L1 Rule Catalog¶
These are the stable rule IDs accepted by execution-gate rules. Missing IDs inherit the shared Rust/Python/API defaults below. Model gates such as native:pii, native:dlp, native:injection_l1, and native:threat_l1 control complete producers; rule gates control individual entries below.
For coverage per benchmark entity, the comparison with Presidio and the secret scanners, and latency, see L1 capabilities.
PII rules (213)¶
All PII rules except the bare and compatibility forms (*_bare, *_compat) are eligible by default when PII L1 is enabled.
In the default strict PII mode every finding scores 1.0. In balanced and recall a finding scores the rule base plus the validator strength (checksum 35, format 15, none 0) plus its context, capped at 100 and divided by 100: 25 when the rule binds the value to a field name, otherwise 25/20/15 for a support term of the label near the value and -30 when a counter-context term is nearer (see PII score and modes, PII context lexicon). Rules marked proximity (required) report only with a support term, in every mode. Rules marked balanced/recall only report a checksum value without a field name and never run in strict; the value must stand alone, not inside a longer number. Rules marked opt-in report the bare value of an id that the default rules report only with a term of its label or after its field name; they are off in every mode until the rules gate enables them (see bare formats), then report in every mode with the validator of the id, standing alone as a word of prose (no code prefix, no SWIFT, X12 or EDIFACT field), outside a key that names another value, without a nearer counter-context term or an account, routing, customer or contract term that names the value, and not on a value that a default rule of another label reports; they score below the labelled rules. Compatibility rules (*_compat) are opt-in the same way and report values that the default rules reject by decision: loopback and unspecified IP addresses and SSA-unassigned SSNs. Structure: a JSON key, a key: value/key=value line, an XML element or attribute, a CSV header or a Markdown/HTML table header that a field rule accepts as its field name binds the value it holds to the rule in every mode, if the value matches the rule's value form in full; for the other rules a key of the label (or a counter-context key) that names exactly the value is its context (+25 or -30) instead of proximity. Obfuscation: every rule also sees values behind zero-width characters, full-width forms and defanged separators ([.], (@)) in every mode, and in recall also spelled-out e-mail separators ([at], ät, dot, punkt) and numbers spaced character by character (-10); the span is the original text and the validator decides on the normalized value. Overlaps: in balanced and recall overlapping findings of two different labels among IBAN, CREDITCARD, FINANCIAL_ACCOUNT_NUMBER, STEUERID, PHONE, VAT_ID_IT, VAT_ID_FR, VAT_ID_HR, VAT_ID_LT, VAT_ID_LV, NHS_NUMBER, AU_ABN, SE_PERSONNUMMER, DK_CPR, NO_FODSELSNUMMER, FI_PERSONAL_IDENTITY_CODE, FR_NIR, FR_SIRET, BE_NATIONAL_NUMBER, TR_NATIONAL_ID resolve to one: an IBAN wins, then the longer value, context that supports its own label, a checksum, the higher score, the earlier rule; a finding inside a printed IBAN form (DE64 7172 …) yields even when its check digits fail. strict keeps both labels and lists CREDITCARD and FINANCIAL_ACCOUNT_NUMBER findings inside a reported IBAN under details.secondary_evidence; evaluations score primary findings only.
| Rule ID | Result entity group | Extra validator | Validator strength | Base | Context | Score (balanced/recall) |
|---|---|---|---|---|---|---|
pii_email |
EMAIL |
yes | format | 55 | key or proximity | 0.70–0.95 |
pii_ipv4 |
IP_ADDRESS |
yes | format | 50 | key or proximity | 0.65–0.90 |
pii_ipv6_full |
IP_ADDRESS |
yes | format | 50 | key or proximity | 0.65–0.90 |
pii_ipv6_compressed |
IP_ADDRESS |
yes | format | 50 | key or proximity | 0.65–0.90 |
pii_ipv6_loopback |
IP_ADDRESS |
yes | format | 40 | key or proximity | 0.55–0.80 |
pii_phone_international |
PHONE |
yes | format | 40 | key or proximity | 0.55–0.80 |
pii_phone_de |
PHONE |
yes | format | 45 | key or proximity | 0.60–0.85 |
pii_phone_de_national_context |
PHONE |
yes | format | 30 | field or key | 0.70 |
pii_phone_de_national_proximity |
PHONE |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_phone_us |
PHONE |
yes | format | 35 | key or proximity | 0.50–0.75 |
pii_phone_regional |
PHONE |
yes | format | 20 | key or proximity, balanced/recall only |
0.50–0.60 |
pii_mac_address |
MAC_ADDRESS |
yes | format | 55 | key or proximity | 0.70–0.95 |
pii_iban_de |
IBAN |
yes | checksum | 55 | key or proximity | 0.90–1.00 |
pii_iban_generic |
IBAN |
yes | checksum | 45 | key or proximity | 0.80–1.00 |
pii_credit_card |
CREDITCARD |
yes | checksum | 40 | key or proximity | 0.75–1.00 |
pii_credit_card_cvv |
CREDITCARD_CVV |
yes | format | 20 | field or key | 0.60 |
pii_credit_card_expiry |
CREDITCARD_EXPIRY |
yes | format | 25 | field or key | 0.65 |
pii_swift_bic_context |
SWIFT_CODE |
yes | format | 40 | field or key | 0.80 |
pii_employee_id |
EMPLOYEE_ID |
yes | format | 30 | field or key | 0.70 |
pii_employee_id_ocr_field |
EMPLOYEE_ID |
yes | format | 25 | field or key | 0.65 |
pii_employee_id_prefixed |
EMPLOYEE_ID |
yes | format | 45 | key or proximity | 0.60–0.85 |
pii_customer_id |
CUSTOMER_ID |
yes | format | 30 | field or key | 0.70 |
pii_patient_id |
PATIENT_ID |
yes | format | 30 | field or key | 0.70 |
pii_student_id |
STUDENT_ID |
yes | format | 30 | field or key | 0.70 |
pii_applicant_id |
APPLICANT_ID |
yes | format | 30 | field or key | 0.70 |
pii_username |
USERNAME |
yes | format | 30 | field or key | 0.70 |
pii_date_of_birth |
DOB |
yes | format | 40 | field or key | 0.80 |
pii_date_of_birth_written_day_first |
DOB |
yes | format | 45 | field or key | 0.85 |
pii_date_of_birth_written_month_first |
DOB |
yes | format | 45 | field or key | 0.85 |
pii_financial_account_number |
FINANCIAL_ACCOUNT_NUMBER |
yes | format | 30 | field or key | 0.70 |
pii_steuer_id_de |
STEUERID |
yes | checksum | 40 | field or key | 1.00 |
pii_steuer_id_de_context_free |
STEUERID |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_steuernummer_de |
TAX_NUMBER_DE |
yes | format | 35 | field or key | 0.75 |
pii_rentenversicherung_de |
SOCIALID |
yes | checksum | 30 | field or key | 0.90 |
pii_health_insurance_number_de |
HEALTH_INSURANCE_NUMBER |
yes | checksum | 25 | field or key | 0.85 |
pii_physician_number_lanr_de |
PHYSICIAN_NUMBER_LANR |
yes | checksum | 10 | field or key | 0.70 |
pii_passport_number_de |
PASSPORT_NUMBER |
yes | format | 40 | field or key | 0.80 |
pii_identity_card_number_de |
IDENTITY_CARD_NUMBER |
yes | format | 40 | field or key | 0.80 |
pii_driver_license_number_de |
DRIVER_LICENSE_NUMBER |
yes | format | 35 | field or key | 0.75 |
pii_driver_license_number_us |
DRIVER_LICENSE_NUMBER |
yes | format | 25 | field or key | 0.65 |
pii_driver_license_number_it |
DRIVER_LICENSE_NUMBER |
yes | format | 30 | field or key | 0.70 |
pii_driver_license_number_uk |
DRIVER_LICENSE_NUMBER |
yes | format | 35 | field or key | 0.75 |
pii_driver_license_number_uk_context_free |
DRIVER_LICENSE_NUMBER |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_kfz_kennzeichen_de |
LICENSEPLATE |
yes | format | 25 | field or key | 0.65 |
pii_vehicle_registration_uk |
LICENSEPLATE |
yes | format | 25 | field or key | 0.65 |
pii_vehicle_registration_uk_context_free |
LICENSEPLATE |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_vehicle_registration_ng |
LICENSEPLATE |
yes | format | 25 | key or proximity, balanced/recall only |
0.55–0.65 |
pii_vehicle_registration_uk_prefix |
LICENSEPLATE |
yes | format | 25 | key or proximity, balanced/recall only |
0.55–0.65 |
pii_vehicle_registration_uk_suffix |
LICENSEPLATE |
yes | format | 25 | key or proximity, balanced/recall only |
0.55–0.65 |
pii_vehicle_registration_in |
LICENSEPLATE |
yes | format | 25 | key or proximity, balanced/recall only |
0.55–0.65 |
pii_ssn_us |
SSN |
yes | format | 45 | field or key | 0.85 |
pii_ssn_us_proximity |
SSN |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_ssn_us_context_free |
SSN |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_ni_uk |
NATIONALID |
yes | format | 50 | field or key | 0.90 |
pii_ni_uk_context_free |
NATIONALID |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_nhs_number_uk |
NHS_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_passport_number_uk |
PASSPORT_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_passport_number_two_letters |
PASSPORT_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_passport_number_field |
PASSPORT_NUMBER |
yes | format | 40 | field or key | 0.80 |
pii_passport_number_us |
PASSPORT_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_passport_number_at_ch |
PASSPORT_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_identity_card_number_at_ch |
IDENTITY_CARD_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_identity_card_number_it |
IDENTITY_CARD_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_passport_number_es |
PASSPORT_NUMBER |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_vat_id_de |
VAT_ID_DE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_at |
VAT_ID_AT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_ch |
VAT_ID_CH |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_fr |
VAT_ID_FR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_nl |
VAT_ID_NL |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_be |
VAT_ID_BE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_it |
VAT_ID_IT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_it_proximity |
VAT_ID_IT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_vat_id_es |
VAT_ID_ES |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_es_proximity |
VAT_ID_ES |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_vat_id_lu |
VAT_ID_LU |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_lv |
VAT_ID_LV |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_mt |
VAT_ID_MT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_pl |
VAT_ID_PL |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_pl_proximity |
VAT_ID_PL |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_vat_id_pt |
VAT_ID_PT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_ro |
VAT_ID_RO |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_se |
VAT_ID_SE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_si |
VAT_ID_SI |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_sk |
VAT_ID_SK |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_no |
VAT_ID_NO |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_gb |
VAT_ID_GB |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_passport_number_de_context_free |
PASSPORT_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_passport_number_de_legacy |
PASSPORT_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_identity_card_number_de_context_free |
IDENTITY_CARD_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_identity_card_number_de_legacy |
IDENTITY_CARD_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_vat_id_bg |
VAT_ID_BG |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_cy |
VAT_ID_CY |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_cz |
VAT_ID_CZ |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_dk |
VAT_ID_DK |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_ee |
VAT_ID_EE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_el |
VAT_ID_EL |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_fi |
VAT_ID_FI |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_hr |
VAT_ID_HR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_hu |
VAT_ID_HU |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_ie |
VAT_ID_IE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_vat_id_lt |
VAT_ID_LT |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_abn_au |
AU_ABN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_abn_au_context_free |
AU_ABN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_acn_au |
AU_ACN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_tfn_au |
AU_TFN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_medicare_au |
AU_MEDICARE |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_medicare_au_context_free |
AU_MEDICARE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_nric_fin_sg |
