
        "etherscan"
      ],
      "domains": [
        "etherscan.io"
      ],
      "web3": true
    },
    {
      "name": "Robinhood",
      "keywords": [
        "robinhood"
      ],
      "domains": [
        "robinhood.com"
      ],
      "web3": true
    },
    {
      "name": "WalletConnect",
      "keywords": [
        "walletconnect"
      ],
      "domains": [
        "walletconnect.com",
        "walletconnect.network",
        "reown.com"
      ],
      "web3": true
    }
  ],
  "aiSites": [
    {
      "name": "ChatGPT",
      "match": [
        "chatgpt.com",
        "chat.openai.com"
      ]
    },
    {
      "name": "Claude",
      "match": [
        "claude.ai"
      ]
    },
    {
      "name": "Microsoft Copilot",
      "match": [
        "copilot.microsoft.com",
        "m365.cloud.microsoft",
        "copilot.cloud.microsoft"
      ]
    },
    {
      "name": "Gemini",
      "match": [
        "gemini.google.com",
        "aistudio.google.com"
      ]
    },
    {
      "name": "Grok",
      "match": [
        "grok.com",
        "x.com/i/grok"
      ]
    },
    {
      "name": "ElevenLabs",
      "match": [
        "elevenlabs.io"
      ]
    },
    {
      "name": "Cursor",
      "match": [
        "cursor.com"
      ]
    },
    {
      "name": "Perplexity",
      "match": [
        "perplexity.ai"
      ]
    },
    {
      "name": "DeepSeek",
      "match": [
        "chat.deepseek.com"
      ]
    },
    {
      "name": "Mistral Le Chat",
      "match": [
        "chat.mistral.ai"
      ]
    },
    {
      "name": "Poe",
      "match": [
        "poe.com"
      ]
    },
    {
      "name": "Amazon",
      "match": [
        "amazon.com",
        "amazon.co.uk",
        "amazon.de",
        "amazon.ca"
      ]
    },
    {
      "name": "Google Search",
      "match": [
        "www.google.com",
        "google.com"
      ]
    },
    {
      "name": "Bing",
      "match": [
        "www.bing.com"
      ]
    },
    {
      "name": "DuckDuckGo",
      "match": [
        "duckduckgo.com"
      ]
    }
  ],
  "searchEngines": [
    {
      "host": "google.",
      "params": [
        "q"
      ]
    },
    {
      "host": "bing.com",
      "params": [
        "q"
      ]
    },
    {
      "host": "duckduckgo.com",
      "params": [
        "q"
      ]
    },
    {
      "host": "search.yahoo.com",
      "params": [
        "p"
      ]
    },
    {
      "host": "search.brave.com",
      "params": [
        "q"
      ]
    },
    {
      "host": "yandex.",
      "params": [
        "text"
      ]
    },
    {
      "host": "ecosia.org",
      "params": [
        "q"
      ]
    },
    {
      "host": "perplexity.ai",
      "params": [
        "q"
      ]
    },
    {
      "host": "chatgpt.com",
      "params": [
        "q",
        "prompt"
      ]
    },
    {
      "host": "amazon.",
      "params": [
        "k",
        "field-keywords"
      ]
    }
  ],
  "typosquatTargets": [
    "google.com",
    "gmail.com",
    "microsoft.com",
    "live.com",