SG_NRIC_FIN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_nric_fin_sg_context_free |
SG_NRIC_FIN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_uen_sg |
SG_UEN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_uen_sg_context_free |
SG_UEN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_rentenversicherung_de_context_free |
SOCIALID |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_health_insurance_number_de_context_free |
HEALTH_INSURANCE_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_physician_number_lanr_de_proximity |
PHYSICIAN_NUMBER_LANR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.70–0.80 |
pii_facility_number_bsnr_de |
FACILITY_NUMBER_BSNR |
yes | format | 20 | key or proximity (required) | 0.50–0.60 |
pii_personnummer_se |
SE_PERSONNUMMER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_personnummer_se_context_free |
SE_PERSONNUMMER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_cpr_dk |
DK_CPR |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_cpr_dk_context_free |
DK_CPR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_fodselsnummer_no |
NO_FODSELSNUMMER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_fodselsnummer_no_context_free |
NO_FODSELSNUMMER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_hetu_fi |
FI_PERSONAL_IDENTITY_CODE |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_hetu_fi_context_free |
FI_PERSONAL_IDENTITY_CODE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_steuernummer_de_context_free |
TAX_NUMBER_DE |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_aba_routing_number_us |
FINANCIAL_ACCOUNT_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_aba_routing_number_us_context_free |
FINANCIAL_ACCOUNT_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_bban_gb |
FINANCIAL_ACCOUNT_NUMBER |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_nir_fr |
FR_NIR |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_nir_fr_context_free |
FR_NIR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_siren_fr |
FR_SIREN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_siret_fr |
FR_SIRET |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_siret_fr_context_free |
FR_SIRET |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_bsn_nl |
NL_BSN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_bsn_nl_context_free |
NL_BSN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_national_number_be |
BE_NATIONAL_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_national_number_be_context_free |
BE_NATIONAL_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_organisationsnummer_se |
SE_ORGANISATIONSNUMMER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_organisationsnummer_se_context_free |
SE_ORGANISATIONSNUMMER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_sin_ca |
CA_SIN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_sin_ca_context_free |
CA_SIN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_national_id_tr |
TR_NATIONAL_ID |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_id_number_za |
ZA_ID_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_id_number_za_context_free |
ZA_ID_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_social_security_number_at |
AT_SOCIAL_SECURITY_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_social_security_number_at_context_free |
AT_SOCIAL_SECURITY_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_ahv_number_ch |
CH_AHV_NUMBER |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_ahv_number_ch_context_free |
CH_AHV_NUMBER |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_nif_pt |
PT_NIF |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_ppsn_ie |
IE_PPSN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_rrn_kr |
KR_RRN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_rrn_kr_context_free |
KR_RRN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_frn_kr |
KR_FRN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_frn_kr_context_free |
KR_FRN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_brn_kr |
KR_BRN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_brn_kr_context_free |
KR_BRN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_nif_es |
ES_NIF |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_nif_es_context_free |
ES_NIF |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_nie_es |
ES_NIE |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_nie_es_context_free |
ES_NIE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_fiscal_code_it |
IT_FISCAL_CODE |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_fiscal_code_it_context_free |
IT_FISCAL_CODE |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_pesel_pl |
PL_PESEL |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_regon_pl |
PL_REGON |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_aadhaar_in |
IN_AADHAAR |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_aadhaar_in_context_free |
IN_AADHAAR |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_gstin_in |
IN_GSTIN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_gstin_in_context_free |
IN_GSTIN |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_pan_in |
IN_PAN |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_voter_id_in |
IN_VOTER |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_dea_number_us |
MEDICAL_LICENSE |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_npi_us |
US_NPI |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_npi_us_context_free |
US_NPI |
yes | checksum | 20 | key or proximity, balanced/recall only |
0.55–0.80 |
pii_commercial_register_de |
COMMERCIAL_REGISTER_DE |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_commercial_register_de_context_free |
COMMERCIAL_REGISTER_DE |
yes | format | 35 | key or proximity, balanced/recall only |
0.50–0.75 |
pii_imei |
IMEI |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_meid |
MEID |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_iccid |
ICCID |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_imsi |
IMSI |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_vin |
VIN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_vin_format |
VIN |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_isin |
ISIN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_lei |
LEI |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_pzn_de |
DE_PZN |
yes | checksum | 25 | key or proximity (required) | 0.75–0.85 |
pii_crypto_btc |
CRYPTO |
yes | checksum | 30 | key or proximity | 0.65–0.90 |
pii_crypto_ltc |
CRYPTO |
yes | checksum | 30 | key or proximity | 0.65–0.90 |
pii_crypto_eth |
CRYPTO |
yes | checksum | 30 | key or proximity | 0.65–0.90 |
pii_crypto_eth_unchecked |
CRYPTO |
yes | format | 35 | key or proximity (required) | 0.65–0.75 |
pii_steuer_id_de_bare |
STEUERID |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_steuernummer_de_bare |
TAX_NUMBER_DE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_physician_number_lanr_de_bare |
PHYSICIAN_NUMBER_LANR |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_facility_number_bsnr_de_bare |
FACILITY_NUMBER_BSNR |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_driver_license_number_de_bare |
DRIVER_LICENSE_NUMBER |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_ssn_us_bare |
SSN |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_aba_routing_number_us_bare |
FINANCIAL_ACCOUNT_NUMBER |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_passport_number_us_bare |
PASSPORT_NUMBER |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_passport_number_two_letters_bare |
PASSPORT_NUMBER |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_passport_number_in_bare |
PASSPORT_NUMBER |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_sin_ca_bare |
CA_SIN |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_aadhaar_in_bare |
IN_AADHAAR |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_npi_us_bare |
US_NPI |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_pesel_pl_bare |
PL_PESEL |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_acn_au_bare |
AU_ACN |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_brn_kr_bare |
KR_BRN |
yes | checksum | 15 | none, opt-in (off by default) | 0.50–0.75 |
pii_pan_in_bare |
IN_PAN |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_voter_id_in_bare |
IN_VOTER |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_vehicle_registration_ng_bare |
LICENSEPLATE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_vehicle_registration_ng_lowercase_bare |
LICENSEPLATE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_vehicle_registration_uk_prefix_bare |
LICENSEPLATE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_vehicle_registration_uk_suffix_bare |
LICENSEPLATE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_vehicle_registration_in_bare |
LICENSEPLATE |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_ipv4_local_compat |
IP_ADDRESS |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_ipv6_local_compat |
IP_ADDRESS |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
pii_ssn_us_unassigned_compat |
SSN |
yes | format | 35 | none, opt-in (off by default) | 0.50–0.75 |
PII context lexicon¶
The context engine reads these DE/EN entries of ark-core/src/detectors/anchor_lexicons/pii.json (with their FR/ES/IT/NL field names where an entry lists them); ark-core/src/detectors/pii/context.rs maps them to labels. Support terms of a label count for rules without a field name of their own, a counter-context term counts for every label when it is nearer than every support term. As a structural key (a JSON key, CSV or table header, XML element), a term of either kind names the value it holds; keys are compared lowercased, with _, -, . and camelCase boundaries as spaces, optionally followed by no, nr, number or nummer. The key iban names no account number.
| Result entity group | Support anchors |
|---|---|
EMAIL |
pii.email_address |
IP_ADDRESS |
pii.network_address |
PHONE |
pii.telephone, pii.mobile_phone, pii.fax, pii.telephone_extension, pii.phone_reachability |
MAC_ADDRESS |
pii.hardware_address |
IBAN |
pii.bank_account |
CREDITCARD |
pii.payment_card |
CREDITCARD_CVV |
pii.card_verification |
CREDITCARD_EXPIRY |
pii.card_expiry |
SWIFT_CODE |
pii.bank_identifier |
EMPLOYEE_ID |
pii.employee_identifier |
CUSTOMER_ID |
pii.customer_identifier |
PATIENT_ID |
pii.patient_identifier |
STUDENT_ID |
pii.student_identifier |
APPLICANT_ID |
pii.applicant_identifier |
USERNAME |
pii.user_account |
DOB |
pii.date_of_birth |
FINANCIAL_ACCOUNT_NUMBER |
pii.bank_account, pii.brokerage_account, pii.bank_routing_number |
STEUERID |
pii.tax_identifier |
TAX_NUMBER_DE |
pii.tax_number |
SOCIALID |
pii.social_insurance_number |
HEALTH_INSURANCE_NUMBER |
pii.health_insurance_number |
PHYSICIAN_NUMBER_LANR |
pii.physician_number |
PASSPORT_NUMBER |
pii.passport |
IDENTITY_CARD_NUMBER |
pii.identity_card |
DRIVER_LICENSE_NUMBER |
pii.driver_license |
LICENSEPLATE |
pii.vehicle_registration |
SSN |
pii.social_insurance_number |
NATIONALID |
pii.national_insurance_number |
NHS_NUMBER |
pii.nhs_number |
VAT_ID_DE |
pii.vat_identifier |
VAT_ID_AT |
pii.vat_identifier |
VAT_ID_CH |
pii.vat_identifier |
VAT_ID_FR |
pii.vat_identifier |
VAT_ID_NL |
pii.vat_identifier |
VAT_ID_BE |
pii.vat_identifier |
VAT_ID_IT |
pii.vat_identifier |
VAT_ID_ES |
pii.vat_identifier, pii.es_cif |
VAT_ID_LU |
pii.vat_identifier |
VAT_ID_LV |
pii.vat_identifier |
VAT_ID_MT |
pii.vat_identifier |
VAT_ID_PL |
pii.pl_nip, pii.vat_identifier |
VAT_ID_PT |
pii.vat_identifier |
VAT_ID_RO |
pii.vat_identifier |
VAT_ID_SE |
pii.vat_identifier |
VAT_ID_SI |
pii.vat_identifier |
VAT_ID_SK |
pii.vat_identifier |
VAT_ID_NO |
pii.vat_identifier |
VAT_ID_GB |
pii.vat_identifier |
VAT_ID_BG |
pii.vat_identifier |
VAT_ID_CY |
pii.vat_identifier |
VAT_ID_CZ |
pii.vat_identifier |
VAT_ID_DK |
pii.vat_identifier |
VAT_ID_EE |
pii.vat_identifier |
VAT_ID_EL |
pii.vat_identifier |
VAT_ID_FI |
pii.vat_identifier |
VAT_ID_HR |
pii.vat_identifier |
VAT_ID_HU |
pii.vat_identifier |
VAT_ID_IE |
pii.vat_identifier |
VAT_ID_LT |
pii.vat_identifier |
AU_ABN |
pii.au_business_number |
AU_ACN |
pii.au_company_number |
AU_TFN |
pii.au_tax_file_number |
AU_MEDICARE |
pii.au_medicare_number |
SG_NRIC_FIN |
pii.sg_nric_fin |
SG_UEN |
pii.sg_unique_entity_number |
FACILITY_NUMBER_BSNR |
pii.facility_number |
SE_PERSONNUMMER |
pii.se_personnummer, pii.nordic_personal_number |