    "office.com",
    "outlook.com",
    "apple.com",
    "icloud.com",
    "amazon.com",
    "paypal.com",
    "facebook.com",
    "instagram.com",
    "netflix.com",
    "openai.com",
    "chatgpt.com",
    "claude.ai",
    "anthropic.com",
    "github.com",
    "gitlab.com",
    "linkedin.com",
    "dropbox.com",
    "docusign.com",
    "coinbase.com",
    "binance.com",
    "metamask.io",
    "ledger.com",
    "chase.com",
    "wellsfargo.com",
    "bankofamerica.com",
    "x.com",
    "twitter.com",
    "youtube.com",
    "whatsapp.com",
    "elevenlabs.io",
    "cursor.com",
    "perplexity.ai",
    "uniswap.org",
    "opensea.io",
    "phantom.app",
    "kraken.com",
    "okx.com",
    "bybit.com",
    "kucoin.com",
    "crypto.com",
    "pancakeswap.finance",
    "trustwallet.com",
    "trezor.io",
    "rabby.io",
    "lido.fi",
    "aave.com",
    "magiceden.io",
    "etherscan.io",
    "robinhood.com",
    "gemini.com",
    "bitstamp.net",
    "okta.com",
    "microsoftonline.com"
  ],
  "suspiciousTlds": [
    "zip",
    "mov",
    "top",
    "xyz",
    "click",
    "country",
    "kim",
    "gq",
    "tk",
    "ml",
    "cf",
    "ga",
    "work",
    "rest",
    "fit",
    "loan",
    "men",
    "date",
    "racing",
    "review",
    "cam",
    "quest",
    "sbs",
    "cfd",
    "lol",
    "icu",
    "monster",
    "buzz",
    "support",
    "beauty",
    "hair",
    "bond"
  ],
  "urlShorteners": [
    "bit.ly",
    "tinyurl.com",
    "t.co",
    "goo.gl",
    "ow.ly",
    "is.gd",
    "buff.ly",
    "rebrand.ly",
    "cutt.ly",
    "shorturl.at",
    "rb.gy",
    "t.ly",
    "tiny.cc",
    "s.id",
    "v.gd"
  ],
  "maliciousCommandPatterns": [
    "\\bpowershell(?:\\.exe)?\\b[^\\n]{0,200}(?:-e(?:nc(?:odedcommand)?)?\\s+[A-Za-z0-9+/=]{20,}|iex|invoke-expression|downloadstring|iwr|invoke-webrequest|frombase64string|-w(?:indowstyle)?\\s+h(?:idden)?)",
    "\\bmshta(?:\\.exe)?\\s+(?:https?:|vbscript:|javascript:)",
    "\\b(?:curl|wget)\\b[^\\n|]{0,200}\\|\\s*(?:ba|z)?sh\\b",
    "\\bcmd(?:\\.exe)?\\s+/c\\s+[^\\n]{0,200}(?:http|\\.exe|\\.bat|\\.ps1|start\\s)",
    "\\brundll32(?:\\.exe)?\\s+[^\\n]{0,120},",
    "\\bregsvr32(?:\\.exe)?\\s+/s\\s+/n\\s+/u\\s+/i:",
    "\\bcertutil(?:\\.exe)?\\s+-urlcache",
    "\\bbitsadmin(?:\\.exe)?\\s+/transfer",
    "\\bosascript\\s+-e\\b",
    "\\bbase64\\s+(?:-d|--decode)\\b[^\\n]{0,80}\\|\\s*(?:ba|z)?sh\\b"
  ],
  "clickfixPatterns": [
    "(?:press|hold)\\s+(?:the\\s+)?(?:windows|win|⊞)\\s*(?:key\\s*)?\\+\\s*r",
    "(?:press|hit)\\s+ctrl\\s*\\+\\s*v",
    "verify (?:you are|you're) (?:a )?human",
    "i'?m not a robot",
    "verification steps?",
    "(?:open|launch) (?:the )?run dialog",
    "press\\s+(?:cmd|command)\\s*\\+\\s*space",
    "paste (?:it|the code|the command) (?:in|into) (?:the )?(?:terminal|run|powershell)"
  ],
  "cryptoScamPatterns": [
    "double your (?:btc|eth|bitcoin|ethereum|crypto|sol|usdt)",
    "send (?:\\d+(?:\\.\\d+)?\\s*)?(?:btc|eth|sol|usdt)[^.]{0,60}(?:receive|get) (?:back|double|2x)",