DK_CPR |
pii.dk_cpr, pii.nordic_personal_number |
NO_FODSELSNUMMER |
pii.no_fodselsnummer, pii.nordic_personal_number |
FI_PERSONAL_IDENTITY_CODE |
pii.fi_personal_identity_code |
FR_NIR |
pii.fr_social_security_number, pii.social_insurance_number |
FR_SIREN |
pii.fr_siren |
FR_SIRET |
pii.fr_siret |
NL_BSN |
pii.nl_citizen_service_number |
BE_NATIONAL_NUMBER |
pii.be_national_number |
SE_ORGANISATIONSNUMMER |
pii.se_organisationsnummer |
CA_SIN |
pii.ca_social_insurance_number |
TR_NATIONAL_ID |
pii.tr_national_id |
ZA_ID_NUMBER |
pii.za_id_number |
AT_SOCIAL_SECURITY_NUMBER |
pii.at_social_security_number, pii.social_insurance_number |
CH_AHV_NUMBER |
pii.ch_ahv_number, pii.social_insurance_number |
PT_NIF |
pii.pt_nif |
IE_PPSN |
pii.ie_ppsn |
KR_RRN |
pii.kr_resident_registration_number |
KR_FRN |
pii.kr_foreigner_registration_number |
KR_BRN |
pii.kr_business_registration_number |
ES_NIF |
pii.es_nif |
ES_NIE |
pii.es_nie |
IT_FISCAL_CODE |
pii.it_fiscal_code |
PL_PESEL |
pii.pl_pesel |
PL_REGON |
pii.pl_regon |
IN_AADHAAR |
pii.in_aadhaar |
IN_GSTIN |
pii.in_gstin |
IN_PAN |
pii.in_pan |
IN_VOTER |
pii.in_voter_id |
MEDICAL_LICENSE |
pii.us_dea_number |
US_NPI |
pii.us_npi |
COMMERCIAL_REGISTER_DE |
pii.commercial_register |
IMEI |
pii.imei |
MEID |
pii.meid |
ICCID |
pii.iccid |
IMSI |
pii.imsi |
VIN |
pii.vin |
ISIN |
pii.isin |
LEI |
pii.lei |
DE_PZN |
pii.de_pzn |
CRYPTO |
pii.crypto_wallet |
| Counter-context anchor | DE | EN |
|---|---|---|
pii.order_number |
bestellnummer, bestell-nummer, bestell_nummer, bestell nummer, bestellnr, bestell-nr, bestell nr, auftragsnummer, auftrags-nummer, auftrags_nummer, auftragsnr, auftrags-nr, auftrag nr, bestellung nr, bestellung #, kommissionsnummer, auftrags nummer, auftrags nr, bestell-id |
order number, order-number, order_number, order no, order id, order-id, order_id, order #, order ref, purchase order, po number, po no, order no., purchase order number |
pii.invoice_number |
rechnungsnummer, rechnungs-nummer, rechnungs_nummer, rechnungs nummer, rechnungsnr, rechnungs-nr, rechnung nr, belegnummer, beleg-nr, belegnr, quittungsnummer, gutschriftsnummer, rechnungs nr, beleg-nummer |
invoice number, invoice-number, invoice_number, invoice no, invoice id, invoice #, bill number, receipt number, receipt no, credit note number, invoice no., invoice-id, invoice_id |
pii.shipment_number |
sendungsnummer, sendungs-nummer, sendungs-nr, sendungsverfolgungsnummer, trackingnummer, tracking-nummer, paketnummer, paket-nr, lieferscheinnummer, lieferschein-nr, lieferscheinnr, frachtbriefnummer |
tracking number, tracking-number, tracking_number, tracking no, tracking id, tracking code, shipment number, shipment id, parcel number, consignment number, waybill number, delivery note number, tracking-id, tracking_id |
pii.ticket_number |
ticketnummer, ticket-nummer, ticket-nr, ticketnr, vorgangsnummer, vorgangs-nummer, vorgangs-nr, vorgangsnr, anfragenummer, störungsnummer, meldungsnummer, fallnummer |
ticket number, ticket-number, ticket_number, ticket no, ticket id, ticket #, case number, case id, case #, incident number, incident id, issue number, request id, request number |
pii.reference_number |
referenznummer, referenz-nummer, referenz-nr, buchungsnummer, buchungs-nummer, buchungs-nr, bestätigungsnummer, reservierungsnummer, transaktionsnummer, transaktions-nummer, transaktions-id, transaktions-nr, aktenzeichen, bestaetigungsnummer |
reference number, reference-number, reference_number, reference no, ref no, ref. no, booking reference, booking number, confirmation number, reservation number, transaction id, transaction-id, transaction_id, transaction number, transaction reference |
pii.product_number |
seriennummer, serien-nummer, serien-nr, seriennr, artikelnummer, artikel-nummer, artikel-nr, artikelnr, teilenummer, materialnummer, chargennummer, chargen-nr, losnummer, modellnummer, versionsnummer, build-nummer, teile-nr, produktnummer, produkt-nr, typennummer, ean, gtin |
serial number, serial-number, serial_number, serial no, part number, part-number, part no, article number, item number, sku, model number, batch number, lot number, version number, build number, item no, product id, product number, ean, gtin |
DLP regex rules (176)¶
Rust, Python, and the Ark API enable only credential/secret entity groups and the classification markings (dlp.document.classification_marking: VS/GEHEIM, corporate levels, Confidential/Restricted/Internal Only, TLP 2.0, NATO/EU) by default; every other content and document class is opt-in. A marking counts where it stands as a banner (upper case, alone on its line apart from markdown or comment decoration) or as the value of a classification key (Classification:, Einstufung:, sensitivity), with no template/example context and no other level of its family within 160 bytes. Set a rule to true to opt into a broader family. Low-level detector evaluate() calls bypass gateway execution gates and evaluate the full detector inventory.
Every credential/secret rule drops documented example and test values: a marker word (EXAMPLE, SAMPLE, BEISPIEL or MUSTER at the start or end of a word, not inside one such as resampler; TEST/TESTKEY, FAKE or DUMMY as a whole word; any marker repeated). Values mostly made of repeated chunks or same-character runs are dropped for fixed-format provider, key, hash, JWT, signed-URL and session-ID rules, also when a generic rule captures such a provider-shaped value. Values that need a single sequential run (AKIA1234567890ABCDEF) to count as low-variety, and low-variety values of generic credential assignments, are dropped only when the same or one of the three lines above calls the value an example, sample, dummy, fixture or documentation value (DE/EN).
Value-capturing credential rules (assignments, URL parameters and userinfo, signatures, auth headers, cookies, CSRF tokens, connection strings) also drop placeholders (<…>, masks, TODO, CHANGEME, REPLACE_ME, BITTE_AENDERN, all-upper or all-lower word sequences such as YOUR_…_HERE, HIER_…_EINTRAGEN, YOUR-API-TOKEN) and references ($VAR, ${…}, %VAR%, {{var}}, Terraform var.x, os.environ[…], os.Getenv, System.getenv, Environment.GetEnvironmentVariable, ENV.fetch, process.env.X and similar environment accessors). They also drop template syntaxes (%(name)s, {name}, %{name}, @name@, __NAME__, !NAME!, ((name)), YAML tags such as !secret and CloudFormation !Ref), secret-manager references (op://, ref+…://, @Microsoft.KeyVault(…), AWS Secrets Manager/SSM ARNs, GCP projects/…/secrets/…, /run/secrets/…), null/None, changeit, redaction words (REDACTED, ***REMOVED***, ***ENTFERNT***) and values that only name the credential (my-access-token, SECRET_PASSWORD).
Every credential/secret rule also drops the vendor-documented example values of research/dlp/documented_values.yaml (stored as SHA-256 of the normalized value) and JWTs with the documented example claims of jwt.io and RFC 7519; publicly known test keys listed there (Hardhat/Anvil default accounts) stay findings with severity test.
Each rule carries metadata v2, and every entry of matched_rules in the layer details reports it: provider for provider-bound formats, validator_strength (checksum: check digits verified; structure: decoded or parsed structure verified; format: fixed prefix, alphabet, length or syntax shape; none: keyword or context only), source_ref (gitleaks:<rule-id>, vendor or specification URL, or ark for in-house rules; see research/dlp/rule_sources.yaml) and, for credential/secret rules, severity (test for provider test/sandbox credentials such as Stripe sk_test_, otherwise live) and subtype (taxonomy v2: what the value is within its group, see DLP taxonomy). Provider, key and JWT rules drop values whose Shannon entropy is below 3.0 bits per character.
Prefix rules (provider tokens, dlp_eth_private_key, dlp_btc_wif, dlp_jwt_token) report a value only as a whole token: the characters right before and after it are no [A-Za-z0-9_] and none of the provider alphabet (- for base64url-style tokens), so a prefix inside an identifier (load_hf_…) or a hex run (Cargo.lock checksum, sha256 digest) is no finding. A value with a + or / neighbour inside a base64 run of at least 16 characters with upper case, lower case and digits (go.sum hash, npm integrity, data URI) is part of the blob. Escapes that end in a letter or digit (\n, \t, \uHHHH, \xHH, URL %HH) still delimit a token.
dlp_eth_private_key also needs a key context: 0x and 64 hex digits is as often a transaction or block hash, a state or Merkle root, an event topic or a CREATE2 salt, so the value counts only next to a key term (private key, privkey, secret key, signing key, mnemonic, keystore, privater/geheimer Schlüssel; on its own line also wallet, signer, accounts, pk, key, Schlüssel), and not where a hash, root, ID or chain-data term (tx hash, transactionHash, blockHash, Transaktionshash, checksum, Prüfsumme, root, Zustandswurzel, topic, salt, nonce, public key …) labels it. The context is the value's line and up to five lines above it, back to the previous hex value; a term after the value counts on its line within a short gap unless it names the next field. A label (only separators between term and value, also across line breaks) decides; without one, a key term proper anywhere in the context supports the value (chat replies, mail bodies), otherwise the nearest term decides. Wallet and signer terms count only on the value's line or as its label. The value must also be a secp256k1 scalar (1 ≤ k < n). The gate applies in every DLP mode.
dlp_btc_wif verifies Base58Check: the version byte of mainnet (0x80; 5… uncompressed, K…/L… compressed) or of testnet, signet and regtest (0xef; 9…, c…), a secp256k1 scalar (1 ≤ k < n) and the 0x01 flag of compressed keys. Testnet keys have severity test. The rule scores at checksum strength, so a bare WIF key stays in balanced; a nearer checksum, hash or ID term still drops it there.
dlp_bip39_seed_phrase reports BIP39 seed phrases: 12, 15, 18, 21 or 24 lowercase words of one official word list (English, Italian, Portuguese, Czech, Spanish, French; Spanish and French words with or without their accents, in NFC or NFD) whose checksum holds, in a line, comma-separated, as a quoted array, numbered or one word per line; the span runs from the first to the last word. A run of more than 27 list words is a word list; only its lines of 12 to 27 list words may hold phrases (two phrases on consecutive lines, a phrase before a line of list words). The published BIP39 test vectors and phrases that repeat more than two words are no findings, and 12- and 15-word phrases (4- and 5-bit checksum) also need numbered words or a context term (seed, mnemonic, recovery, phrase, wallet, backup, passphrase, Wiederherstellung …) in the 200 bytes before them.
dlp_github_token verifies the CRC32 of GitHub tokens: ghp_, gho_, ghu_, ghs_ or ghr_ and exactly 36 base62 characters, of which the last six are the CRC32 of the first 30 as base62 digits; dlp_github_pat takes github_pat_ and exactly 82 characters. A longer or shorter body is no token. The rule scores at checksum strength, so a bare token stays in balanced, also next to a counter term. A generic assignment, URL or header rule does not report a value that starts with a whole gh…_ token shape whose CRC32 fails.
dlp_npm_token verifies the CRC32 of npm tokens: npm_ and exactly 36 base62 characters, of which the last six are the CRC32 of the first 30, as for GitHub tokens; it scores at checksum strength, and a generic rule does not report an npm_ token shape whose CRC32 fails. dlp_gitlab_pat takes glpat- and exactly 20 characters or the routable form (payload, ., a two-character version and a seven-character base36 check value, which is not verified; or the current form with .01., the payload length as two base36 digits and a seven-digit base36 CRC32). dlp_gitlab_token takes the other documented GitLab prefixes with the lengths of the gitleaks rules: deploy (gldt-), runner (glrt-, or glrtr- when created through a registration token; also routable), workspace (glwt-, routable only), runner registration (GR1348941), pipeline trigger (glptt-, 40 lower-case hex digits), feed (glft-), incoming mail (glimt-), Kubernetes agent (glagent-), CI/CD job (glcbt-), SCIM (glsoat-) and feature flag client tokens (glffct-); dlp_gitlab_oauth_secret takes OAuth application secrets (gloas- and 64 characters) as API_KEY with subtype secret_key.
DevOps and package-registry tokens are SECRET_TOKEN with subtype access_token: dlp_dockerhub_token takes Docker Hub personal (dckr_pat_) and organization (dckr_oat_) access tokens with 27 base64url characters; dlp_pypi_token takes pypi- and the base64url of a Macaroon V2 for pypi.org or test.pypi.org (severity test) and parses it completely (version, header with location and identifier, caveat sections, 32-byte signature) at structure strength; dlp_rubygems_token takes rubygems_ and 48 lower-case hex digits; dlp_cratesio_token takes cio and 32 alphanumerics with upper- and lower-case letters; dlp_packagist_token takes the Private Packagist prefixes packagist_ort_, packagist_out_, packagist_uut_ and packagist_cut_, 60 hex digits and the CRC32 of prefix and random part as eight hex digits at checksum strength (a generic rule does not report a Packagist token shape whose CRC32 fails); dlp_jfrog_token takes Artifactory API keys (AKCp and 69 alphanumerics) and reference tokens (cmVmd and 59); dlp_terraform_cloud_token takes HCP Terraform tokens (14 alphanumerics, .atlasv1., 60 to 70 characters); dlp_pulumi_token takes pul- and 40 hex digits; dlp_vault_token takes Vault service (hvs., 90 to 120 characters) and batch tokens (hvb., 138 to 300); dlp_vault_legacy_token takes pre-1.10 service tokens (s. and 24 alphanumerics with both cases) only with vault on the value's line or up to five lines above it; dlp_doppler_token takes the documented Doppler prefixes (dp.pt., dp.ct., dp.st. with an optional scope, dp.sa., dp.said., dp.scim., dp.audit.) with 40 to 44 alphanumerics.
CI and hosting tokens carry the provider's entity group and subtype. Prefix rules with a token boundary: dlp_azure_devops_pat takes Azure DevOps PATs since 2024 (84 alphanumerics with the signature AZDO at positions 76 to 80, upper- and lower-case letters); dlp_circleci_token takes CircleCI personal (CCIPAT_) and project (CCIPRJ_) API tokens (a base58 UUID, _ and 40 hex digits); dlp_vercel_token takes the Vercel prefixes vcp_, vci_, vca_, vcr_ and vck_ with 56 alphanumerics of both cases; dlp_netlify_token takes nfp_ and 36 characters; dlp_flyio_token takes Fly.io OAuth tokens (fo1_ and 43 characters); dlp_heroku_api_key takes HRKU-AA and 58 characters; dlp_render_api_key takes rnd_ and 24 to 64 alphanumerics of both cases only with render on the value's line or up to five lines above it (Render documents no length); dlp_cloudflare_origin_ca_key takes v1.0-, 24 and 146 hex digits; dlp_digitalocean_token takes dop_v1_, doo_v1_ and dor_v1_ with 64 hex digits. dlp_flyio_macaroon_token takes Fly.io macaroon tokens (fm1a_, fm1r_, fm2_ and 100 to 4096 base64 characters) without a token boundary, since / and + belong to the token. Key-anchored rules report the value under a key that names the provider and ends in a credential noun right before the separator (TRAVIS_API_TOKEN=, "netlify_auth_token":, Heroku-API-Schlüssel:, Circle-Token:): dlp_bitbucket_client_secret (64 characters, API_KEY with subtype secret_key), dlp_azure_devops_legacy_pat (52 lower-case alphanumerics under azure devops, azdo or vsts), dlp_circleci_legacy_token (40 hex digits), dlp_travis_token (22 alphanumerics), dlp_vercel_legacy_token (24 alphanumerics), dlp_netlify_legacy_token (40 to 46 characters), dlp_heroku_legacy_api_key and dlp_railway_token (UUIDs) and dlp_cloudflare_api_key (API tokens with 40 characters, Global API Keys with 37 hex digits). IDs under provider keys without a credential noun (HEROKU_APP_ID, CIRCLE_SHA1, RAILWAY_PROJECT_ID, CLOUDFLARE_ZONE_ID) are no credentials.
Observability tokens and keys: tokens are SECRET_TOKEN with subtype access_token, keys API_KEY with subtype api_key. Prefix rules with a token boundary: dlp_newrelic_user_api_key takes NRAK- and 27 alphanumerics; dlp_newrelic_insert_key takes NRII- and 32 or 25 characters; dlp_newrelic_license_key takes 32 hex digits, or eu01xx and 26, and the suffix FFFFNRAL; dlp_sentry_user_token takes sntryu_ and 64 hex digits; dlp_grafana_service_account_token takes glsa_, 32 alphanumerics, _ and the CRC32 of everything before that _ as the hex of its little-endian bytes at checksum strength (a generic rule does not report a glsa_ shape whose CRC32 fails); dlp_dynatrace_token takes dt0c01 or dt0s01 to dt0s16, the 24-character public and the 64-character secret portion. Base64 tokens, without a token boundary since / and + belong to them, are decoded and parsed at structure strength: dlp_sentry_org_token (sntrys_, the base64 of a JSON payload with a numeric iat, _ and 43 base64 characters), dlp_grafana_api_key (the base64 of {"k","n","id"}, starting with eyJrIjoi) and dlp_grafana_cloud_token (glc_ and the base64 of a JSON object with the key in k). Key-anchored rules report a value under a key that names the provider and ends in a credential noun right before the separator: dlp_datadog_api_key (32 hex digits or 40 characters under datadog or a leading dd_/dd-/ddApi/ddApp; the public client token pub and 32 hex digits is no secret for any rule), dlp_newrelic_legacy_license_key (40 hex digits), dlp_sentry_auth_token (64 hex digits), dlp_splunk_hec_token (a GUID, also after Authorization: Splunk), dlp_elastic_api_key (id:api_key with 20 and 22 base64url characters or its base64, also after Authorization: ApiKey; decoded and split at structure strength), dlp_honeycomb_api_key (22 alphanumerics with both cases or 32 hex digits, also in the x-honeycomb-team header and OTEL_EXPORTER_OTLP_HEADERS) and dlp_pagerduty_api_key (20 characters with both cases or a 32-hex integration key; in the Token token= scheme, which Rails shares, only with pagerduty on the value's line or up to five lines above it). dlp_sentry_dsn_secret reports the secret key of a legacy DSN (https://<public key>:<secret key>@host/<project id>, API_KEY with subtype secret_key); a DSN with the public key only is safe to expose and no finding.
dlp_aws_access_key takes the credential prefixes of the IAM unique-ID table: AKIA (long-term), ASIA (temporary), ABIA (STS service bearer token), ACCA (context-specific credential) or legacy A3T and one more character, then exactly 16 Base32 characters (A-Z, 2-7). Group, user, role, policy and other unique IDs (AGPA, AIDA, AROA, ANPA …) are no credentials. dlp_aws_secret_key takes 40 base64 characters with upper and lower case letters as a whole run, only in structural AWS context: after an AWS key name or label (aws_secret_access_key, AwsSecretAccessKey, aws.secretKey, AWS-Secret-Access-Key, SecretAccessKey; in prose up to two lines on), right after an access key ID (SDK call, IAM credentials CSV, CLI), or after a generic secret_key, secret-key or secretKey with AWS context within five lines above or two below (an access key ID or access_key key, Terraform provider "aws" or backend "s3", amazonaws.com, aws as a name part). Hex digests, longer base64 runs and single-case values are no secret key.
The generic credential rules need password likeness. dlp_password_assignment and dlp_generic_credential_assignment drop a value that is a code expression (call, index or member access, Token::… path, type annotation such as str, string|null, Option<&str>, Arc<…>, format placeholder %s, ABNF repetition), a key or label ending in :, a file path, or that follows a shell variable used as key ($PWD:/work); a quoted value is a string literal and only checked for paths and stand-ins. A value of letters and _/-/. only is dropped if it is a DE/EN dictionary word sequence or word form (falsch, abgelaufen, stored, case-sensitive), names a credential in one naming convention (GIT_PASSWORD, passwordGenerator, clientSecret) or is a test stand-in (password, pass, topSecret, realtoken, foo001). A value with a digit or another symbol is never a word, so weak but real passwords (hunter2, Sommer2026!, P@ssw0rd, letmein, abcabcabcabc) stay findings. dlp_url_userinfo_password reads the password percent-decoded (p%40ss is p@ss) and drops stand-ins and credential names as passwords, also masked with leetspeak digits and symbols (user:pass, user:secret, user:p%40ssw%24rd, token:MY_GITHUB_TOKEN), and the pseudo-password x-oauth-basic; a chosen password keeps its encoded span; dlp_url_userinfo_token reports the token in the username of https://<token>:x-oauth-basic@… as SECRET_TOKEN (subtype access_token) if it has two character classes, at least 3 bits of entropy per character and no sequential or repeated runs.
Connection strings report the password per scheme. dlp_connection_string_password (subtype connection_string, structure strength) takes the password/pwd key of a ;-separated key/value string with a server, data source, address, host, DSN, driver or provider key or after a jdbc: URL (ADO.NET, ODBC with {…} values, OLE DB, JDBC SQL Server and DB2 properties), of a libpq keyword/value string with a host and a database, user or port (host=db dbname=app user=app password=…; keyword arguments of a call such as connect(host="db", password=…) are no libpq string), the password/pwd query parameter of a database or broker URL (jdbc:mysql://db/app?user=app&password=…, also & and & in XML; a web URL stays with dlp_credential_in_url) and the password of an Oracle thin/OCI URL (jdbc:oracle:thin:user/…@host). A bare value runs to the ;, a quote, the line end or the next libpq key= and may hold spaces. dlp_ldap_bind_password (subtype password) takes the LDAP simple-bind password of ldapsearch/ldapmodify/ldapadd/ldapdelete/ldappasswd/ldapwhoami/ldapcompare/ldapmodrdn/ldapexop -w, of bindpw/bind_pw/bindCredential keys, of SSSD ldap_default_authtok and of the Apache AuthLDAPBindPassword directive (a directive without = or : only at the start of its line); -W prompts and has no value. Both drop stand-ins and credential names, also in leetspeak (Password=password;, Pwd=s3cr3t;, -w secret, Password=myPassword;), and win the overlap against the generic assignment and URL parameter matches of the same value. dlp_url_userinfo_password also takes a userinfo without a username (redis://:…@host).
URL credentials. dlp_credential_in_url and the generic assignment drop a URL parameter that is a CSRF parameter itself, a token next to a pagination, cursor or CSRF parameter (page, per_page, cursor, offset, limit, after, before, _csrf, authenticity_token …) and the secret of an otpauth:// URI. dlp_signed_url_signature needs the structure of a signed URL: X-Amz-Signature or X-Goog-Signature next to another parameter of its scheme (Algorithm, Credential, Date, Expires), Signature next to Expires, Key-Pair-Id, Policy, AWSAccessKeyId or GoogleAccessId, Azure SAS sig next to sv and se or sp. Both take & and & as the parameter separator of XML and HTML attribute values and .config files, so an api_key, token or secret of <add value="https://…&api_key=…"> keeps dlp_credential_in_url instead of the generic assignment. dlp_auth_url_token (subtype auth_url) reports the token of an auth URL: OAuth access_token/id_token/refresh_token in a redirect query or fragment, an authorization code next to state or on a callback/redirect/oauth/authorize path, reset, magic-link, login, invitation, confirmation and verification tokens as a query parameter or a path segment (/reset-password/…, /invitations/accept/…, /einladung/…); the token looks issued (16+ characters, two character classes, 3 bits of entropy) and is no UUID or hex digest. dlp_otp_secret (subtype otp_secret, structure strength) reports the Base32 secret of an otpauth://totp or hotp URI and an upper-case Base32 seed after a TOTP/OTP/2FA/MFA/authenticator secret, seed or key name (in prose up to 40 characters before the :); the seed has at least 16 characters (80 bits), an RFC 4648 length or padding and no repeated or sequential runs, and the Key Uri Format example seed is a documented value.
Passwords on CLI command lines. dlp_cli_password (subtype password, format strength, structural credential tier) takes the password of curl -u/--user user:…, of the MySQL/MariaDB clients -p… (attached; -p db prompts) and --password=…, of a shell PGPASSWORD=…, sshpass -p, docker/podman login -p/--password (not --password-stdin), htpasswd in batch mode (-b: the last argument), PowerShell ConvertTo-SecureString with a quoted literal and -AsPlainText (also piped), and net use \\server\share with a password before or after /user:. The option may follow the tool within its line or \-continued lines, not past |, ; or &. Prompts (curl -u user, mysql -p db, net use … *), sshpass -e/-f, shell, CI and template references and stand-ins are no findings.