    "(?:claim|connect wallet to claim) (?:your )?(?:free )?(?:airdrop|tokens|rewards|nft)",
    "(?:elon|musk|vitalik|saylor)[^.]{0,40}(?:giveaway|airdrop)",
    "wallet (?:validation|synchroni[sz]ation|rectification)",
    "enter (?:your )?(?:12|24)[- ]word (?:seed|recovery|secret) phrase",
    "(?:guaranteed|risk[- ]free) (?:\\d+%\\s*)?(?:daily |weekly )?(?:returns|profit)",
    "migrate your (?:tokens|wallet) (?:now|immediately)"
  ],
  "promptInjectionPatterns": [
    "ignore (?:all |any )?(?:the )?(?:previous|prior|above) (?:instructions|prompts|messages)",
    "disregard (?:all |any )?(?:previous|prior|your) (?:instructions|rules|guidelines)",
    "you are now (?:in )?(?:developer|dan|jailbreak) mode",
    "system prompt:",
    "(?:assistant|ai|llm)[,:]? (?:please )?(?:send|exfiltrate|forward|email) (?:the )?(?:user'?s?|their) (?:data|password|credentials|keys)",
    "do not (?:tell|inform|reveal to) the user",
    "<\\s*(?:system|instructions?)\\s*>"
  ],
  "walletDrainerSignals": {
    "dangerousMethods": [
      "eth_sign",
      "eth_signTypedData",
      "eth_signTypedData_v3",
      "eth_signTypedData_v4",
      "personal_sign",
      "wallet_requestPermissions",
      "eth_sendTransaction"
    ],
    "dangerousSelectors": {
      "0x095ea7b3": "approve(address,uint256)",
      "0xa22cb465": "setApprovalForAll(address,bool)",
      "0x39509351": "increaseAllowance(address,uint256)",
      "0x23b872dd": "transferFrom(address,address,uint256)",
      "0x42842e0e": "safeTransferFrom(address,address,uint256)",
      "0xd505accf": "permit(...)",
      "0x2b67b570": "Permit2 permit"
    },
    "typedDataPrimaryTypes": [
      "Permit",
      "PermitSingle",
      "PermitBatch",
      "PermitTransferFrom",
      "PermitBatchTransferFrom",
      "OrderComponents",
      "Order",
      "BulkOrder"
    ]
  },
  "packs": {
    "core": {
      "label": "Core (PII, secrets, credentials)"
    },
    "finance": {
      "label": "Finance & Accounting"
    },
    "healthcare": {
      "label": "Healthcare & MedTech"
    },
    "legal": {
      "label": "Contracts & Legal"
    },
    "web3": {
      "label": "Web3 & Crypto"
    },
    "banking": {
      "label": "Banking & Financial Services"
    },
    "government": {
      "label": "Government & Public Sector"
    },
    "defense": {
      "label": "Military & Defence"
    },
    "education": {
      "label": "Education"
    },
    "insurance_hr": {
      "label": "Insurance & HR"
    },
    "telecom": {
      "label": "Telecoms"
    }
  },
  "walletExtensions": [
    {
      "name": "MetaMask",
      "ids": [
        "nkbihfbeogaeaoehlefnkodbefgpgknn",
        "ejbalbakoplchlghecdalmeeeajnimhm"
      ]
    },
    {
      "name": "Phantom",
      "ids": [
        "bfnaelmomeimhlpmgjnjophhpkkoljpa"
      ]
    },
    {
      "name": "Coinbase Wallet",
      "ids": [
        "hnfanknocfeofbddgcijnmhnfnkdnaad"
      ]
    },
    {
      "name": "Trust Wallet",
      "ids": [
        "egjidjbpglichdcondbcbdnbeeppgdph"
      ]
    },
    {
      "name": "Rabby",
      "ids": [