Credential files. dlp_netrc_password (subtype password, format strength, structural credential tier) takes the password of a .netrc/_netrc entry: machine <host> (a dotted name, an address or localhost) or default login <user>, up to three login/account/port pairs and password <value>, also one token per line; curl also reads a quoted value. dlp_docker_config_auth (subtype password, structure strength) takes the auth value of a Docker/Podman config.json/auth.json registry entry, also in an escaped .dockerconfigjson string, when it decodes to user:password like a Basic credential. References, stand-ins, empty and credential-helper entries are no findings. .npmrc _authToken/_password, .pypirc, Maven settings.xml, NuGet.Config and .s3cfg keys are covered by the generic assignment and AWS rules.
Before any regex runs, one Aho-Corasick pass finds the prefilter keywords of all rules (ASCII case-insensitive); a rule whose keywords are absent is skipped. The three rules without a literal have a structural prefilter instead: dlp_discord_token needs a run of 23 alphanumerics, dlp_btc_wif a run of 51 Base58 characters, dlp_bip39_seed_phrase an ASCII letter or digit, and its regex runs only where one pass over the words of the text finds a phrase. Where every match starts a bounded number of bytes before a keyword (for example dlp_generic_credential_assignment), the rule is only tried at those positions, in text order. Every gate is proven from the rule's regex, so the findings are the same as a full scan; a text with LONG S or KELVIN SIGN, which case-insensitive rules match for s and k, runs every rule on the whole text (rust/tests/dlp_rule_prefilter.rs).
Overlapping credential/secret findings keep one span: a span that only adds quotes or a trailing ;/, to a tighter span of the same tier gives way to it; a fixed-format match strictly inside a longer fixed-format value of another rule, or a match of a keywordless rule inside a longer secret value, is a substring artefact; then the tier decides — provider and key-material rules > platform-format tokens (JWT, bearer, CSRF, session cookie, URL signature) > password hashes > structural credentials (URL userinfo and parameters, Basic auth, connection strings, LDAP bind, CLI and credential-file passwords) > generic assignments —, within a tier the stronger validator, then the registry order. A generic key that is the userinfo of a URL (https://token:…@host) belongs to the URL credential. Suppressed matches stay in matched_rules with suppressed_by; identifier and content classes keep overlapping spans (see Evidence spans).
In the default strict DLP mode every finding scores 1.0. In balanced and recall (thresholds 0.50 and 0.30 as for PII) a finding scores the rule base plus the validator strength (checksum 35, structure 25, format 15, none 0) plus its context, capped at 100 and divided by 100: 25 for a field rule, which captures the value behind a field name of its own; for a proximity rule 25/20/15 for a credential term near the value (dlp.password, dlp.credentials, dlp.api_key, dlp.access_key, dlp.access_token, dlp.refresh_token, dlp.secret_token, dlp.client_secret, dlp.service_account_key, dlp.encryption_key, dlp.signing_key, dlp.private_key, dlp.secret, dlp.secret_environment_labels, dlp.database_connection, dlp.authorization_header, dlp.credential_files) and -30 when a digest, hash or ID term (dlp.digest_reference) is nearer; none rules score without context. A scored mode keeps the strict spans whose score reaches the threshold (see DLP score and modes). The score column shows the score without counter-context.
| Rule ID | Result entity group | Subtype | Provider | Validator | Source | Extra validator | Default | Base | Context | Score (balanced/recall) |
|---|---|---|---|---|---|---|---|---|---|---|
dlp_anthropic_key |
API_KEY |
api_key |
anthropic |
format |
gitleaks:anthropic-api-key |
yes | on | 55 | proximity | 0.70–0.95 |
dlp_openai_key |
API_KEY |
api_key |
openai |
format |
gitleaks:openai-api-key |
yes | on | 55 | proximity | 0.70–0.95 |
dlp_openai_legacy |
API_KEY |
api_key |
openai |
format |
gitleaks:openai-api-key |
yes | on | 45 | proximity | 0.60–0.85 |
dlp_openai_svc |
API_KEY |
api_key |
openai |
format |
gitleaks:openai-api-key |
yes | on | 55 | proximity | 0.70–0.95 |
dlp_huggingface |
API_KEY |
api_key |
huggingface |
format |
gitleaks:huggingface-access-token |
no | on | 45 | proximity | 0.60–0.85 |
dlp_groq_key |
API_KEY |
api_key |
groq |
format |
github.com | no | on | 50 | proximity | 0.65–0.90 |
dlp_xai_key |
API_KEY |
api_key |
xai |
format |
ark |
no | on | 50 | proximity | 0.65–0.90 |
dlp_replicate |
API_KEY |
api_key |
replicate |
format |
github.com | no | on | 45 | proximity | 0.60–0.85 |
dlp_perplexity_key |
API_KEY |
api_key |
perplexity |
format |
gitleaks:perplexity-api-key |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_cohere_key |
API_KEY |
api_key |
cohere |
format |
gitleaks:cohere-api-token |
yes | on | 40 | field | 0.80 |
dlp_openrouter_key |
API_KEY |
api_key |
openrouter |
format |
github.com | no | on | 50 | proximity | 0.65–0.90 |
dlp_deepseek_key |
API_KEY |
api_key |
deepseek |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_fireworks_key |
API_KEY |
api_key |
fireworks |
format |
github.com | yes | on | 45 | proximity | 0.60–0.85 |
dlp_langsmith_key |
API_KEY |
api_key |
langsmith |
format |
github.com | no | on | 50 | proximity | 0.65–0.90 |
dlp_pinecone_key |
API_KEY |
api_key |
pinecone |
format |
github.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_elevenlabs_key |
API_KEY |
api_key |
elevenlabs |
format |
github.com | no | on | 45 | proximity | 0.60–0.85 |
dlp_azure_openai_key |
API_KEY |
api_key |
azure_openai |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_wandb_key |
API_KEY |
api_key |
wandb |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_assemblyai_key |
API_KEY |
api_key |
assemblyai |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_deepgram_key |
API_KEY |
api_key |
deepgram |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_aws_access_key |
CLOUD_KEY |
api_key |
aws |
format |
gitleaks:aws-access-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_aws_secret_key |
CLOUD_KEY |
secret_key |
aws |
format |
docs.aws.amazon.com | yes | on | 35 | field | 0.75 |
dlp_google_api_key |
CLOUD_KEY |
api_key |
google |
format |
gitleaks:gcp-api-key |
no | on | 55 | proximity | 0.70–0.95 |
dlp_google_oauth_token |
CLOUD_KEY |
access_token |
google |
format |
developers.google.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_gcp_client_secret |
CLOUD_KEY |
secret_key |
google |
format |
github.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_azure_storage_account_key |
CLOUD_KEY |
secret_key |
azure |
structure |
github.com | yes | on | 50 | field | 1.00 |
dlp_azure_entra_client_secret |
CLOUD_KEY |
secret_key |
azure |
format |
gitleaks:azure-ad-client-secret |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_alibaba_access_key_id |
CLOUD_KEY |
api_key |
alibaba |
format |
gitleaks:alibaba-access-key-id |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_alibaba_secret_key |
CLOUD_KEY |
secret_key |
alibaba |
format |
gitleaks:alibaba-secret-key |
yes | on | 40 | field | 0.80 |
dlp_aws_bedrock_api_key |
CLOUD_KEY |
api_key |
aws |
structure |
gitleaks:aws-amazon-bedrock-api-key-long-lived |
yes | on | 50 | proximity | 0.75–1.00 |
dlp_ibm_cloud_api_key |
CLOUD_KEY |
api_key |
ibm |
format |
github.com | yes | on | 40 | field | 0.80 |
dlp_atlassian_api_token |
API_KEY |
api_key |
atlassian |
format |
gitleaks:atlassian-api-token |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_atlassian_legacy_api_token |
API_KEY |
api_key |
atlassian |
format |
gitleaks:atlassian-api-token |
yes | on | 40 | field | 0.80 |
dlp_notion_api_token |
API_KEY |
api_key |
notion |
format |
gitleaks:notion-api-token |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_linear_api_key |
API_KEY |
api_key |
linear |
format |
gitleaks:linear-api-key |
yes | on | 50 | proximity | 0.65–0.90 |
dlp_linear_client_secret |
API_KEY |
secret_key |
linear |
format |
gitleaks:linear-client-secret |
no | on | 40 | field | 0.80 |
dlp_airtable_pat |
API_KEY |
api_key |
airtable |
format |
gitleaks:airtable-personnal-access-token |
no | on | 50 | proximity | 0.65–0.90 |
dlp_airtable_api_key |
API_KEY |
api_key |
airtable |
format |
gitleaks:airtable-api-key |
yes | on | 40 | field | 0.80 |
dlp_postman_api_key |
API_KEY |
api_key |
postman |
format |
gitleaks:postman-api-token |
no | on | 50 | proximity | 0.65–0.90 |
dlp_mapbox_secret_token |
API_KEY |
api_key |
mapbox |
format |
github.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_github_token |
SECRET_TOKEN |
access_token |
github |
checksum |
gitleaks:github-pat |
yes | on | 55 | proximity | 0.90–1.00 |
dlp_github_pat |
SECRET_TOKEN |
access_token |
github |
format |
gitleaks:github-fine-grained-pat |
no | on | 60 | proximity | 0.75–1.00 |
dlp_gitlab_pat |
SECRET_TOKEN |
access_token |
gitlab |
format |
gitleaks:gitlab-pat |
no | on | 55 | proximity | 0.70–0.95 |
dlp_gitlab_token |
SECRET_TOKEN |
access_token |
gitlab |
format |
docs.gitlab.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_gitlab_oauth_secret |
API_KEY |
secret_key |
gitlab |
format |
gitleaks:gitlab-oauth-app-secret |
no | on | 55 | proximity | 0.70–0.95 |
dlp_npm_token |
SECRET_TOKEN |
access_token |
npm |
checksum |
gitleaks:npm-access-token |
yes | on | 50 | proximity | 0.85–1.00 |
dlp_dockerhub_token |
SECRET_TOKEN |
access_token |
dockerhub |
format |
docs.docker.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_pypi_token |
SECRET_TOKEN |
access_token |
pypi |
structure |
gitleaks:pypi-upload-token |
yes | on | 50 | proximity | 0.75–1.00 |
dlp_rubygems_token |
SECRET_TOKEN |
access_token |
rubygems |
format |
gitleaks:rubygems-api-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_cratesio_token |
SECRET_TOKEN |
access_token |
cratesio |
format |
github.com | yes | on | 45 | proximity | 0.60–0.85 |
dlp_packagist_token |
SECRET_TOKEN |
access_token |
packagist |
checksum |
packagist.com | yes | on | 50 | proximity | 0.85–1.00 |
dlp_jfrog_token |
SECRET_TOKEN |
access_token |
jfrog |
format |
gitleaks:artifactory-api-key |
no | on | 55 | proximity | 0.70–0.95 |
dlp_terraform_cloud_token |
SECRET_TOKEN |
access_token |
terraform_cloud |
format |
gitleaks:hashicorp-tf-api-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_pulumi_token |
SECRET_TOKEN |
access_token |
pulumi |
format |
gitleaks:pulumi-api-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_vault_token |
SECRET_TOKEN |
access_token |
vault |
format |
gitleaks:vault-service-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_vault_legacy_token |
SECRET_TOKEN |
access_token |
vault |
format |
gitleaks:vault-service-token |
yes | on | 40 | proximity | 0.55–0.80 |
dlp_doppler_token |
SECRET_TOKEN |
access_token |
doppler |
format |
docs.doppler.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_bitbucket_client_secret |
API_KEY |
secret_key |
bitbucket |
format |
gitleaks:bitbucket-client-secret |
no | on | 40 | field | 0.80 |
dlp_azure_devops_pat |
SECRET_TOKEN |
access_token |
azure_devops |
format |
learn.microsoft.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_azure_devops_legacy_pat |
SECRET_TOKEN |
access_token |
azure_devops |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_circleci_token |
SECRET_TOKEN |
access_token |
circleci |
format |
circleci.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_circleci_legacy_token |
SECRET_TOKEN |
access_token |
circleci |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_travis_token |
SECRET_TOKEN |
access_token |
travisci |
format |
gitleaks:travisci-access-token |
no | on | 40 | field | 0.80 |
dlp_vercel_token |
CLOUD_KEY |
access_token |
vercel |
format |
vercel.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_vercel_legacy_token |
CLOUD_KEY |
access_token |
vercel |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_netlify_token |
CLOUD_KEY |
access_token |
netlify |
format |
github.com | yes | on | 50 | proximity | 0.65–0.90 |
dlp_netlify_legacy_token |
CLOUD_KEY |
access_token |
netlify |
format |
gitleaks:netlify-access-token |
no | on | 40 | field | 0.80 |
dlp_flyio_token |
CLOUD_KEY |
access_token |
flyio |
format |
gitleaks:flyio-access-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_flyio_macaroon_token |
CLOUD_KEY |
access_token |
flyio |
format |
gitleaks:flyio-access-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_heroku_api_key |
CLOUD_KEY |
api_key |
heroku |
format |
gitleaks:heroku-api-key-v2 |
no | on | 55 | proximity | 0.70–0.95 |
dlp_heroku_legacy_api_key |
CLOUD_KEY |
api_key |
heroku |
format |
gitleaks:heroku-api-key |
no | on | 40 | field | 0.80 |
dlp_render_api_key |
CLOUD_KEY |
api_key |
render |
format |
render.com | yes | on | 40 | proximity | 0.55–0.80 |
dlp_railway_token |
CLOUD_KEY |
access_token |
railway |
format |
github.com | no | on | 40 | field | 0.80 |
dlp_cloudflare_api_key |
CLOUD_KEY |
api_key |
cloudflare |
format |
gitleaks:cloudflare-api-key |
no | on | 40 | field | 0.80 |
dlp_cloudflare_origin_ca_key |
CLOUD_KEY |
api_key |
cloudflare |
format |
gitleaks:cloudflare-origin-ca-key |
no | on | 55 | proximity | 0.70–0.95 |
dlp_digitalocean_token |
CLOUD_KEY |
access_token |
digitalocean |
format |
gitleaks:digitalocean-pat |
no | on | 55 | proximity | 0.70–0.95 |
dlp_datadog_api_key |
API_KEY |
api_key |
datadog |
format |
gitleaks:datadog-access-token |
no | on | 40 | field | 0.80 |
dlp_newrelic_user_api_key |
API_KEY |
api_key |
newrelic |
format |
gitleaks:new-relic-user-api-key |
no | on | 55 | proximity | 0.70–0.95 |
dlp_newrelic_insert_key |
API_KEY |
api_key |
newrelic |
format |
gitleaks:new-relic-insert-key |
no | on | 55 | proximity | 0.70–0.95 |
dlp_newrelic_license_key |
API_KEY |
api_key |
newrelic |
format |
github.com | no | on | 50 | proximity | 0.65–0.90 |
dlp_newrelic_legacy_license_key |
API_KEY |
api_key |
newrelic |
format |
docs.newrelic.com | no | on | 40 | field | 0.80 |
dlp_sentry_user_token |
SECRET_TOKEN |
access_token |
sentry |
format |
gitleaks:sentry-user-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_sentry_org_token |
SECRET_TOKEN |
access_token |
sentry |
structure |
gitleaks:sentry-org-token |
yes | on | 50 | proximity | 0.75–1.00 |
dlp_sentry_auth_token |
SECRET_TOKEN |
access_token |
sentry |
format |
gitleaks:sentry-access-token |
no | on | 40 | field | 0.80 |
dlp_sentry_dsn_secret |
API_KEY |
secret_key |
sentry |
format |
docs.sentry.io | no | on | 50 | field | 0.90 |
dlp_grafana_api_key |
SECRET_TOKEN |
access_token |
grafana |
structure |
gitleaks:grafana-api-key |
yes | on | 50 | proximity | 0.75–1.00 |
dlp_grafana_cloud_token |
SECRET_TOKEN |
access_token |
grafana |
structure |
gitleaks:grafana-cloud-api-token |
yes | on | 50 | proximity | 0.75–1.00 |
dlp_grafana_service_account_token |
SECRET_TOKEN |
access_token |
grafana |
checksum |
github.com | yes | on | 55 | proximity | 0.90–1.00 |
dlp_dynatrace_token |
SECRET_TOKEN |
access_token |
dynatrace |
format |
docs.dynatrace.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_splunk_hec_token |
SECRET_TOKEN |
access_token |
splunk |
format |
docs.splunk.com | no | on | 40 | field | 0.80 |
dlp_elastic_api_key |
API_KEY |
api_key |
elastic |
structure |
www.elastic.co | yes | on | 45 | field | 0.95 |
dlp_honeycomb_api_key |
API_KEY |
api_key |
honeycomb |
format |
github.com | yes | on | 40 | field | 0.80 |
dlp_pagerduty_api_key |
API_KEY |
api_key |
pagerduty |
format |
github.com | yes | on | 40 | field | 0.80 |
dlp_stripe_key |
PAYMENT_KEY |
api_key |
stripe |
format |
gitleaks:stripe-access-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_stripe_webhook |
PAYMENT_KEY |
secret_key |
stripe |
format |
docs.stripe.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_slack_token |
SECRET_TOKEN |
access_token |
slack |
format |
api.slack.com | no | on | 55 | proximity | 0.70–0.95 |
dlp_slack_app_token |
SECRET_TOKEN |
access_token |
slack |
format |
gitleaks:slack-app-token |
no | on | 55 | proximity | 0.70–0.95 |
dlp_discord_token |
SECRET_TOKEN |
access_token |
discord |
structure |
github.com | yes | on | 35 | proximity | 0.60–0.85 |
dlp_eth_private_key |
CRYPTO_KEY |
private_key |
ethereum |
format |
ethereum.org | yes | on | 25 | proximity | 0.40–0.65 |
dlp_btc_wif |
CRYPTO_KEY |
private_key |
bitcoin |
checksum |
en.bitcoin.it | yes | on | 30 | proximity | 0.65–0.90 |
dlp_bip32_extended_private_key |
CRYPTO_KEY |
private_key |
bitcoin |
checksum |
github.com | yes | on | 30 | proximity | 0.65–0.90 |
dlp_eth_keystore_ciphertext |
CRYPTO_KEY |
private_key |
ethereum |
format |
ethereum.org | no | on | 30 | field | 0.70 |
dlp_solana_keypair |
CRYPTO_KEY |
private_key |
solana |
format |
solana.com | yes | on | 25 | field | 0.65 |
dlp_electrum_seed |
CRYPTO_KEY |
seed_phrase |
bitcoin |
checksum |
electrum.readthedocs.io | yes | on | 30 | field | 0.90 |
dlp_monero_seed |
CRYPTO_KEY |
seed_phrase |
monero |
checksum |
github.com | yes | on | 30 | field | 0.90 |
dlp_cardano_signing_key |
CRYPTO_KEY |
private_key |
cardano |
checksum |
cips.cardano.org | yes | on | 30 | proximity | 0.65–0.90 |
dlp_bip39_seed_phrase |
CRYPTO_KEY |
seed_phrase |
– | checksum |
github.com | yes | on | 30 | proximity | 0.65–0.90 |
dlp_private_key_block |
PRIVATE_KEY |
private_key |
– | structure |
gitleaks:private-key |
yes | on | 70 | proximity | 0.95–1.00 |
dlp_private_key_header |
PRIVATE_KEY |
private_key |
– | format |
gitleaks:private-key |
no | on | 50 | proximity | 0.65–0.90 |
dlp_jwk_private_key |
PRIVATE_KEY |
private_key |
– | structure |
datatracker.ietf.org | yes | on | 70 | proximity | 0.95–1.00 |
dlp_wireguard_private_key |
PRIVATE_KEY |
private_key |
wireguard |
structure |
www.wireguard.com | yes | on | 50 | field | 1.00 |
dlp_openvpn_static_key |
CRYPTO_KEY |
private_key |
openvpn |
structure |
openvpn.net | yes | on | 70 | proximity | 0.95–1.00 |
dlp_ipsec_psk |
CRYPTO_KEY |
private_key |
– | none |
docs.strongswan.org | no | on | 40 | field | 0.65 |
dlp_symmetric_key |
CRYPTO_KEY |
private_key |
– | structure |
docs.openssl.org | yes | on | 40 | field | 0.90 |
dlp_laravel_app_key |
CRYPTO_KEY |
private_key |
laravel |
structure |
laravel.com | yes | on | 50 | field | 1.00 |
dlp_django_secret_key |
CRYPTO_KEY |
private_key |
django |
format |
docs.djangoproject.com | yes | on | 45 | field | 0.85 |
dlp_rails_secret_key_base |
CRYPTO_KEY |
private_key |
rails |
format |
guides.rubyonrails.org | yes | on | 50 | field | 0.90 |
dlp_jwt_token |
SECRET_TOKEN |
access_token |
– | structure |
gitleaks:jwt |
yes | on | 45 | proximity | 0.70–0.95 |
dlp_credential_in_url |
CREDENTIAL |
auth_url |
– | none |
ark |
yes | on | 25 | field | 0.50 |
dlp_auth_url_token |
CREDENTIAL |
auth_url |
– | none |
www.rfc-editor.org | yes | on | 25 | field | 0.50 |
dlp_otp_secret |
CREDENTIAL |
otp_secret |
– | structure |
github.com | yes | on | 30 | field | 0.80 |
dlp_env_var_secret |
CREDENTIAL |
generic_secret |
– | none |
ark |
yes | on | 35 | field | 0.60 |
dlp_password_assignment |
CREDENTIAL |
password |
– | none |
ark |
yes | on | 35 | field | 0.60 |
dlp_generic_credential_assignment |
CREDENTIAL |
generic_secret |
– | none |
ark |
yes | on | 30 | field | 0.55 |
dlp_prose_password |
CREDENTIAL |
password |
– | none |
ark |
yes | on | 30 | field | 0.55 |
dlp_prose_secret |
CREDENTIAL |
generic_secret |
– | none |
ark |
yes | on | 30 | field | 0.55 |
dlp_bearer_token |
SECRET_TOKEN |
access_token |
– | format |
www.rfc-editor.org | yes | on | 35 | field | 0.75 |
dlp_basic_auth |
CREDENTIAL |
password |
– | structure |
www.rfc-editor.org | yes | on | 35 | field | 0.85 |
dlp_signed_url_signature |
CREDENTIAL |
signature |
– | none |
docs.aws.amazon.com | yes | on | 25 | field | 0.50 |
dlp_session_cookie |
CREDENTIAL |
session_token |
– | none |
ark |
yes | on | 30 | field | 0.55 |
dlp_csrf_token |
SECRET_TOKEN |
session_token |
– | none |
ark |
yes | on | 25 | field | 0.50 |
dlp_password_hash |
PASSWORD_HASH |
password_hash |
– | format |
ark |
yes | on | 35 | field | 0.75 |
dlp_url_userinfo_password |
CREDENTIAL |
password |
– | none |
ark |
yes | on | 35 | field | 0.60 |
dlp_url_userinfo_token |
SECRET_TOKEN |
access_token |
– | none |
github.blog | yes | on | 35 | field | 0.60 |
dlp_connection_string_password |
CREDENTIAL |
connection_string |
– | structure |
learn.microsoft.com | yes | on | 35 | field | 0.85 |
dlp_ldap_bind_password |
CREDENTIAL |
password |
– | format |
www.openldap.org | yes | on | 35 | field | 0.75 |
dlp_cli_password |
CREDENTIAL |
password |
– | format |
curl.se | yes | on | 35 | field | 0.75 |
dlp_netrc_password |
CREDENTIAL |
password |
– | format |
www.gnu.org | yes | on | 35 | field | 0.75 |
dlp_docker_config_auth |
CREDENTIAL |
password |
– | structure |
docs.docker.com | yes | on | 35 | field | 0.85 |
dlp_de_vat_id |
dlp.de.vat_id |
– | – | format |
ark |
no | off | 30 | field | 0.70 |
dlp_de_commercial_register_number |
dlp.de.commercial_register_number |
– | – | format |
ark |
yes | off | 30 | field | 0.70 |
dlp_de_facility_number_bsnr |
dlp.de.facility_number_bsnr |
– | – | format |
ark |
no | off | 30 | field | 0.70 |
dlp_record_case_id |
dlp.record.case_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_record_contract_id |
dlp.record.contract_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_record_claim_id |
dlp.record.claim_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_record_order_id |
dlp.record.order_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_record_invoice_id |
dlp.record.invoice_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_project_id |
dlp.project_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_organization_id |
dlp.organization_id |
– | – | none |
ark |
yes | off | 30 | field | 0.55 |
dlp_internal_business_metric |
dlp.internal.business_metric |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_database_dump_insert |
dlp.content.database_dump |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_source_code_fence |
dlp.content.source_code |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_source_code_statement |
dlp.content.source_code |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_source_code_python_rust_assignment |
dlp.content.source_code |
– | – | format |
ark |
yes | off | 40 | none | 0.55 |
dlp_source_code_declaration |
dlp.content.source_code |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_source_code_import |
dlp.content.source_code |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_sql_statement |
dlp.content.sql |
– | – | structure |
ark |
yes | off | 30 | none | 0.55 |
dlp_sql_multiline_statement |
dlp.content.sql |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_database_dump_header |
dlp.content.database_dump |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_stacktrace_block |
dlp.content.system_log |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_structured_system_log |
dlp.content.system_log |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_legal_privileged |
dlp.document.legal_privileged |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_unpublished_financials |
dlp.document.unpublished_financials |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_m_and_a |
dlp.document.m_and_a |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_board_minutes |
dlp.document.board_minutes |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_nda_trade_secret |
dlp.document.nda_trade_secret |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_contract |
dlp.document.contract |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_hr |
dlp.document.hr |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_security_report |
dlp.document.security_report |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_export_control |
dlp.document.export_control |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_document_rnd_ip |
dlp.document.rnd_ip |
– | – | format |
ark |
no | off | 40 | none | 0.55 |
dlp_marking_de_government |
dlp.document.classification_marking |
– | – | format |
ark |
no | on | 40 | none | 0.55 |
dlp_marking_de_corporate |
dlp.document.classification_marking |
– | – | format |
ark |
no | on | 40 | none | 0.55 |
dlp_marking_en_corporate |
dlp.document.classification_marking |
– | – | format |
ark |
no | on | 40 | none | 0.55 |
dlp_marking_tlp |
dlp.document.classification_marking |
– | – | format |
ark |
no | on | 40 | none | 0.55 |
dlp_marking_nato_eu |
dlp.document.classification_marking |
– | – | format |
ark |
no | on | 40 | none | 0.55 |
DLP relationship rules (5)¶
These rules use the shared source-bound component contract and emit finding spans. Their evidence includes action/target relations or MCP tool/argument components.