        "acmacodkjbdgmoleebolmdjonilkdbch"
      ]
    }
  ],
  "walletExtensionKeywords": [
    "metamask",
    "phantom",
    "coinbase wallet",
    "trust wallet",
    "rabby",
    "ledger",
    "trezor",
    "keplr",
    "solflare",
    "okx wallet",
    "exodus",
    "backpack",
    "wallet",
    "seed phrase",
    "crypto",
    "web3"
  ],
  "aitm": {
    "idpDomains": [
      "login.microsoftonline.com",
      "login.live.com",
      "login.microsoft.com",
      "account.microsoft.com",
      "accounts.google.com",
      "okta.com",
      "oktapreview.com",
      "auth0.com",
      "onelogin.com",
      "pingidentity.com",
      "duosecurity.com",
      "appleid.apple.com",
      "github.com",
      "gitlab.com",
      "login.salesforce.com",
      "id.atlassian.com",
      "signin.aws.amazon.com",
      "login.yahoo.com",
      "paypal.com"
    ],
    "mfaPatterns": [
      "enter (?:the |your )?(?:6|six|8|eight)[- ]digit (?:code|pin)",
      "verification code",
      "one[- ]time (?:pass(?:code|word)|code|pin)",
      "authenticator app",
      "approve (?:the )?sign[- ]in request",
      "enter the code (?:shown|displayed|sent)",
      "2-?step verification",
      "multi-?factor",
      "security key"
    ],
    "deviceCodePatterns": [
      "microsoft\\.com/devicelogin",
      "aka\\.ms/devicelogin",
      "google\\.com/device",
      "github\\.com/login/device",
      "enter (?:this|the following) code (?:at|on)"
    ],
    "loginPatterns": [
      "sign in to (?:your )?(?:microsoft|office|outlook|google|okta|account)",
      "enter (?:your )?password",
      "stay signed in",
      "pick an account",
      "use your (?:microsoft|google) account"
    ]
  },
  "becPatterns": [
    "(?:updated?|new|changed?)\\s+(?:bank(?:ing)?|wire|remittance|payment)\\s+(?:details|instructions|account)",
    "(?:urgent|immediate)\\s+(?:wire|payment|transfer)",
    "(?:gift cards?|itunes cards?)\\s+(?:for|to)\\s+(?:the )?(?:ceo|director|client)",
    "do not (?:call|phone) (?:to )?(?:confirm|verify)",
    "change of (?:bank|payment) (?:details|account)"
  ],
  "placeholderValues": {
    "exact": [
      "string",
      "str",
      "null",
      "none",
      "nil",
      "undefined",
      "required",
      "optional",
      "true",
      "false",
      "password",
      "passwd",
      "secret",
      "changeme",
      "redacted",
      "hidden",
      "masked",
      "empty",
      "unknown",
      "number",
      "boolean",
      "object",
      "any"
    ],
    "contains": [
      "process.env",
      "os.environ",
      "getenv",
      "environ[",
      "env.",
      "settings.",
      "config.",
      "configuration[",
      "secrets.",
      "vault:",
      "${",
      "{{",
      "<",
      "%(",
      "%s",
      "your_",
      "your-",
      "yourkey",
      "xxxx",
      "****",
      "••••",
      "changeme",
      "example",
      "placeholder",
      "dummy",
      "sample",
      "redacted",
      "[redacted",
      "insert_",
      "replace_",
      "todo",
      "auto-",