| Rule ID | Model gate | Default |
|---|---|---|
dlp_sensitive_material |
native:sensitive_material |
on |
dlp_secret_transfer |
native:secret_transfer |
on |
dlp_mcp_runtime_risk |
native:mcp_runtime_risk |
off |
dlp_mcp_policy |
native:mcp_policy |
off |
dlp_destructive_operation |
native:destructive_operation |
off |
Injection rules (57)¶
Injection rule IDs gate versioned catalog entries, native evidence producers, and the structural producer. Several source rules can intentionally share one canonical ID; the table lists each effective gate once.
| Rule ID | Family | Description | Source |
|---|---|---|---|
ark.injection.agentic.control_abuse |
agentic_control_abuse |
Native producer gate for native:agentic_control_abuse. | ark-native-injection-71ff48e |
ark.injection.authority.claim |
authority_escalation |
Claim to be developer/admin | prompt-armor-complete-95e532e |
ark.injection.authority.escalation |
authority_escalation |
Native producer gate for native:authority_escalation. | ark-native-injection-71ff48e |
ark.injection.authority.fake_system_asset_transfer |
authority_escalation |
Uses a fake system or administrator authority marker to mandate a concrete crypto-asset transfer | source-derived-coverage-0.1.6 |
ark.injection.boundary.delimited_replacement_action |
instruction_boundary |
Uses a synthetic delimiter boundary before a replacement instruction and action | source-derived-p0-0.1.6 |
ark.injection.boundary.delimiter |
instruction_boundary |
Native producer gate for native:instruction_boundary. | ark-native-injection-71ff48e |
ark.injection.boundary.fake_system |
instruction_boundary |
Fake system prompt injection | prompt-armor-complete-95e532e |
ark.injection.boundary.persona_directive |
instruction_boundary |
Forged system-role boundary followed by an unsafe persona directive | source-derived-coverage-0.1.6 |
ark.injection.covert.execution |
covert_instruction |
Native producer gate for native:covert_instruction. | ark-native-injection-71ff48e |
ark.injection.cross_tool.override_action |
cross_tool_instruction |
Native producer gate for native:cross_tool_instruction. | ark-native-injection-71ff48e |
ark.injection.cross_tool.override_then_call |
cross_tool_instruction |
Overrides the user or prior instructions in order to invoke another tool | source-derived-coverage-0.1.6 |
ark.injection.escalation.multi_turn |
multi_turn_escalation |
Native producer gate for native:multi_turn_escalation. | ark-native-injection-71ff48e |
ark.injection.escalation.prior_bypass_agreement |
multi_turn_escalation |
Claims prior agreement to bypass active safety restrictions | source-derived-coverage-0.1.6 |
ark.injection.exfil.external_sink |
cross_tool_instruction |
Send data to external URL/email | prompt-armor-complete-95e532e |
ark.injection.exfil.sensitive_path_external_sink_audited |
cross_tool_instruction |
Reads a sensitive credential path and transfers it to an explicit external network destination | source-derived-p0-0.1.6 |
ark.injection.exfil.sensitive_path_to_sink |
cross_tool_instruction |
Reads a sensitive credential path and directs its contents to an output or transfer sink | source-derived-p0-0.1.6 |
ark.injection.guardrail.disable_directive |
guardrail_tamper |
Imperative bypass of explicit safety controls | source-derived-coverage-0.1.6 |
ark.injection.guardrail.tamper |
guardrail_tamper |
Native producer gate for native:guardrail_tamper. | ark-native-injection-71ff48e |
ark.injection.identity.reassign |
jailbreak_framing |
Identity reassignment | prompt-armor-complete-95e532e |
ark.injection.jailbreak.dual_response |
jailbreak_framing |
Dual response mode (classic DAN pattern) | prompt-armor-complete-95e532e |
ark.injection.jailbreak.framing |
jailbreak_framing |
Native producer gate for native:jailbreak_framing. | ark-native-injection-71ff48e |
ark.injection.jailbreak.game_framing |
jailbreak_framing |
Game-based jailbreak opening | prompt-armor-complete-95e532e |
ark.injection.jailbreak.named_mode |
jailbreak_framing |
Known jailbreak persona names | prompt-armor-complete-95e532e |
ark.injection.jailbreak.remove_constraints |
jailbreak_framing |
Bypass restrictions/safety | prompt-armor-complete-95e532e |
ark.injection.leak.hidden_instructions |
instruction_leak |
Native producer gate for native:instruction_leak. | ark-native-injection-71ff48e |
ark.injection.leak.own_prompt |
instruction_leak |
Disclosure of the assistant own prompt | source-derived-coverage-0.1.6 |
ark.injection.leak.system_instructions |
instruction_leak |
Request to reveal system prompt | prompt-armor-complete-95e532e |
ark.injection.leak.system_prompt_extraction |
instruction_leak |
Directly requests disclosure of the assistant's system or initialization instructions | source-derived-coverage-0.1.6 |
ark.injection.obfuscation.binary_smuggling |
binary_smuggling |
Native producer gate for native:binary_smuggling. | ark-native-injection-71ff48e |
ark.injection.obfuscation.decode_for_instructions |
encoded_instruction |
Directs decoding an opaque message specifically to obtain instructions | source-derived-coverage-0.1.6 |
ark.injection.obfuscation.decode_request |
encoded_instruction |
Encoded message decode request | prompt-armor-complete-95e532e |
ark.injection.obfuscation.decode_then_execute |
encoded_instruction |
Directs the model to decode an encoded payload and execute or follow it | source-derived-p0-0.1.6 |
ark.injection.obfuscation.encoded_instruction |
encoded_instruction |
Native producer gate for native:encoded_instruction. | ark-native-injection-71ff48e |
ark.injection.obfuscation.encoded_instruction_payload |
encoded_instruction |
Requests decoding of a supplied payload containing an instruction override or prompt disclosure | source-derived-coverage-0.1.6 |
ark.injection.obfuscation.escaped_instruction_payload |
encoded_instruction |
Requests decoding a Unicode-escaped instruction override or prompt disclosure | source-derived-coverage-0.1.6 |
ark.injection.obfuscation.hidden_html |
hidden_html_instruction |
Native producer gate for native:hidden_html_instruction. | ark-native-injection-71ff48e |
ark.injection.obfuscation.steganographic |
encoded_instruction |
Acrostic/steganographic instruction | prompt-armor-complete-95e532e |
ark.injection.obfuscation.unicode_confusable |
unicode_confusable |
Native producer gate for native:unicode_confusable. | ark-native-injection-71ff48e |
ark.injection.obfuscation.zero_width |
zero_width_obfuscation |
Native producer gate for native:zero_width_obfuscation. | ark-native-injection-71ff48e |
ark.injection.output.forced_marker |
output_manipulation |
Native producer gate for native:output_manipulation. | ark-native-injection-71ff48e |
ark.injection.output.ignore_then_fixed_output |
output_manipulation |
Overrides surrounding instructions and restricts the response to attacker-chosen output | source-derived-coverage-0.1.6 |
ark.injection.override.authority_issued_replacement |
instruction_override |
Claims that an authority issued replacement instructions and demands an action | source-derived-p0-0.1.6 |
ark.injection.override.discard_prior |
instruction_override |
Ignore previous instructions pattern | prompt-armor-complete-95e532e |
ark.injection.override.ethical_parameters |
instruction_override |
Reset existing ethical constraints | source-derived-coverage-0.1.6 |
ark.injection.override.hierarchy |
instruction_override |
Native producer gate for native:instruction_override. | ark-native-injection-71ff48e |
ark.injection.override.hierarchy_then_direct_action |
instruction_override |
Discards an instruction-hierarchy constraint and immediately requests a replacement action | source-derived-coverage-0.1.6 |
ark.injection.override.obfuscated_discard |
instruction_override |
Ignore what I said before (incl. typos) | prompt-armor-complete-95e532e |
ark.injection.override.prior_reference |
instruction_override |
Override an explicit prior-context reference | source-derived-coverage-0.1.6 |
ark.injection.override.replacement_directive |
instruction_override |
New instructions declaration | prompt-armor-complete-95e532e |
ark.injection.skillspector.anti_refusal |
jailbreak_framing |
Explicit bilingual instruction-boundary violation: anti_refusal | ark-skillspector-derived-0.1.7 |
ark.injection.skillspector.memory_reset |
instruction_override |
Explicit bilingual instruction-boundary violation: memory_reset | ark-skillspector-derived-0.1.7 |
ark.injection.skillspector.persistent_override |
multi_turn_escalation |
Explicit bilingual instruction-boundary violation: persistent_override | ark-skillspector-derived-0.1.7 |
ark.injection.skillspector.policy_nullification |
guardrail_tamper |
Explicit bilingual instruction-boundary violation: policy_nullification | ark-skillspector-derived-0.1.7 |
ark.injection.skillspector.unconditional_compliance |
jailbreak_framing |
Explicit bilingual instruction-boundary violation: unconditional_compliance | ark-skillspector-derived-0.1.7 |
ark.injection.structure.override_sensitive_disclosure |
instruction_override |
Structural override plus sensitive-disclosure relationship. | native structural producer |
ark.injection.tool_call.injected |
tool_call_injection |
Native producer gate for native:tool_call_injection. | ark-native-injection-71ff48e |
ark.injection.tool_output.override |
tool_output_instruction |
Native producer gate for native:tool_output_instruction. | ark-native-injection-71ff48e |
Threat rules (40)¶
Enabled by default when Threat L1 is configured. Matches report risky operations, not proof of malicious intent. See Threat L1 for context and coverage limits.