      "-generated",
      "-only",
      "-based",
      "-encoded",
      "-scoped",
      "-specific",
      "-level",
      "-wide",
      "-sensitive",
      "-free",
      "-protected",
      "-enabled",
      "-disabled"
    ]
  },
  "exampleValues": [
    "4111111111111111",
    "4242424242424242",
    "4000056655665556",
    "4012888888881881",
    "4222222222222",
    "5555555555554444",
    "5200828282828210",
    "5105105105105100",
    "2223003122003222",
    "378282246310005",
    "371449635398431",
    "378734493671000",
    "6011111111111117",
    "6011000990139424",
    "6011981111111113",
    "3530111333300000",
    "3566002020360505",
    "3566111111111113",
    "30569309025904",
    "38520000023237",
    "36227206271667",
    "6200000000000005",
    "6205500000000000004",
    "AKIAIOSFODNN7EXAMPLE",
    "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
    "123-45-6789",
    "078-05-1120",
    "219-09-9999"
  ],
  "exampleSuffixes": [
    "EXAMPLE",
    "EXAMPLEKEY"
  ],
  "ibanLengths": {
    "AD": 24,
    "AE": 23,
    "AL": 28,
    "AT": 20,
    "AZ": 28,
    "BA": 20,
    "BE": 16,
    "BG": 22,
    "BH": 22,
    "BI": 27,
    "BR": 29,
    "BY": 28,
    "CH": 21,
    "CR": 22,
    "CY": 28,
    "CZ": 24,
    "DE": 22,
    "DJ": 27,
    "DK": 18,
    "DO": 28,
    "EE": 20,
    "EG": 29,
    "ES": 24,
    "FI": 18,
    "FK": 18,
    "FO": 18,
    "FR": 27,
    "GB": 22,
    "GE": 22,
    "GI": 23,
    "GL": 18,
    "GR": 27,
    "GT": 28,
    "HN": 28,
    "HR": 21,
    "HU": 28,
    "IE": 22,
    "IL": 23,
    "IQ": 23,
    "IS": 26,
    "IT": 27,
    "JO": 30,
    "KW": 30,
    "KZ": 20,
    "LB": 28,
    "LC": 32,
    "LI": 21,
    "LT": 20,
    "LU": 20,
    "LV": 21,
    "LY": 25,
    "MC": 27,
    "MD": 24,
    "ME": 22,
    "MK": 19,
    "MN": 20,
    "MR": 27,
    "MT": 31,
    "MU": 30,
    "NI": 28,
    "NL": 18,
    "NO": 15,
    "OM": 23,
    "PK": 24,
    "PL": 28,
    "PS": 29,
    "PT": 25,
    "QA": 29,
    "RO": 24,
    "RS": 22,
    "RU": 33,
    "SA": 24,
    "SC": 31,
    "SD": 18,
    "SE": 24,
    "SI": 19,
    "SK": 24,
    "SM": 27,
    "SO": 23,
    "ST": 25,
    "SV": 28,
    "TL": 23,
    "TN": 24,
    "TR": 26,
    "UA": 29,
    "VA": 22,
    "VG": 24,
    "XK": 20,
    "YE": 30
  },
  "isoCountries": "AD AE AF AG AI AL AM AO AQ AR AS AT AU AW AX AZ BA BB BD BE BF BG BH BI BJ BL BM BN BO BQ BR BS BT BV BW BY BZ CA CC CD CF CG CH CI CK CL CM CN CO CR CU CV CW CX CY CZ DE DJ DK DM DO DZ EC EE EG EH ER ES ET FI FJ FK FM FO FR GA GB GD GE GF GG GH GI GL GM GN GP GQ GR GS GT GU GW GY HK HM HN HR HT HU ID IE IL IM IN IO IQ IR IS IT JE JM JO JP KE KG KH KI KM KN KP KR KW KY KZ LA LB LC LI LK LR LS LT LU LV LY MA MC MD ME MF MG MH MK ML MM MN MO MP MQ MR MS MT MU MV MW MX MY MZ NA NC NE NF NG NI NL NO NP NR NU NZ OM PA PE PF PG PH PK PL PM PN PR PS PT PW PY QA RE RO RS RU RW SA SB SC SD SE SG SH SI SJ SK SL SM SN SO SR SS ST SV SX SY SZ TC TD TF TG TH TJ TK TL TM TN TO TR TT TV TW TZ UA UG UM US UY UZ VA VC VE VG VI VN VU WF WS XK YE YT ZA ZM ZW"
}