| Rule ID | Threat class | SkillSpector reference groups |
|---|---|---|
ark.threat.remote_execution |
tool_abuse |
SC2, TM2 |
ark.threat.remote_execution_instruction |
tool_abuse |
SC2, TM2 |
ark.threat.decoded_execution |
tool_abuse |
SC3 |
ark.threat.decoded_shell_execution |
tool_abuse |
SC3, TM2 |
ark.threat.credential_harvesting |
secrets_access |
PE3, AS1, E3 |
ark.threat.credential_file_access |
secrets_access |
PE3, AS1 |
ark.threat.secret_exfiltration |
exfiltration_attempt |
E1, E3, E5 |
ark.threat.credential_file_upload |
exfiltration_attempt |
E3, E5 |
ark.threat.environment_exfiltration |
exfiltration_attempt |
E2 |
ark.threat.docker_socket |
tool_abuse |
PE4 |
ark.threat.privileged_container |
tool_abuse |
PE5, TM4 |
ark.threat.persistence_payload |
harmful_behavior |
RA2 |
ark.threat.agent_guard_removal |
harmful_behavior |
RA1, AS1 |
ark.threat.security_disable |
tool_abuse |
TM3, SC7 |
ark.threat.untrusted_deserialization |
tool_abuse |
DS1, DS2, DS3, AST10 |
ark.threat.untrusted_output_execution |
tool_abuse |
OH1, OH2 |
ark.threat.ssrf_metadata |
secrets_access |
SSRF1 |
ark.threat.session_exfiltration |
exfiltration_attempt |
E4, P3 |
ark.threat.environment_post |
exfiltration_attempt |
E2 |
ark.threat.agent_config_exfiltration |
exfiltration_attempt |
AS1, AS2, AS3 |
ark.threat.kubernetes_privileged_json |
tool_abuse |
TM4, PE5 |
ark.threat.kubernetes_privileged_yaml |
tool_abuse |
TM4, PE5 |
ark.threat.unsafe_tls_code |
tool_abuse |
TM3, SC7 |
ark.threat.unsafe_shell_input |
tool_abuse |
TM1 |
ark.threat.dynamic_ssrf |
tool_abuse |
SSRF3, TT |
ark.threat.unauthorized_autonomy |
tool_abuse |
EA2, EA3 |
ark.threat.harmful_intent |
harmful_behavior |
P5 |
ark.threat.secret_source_transfer |
exfiltration_attempt |
E3, E5 |
ark.threat.ua_credential_store_access |
secrets_access |
PE3, AS1 |
ark.threat.ua_metadata_fetch |
secrets_access |
SSRF1 |
ark.threat.ua_destructive_request |
tool_abuse |
RA1 |
ark.threat.ua_security_control_disable |
tool_abuse |
TM3, SC7 |
ark.threat.ua_fetch_and_run |
tool_abuse |
SC2, TM2 |
ark.threat.ua_runtime_socket_mount |
tool_abuse |
PE4 |
ark.threat.ua_host_root_mount_config |
tool_abuse |
PE5, TM4 |
ark.threat.ua_compose_privileged |
tool_abuse |
PE5, TM4 |
ark.threat.ua_privilege_widening |
tool_abuse |
PE5 |
ark.threat.ua_persistence |
harmful_behavior |
RA2 |
ark.threat.ua_untrusted_deserialization |
tool_abuse |
DS1, DS2 |
ark.threat.ua_unsafe_tls_client |
tool_abuse |
TM3, SC7 |
Shell command policies (117)¶
Cedar policies of Cat, the shell_command detector (see Check shell commands). The rule ID is cat. plus the policy ID that verdicts report: {"rules": {"cat.core.remote_to_exec": false}} turns that policy off like any other L1 rule; a missing ID keeps the policy on. core policies ship with Ark at their @decision level; bundle-default policies take the level that the release's validation gate set in the bundle's policy_levels.json (block or ask; a rejected policy is not loaded). User policies (user.*, rule ID cat.user.*) from policy_dirs are rules too. segment policies read one command segment, command policies the whole command.
| Rule ID | Title | Tier | Scope | Level |
|---|---|---|---|---|
cat.core.cred_literal_to_net |
Sends a literal credential (token, key) to a network tool | core |
command |
block |
cat.core.db_dump_to_net |
Sends a database dump to the network | core |
command |
block |
cat.core.decoded_to_interp |
Decodes data and pipes it into an interpreter | core |
command |
block |
cat.core.git_exec_config |
Sets git config that executes commands (hooks, sshCommand, fsmonitor, ...) | core |
command |
ask |
cat.core.host_root_mount |
Mounts the host root filesystem into a container | core |
segment |
block |
cat.core.metadata_fetch |
Fetches from a link-local address (cloud instance metadata) | core |
segment |
block |
cat.core.persistence_write |
Writes a persistence location (shell profile, cron, authorized_keys, ...) | core |
segment |
ask |
cat.core.privileged_container |
Starts a privileged container | core |
segment |
ask |
cat.core.remote_to_exec |
Runs code fetched from the network (pipe, substitution or saved file) | core |
command |
block |
cat.core.secctl_off |
Turns off a security control (audit, AV/EDR, firewall, SELinux, ...) | core |
segment |
block |
cat.core.secret_to_net |
Sends secret material (keys, cloud credentials, .env, ...) to the network | core |
command |
block |
cat.core.sql_exec |
Runs OS code or files through SQL (UDF SONAME, INTO OUTFILE, COPY PROGRAM, ...) | core |
segment |
block |
cat.core.sudoers_nopasswd_all |
Grants passwordless sudo for all commands | core |
segment |
block |
cat.C2-BURP |
Burp Collaborator (pentest C2) | bundle-default |
command |
release gate |
cat.C2-CANARY |
Canary Tokens | bundle-default |
command |
release gate |
cat.C2-DNS-TUNNEL |
DNS TXT query with high-entropy label (tunneling indicator) | bundle-default |
command |
release gate |
cat.C2-HOOKBIN |
HookBin (known exfil) | bundle-default |
command |
release gate |
cat.C2-METADATA-AWS |
AWS metadata endpoint (SSRF) | bundle-default |
segment |
release gate |
cat.C2-METADATA-AZURE |
Azure metadata endpoint (SSRF) | bundle-default |
command |
release gate |
cat.C2-METADATA-DECIMAL |
AWS metadata endpoint (decimal-encoded SSRF) | bundle-default |
command |
release gate |
cat.C2-METADATA-GCP |
GCP metadata endpoint (SSRF) | bundle-default |
command |
release gate |
cat.C2-METADATA-HEX |
AWS metadata endpoint (hex-encoded SSRF) | bundle-default |
command |
release gate |
cat.C2-METADATA-OCTAL |
AWS metadata endpoint (octal-encoded SSRF) | bundle-default |
command |
release gate |
cat.C2-PASTEBIN |
Pastebin raw fetch | bundle-default |
command |
release gate |
cat.C2-PIPEDREAM |
Pipedream (known exfil) | bundle-default |
command |
release gate |
cat.C2-REQUESTBIN |
RequestBin (known exfil) | bundle-default |
command |
release gate |
cat.C2-WEBHOOK-SITE |
webhook.site (known exfil) | bundle-default |
command |
release gate |
cat.CMD-CHMOD-WORLD |
chmod world-writable | bundle-default |
segment |
release gate |
cat.CMD-DD-IF |
dd disk write | bundle-default |
segment |
release gate |
cat.CMD-DEVICE-WIPE |
Destructive write to a disk device | bundle-default |
segment |
release gate |
cat.CMD-EVAL |
Shell eval with dynamic input | bundle-default |
command |
release gate |
cat.CMD-PIPE-CURL |
curl piped to shell | bundle-default |
segment |
release gate |
cat.CMD-PIPE-WGET |
wget piped to shell | bundle-default |
segment |
release gate |
cat.CMD-PYTHON-SOCKET-CONNECT |
Python code connects to a nonlocal socket | bundle-default |
segment |
release gate |
cat.CMD-REMOTE-PAYLOAD-EXEC-CLEANUP |
Remote payload execution with anti-forensic cleanup | bundle-default |
command |
release gate |
cat.CMD-REVSHELL-BASH |
Bash reverse shell | bundle-default |
segment |
release gate |
cat.CMD-REVSHELL-DEVTCP |
Reverse shell via /dev/tcp | bundle-default |
command |
release gate |
cat.CMD-REVSHELL-NC |
Netcat reverse shell with -e | bundle-default |
command |
release gate |
cat.CMD-REVSHELL-POWERSHELL-TCP |
PowerShell TCP command-execution loop | bundle-default |
command |
release gate |
cat.CMD-RM-RF |
Recursive force delete from critical root path | bundle-default |
segment |
release gate |
cat.CMD-SOCAT-EXEC |
socat with EXEC (reverse shell) | bundle-default |
command |
release gate |
cat.CMD-SYSTEMCTL |
Suspicious systemd persistence enablement | bundle-default |
command |
release gate |
cat.CMD-WGET-POST |
wget POST data exfil | bundle-default |
command |
release gate |
cat.CMD-WIN-REG-PERSIST |
Windows registry persistence modification | bundle-default |
segment |
release gate |
cat.PATH-AWS-CONFIG |
AWS config file | bundle-default |
command |
release gate |
cat.PATH-AWS-CREDS |
AWS credentials file | bundle-default |
segment |
release gate |
cat.PATH-DOCKER |
Docker config | bundle-default |
segment |
release gate |
cat.PATH-ETC-SHADOW |
/etc/shadow access | bundle-default |
command |
release gate |
cat.PATH-GIT-CREDS |
Git credentials file | bundle-default |
segment |
release gate |
cat.PATH-GNUPG |
GPG keyring access | bundle-default |
command |
release gate |
cat.PATH-HISTORY |
Shell history file | bundle-default |
segment |
release gate |
cat.PATH-NETRC |
netrc credentials file | bundle-default |
command |
release gate |
cat.PATH-NPMRC |
npm config (may contain tokens) | bundle-default |
command |
release gate |
cat.PATH-PASSWORD-CRACKER-POTFILE |
Password-cracker recovered credential store read | bundle-default |
segment |
release gate |
cat.PATH-PYPIRC |
PyPI config (may contain tokens) | bundle-default |
command |
release gate |
cat.PATH-SSH-DIR |
SSH directory access | bundle-default |
segment |
release gate |
cat.SEC-CONNSTR |
Connection string with credentials | bundle-default |
command |
release gate |
cat.SEC-DISCORD-WEBHOOK |
Discord webhook URL | bundle-default |
command |
release gate |
cat.SEC-GITHUB-PAT |
GitHub fine-grained PAT | bundle-default |
command |
release gate |
cat.SEC-GITLAB |
GitLab personal access token | bundle-default |
command |
release gate |
cat.SEC-GOOGLE |
Google API key | bundle-default |
command |
release gate |
cat.SEC-NPM-TOKEN |
npm access token | bundle-default |
command |
release gate |
cat.SEC-OPENAI |
OpenAI project key | bundle-default |
command |
release gate |
cat.SEC-OPENAI-V2 |
OpenAI API key (long form) | bundle-default |
command |
release gate |
cat.SEC-PRIVKEY |
Private key | bundle-default |
command |
release gate |
cat.SEC-PYPI-TOKEN |
PyPI API token | bundle-default |
command |
release gate |
cat.SEC-SENDGRID |
SendGrid API key | bundle-default |
command |
release gate |
cat.SEC-SLACK-WEBHOOK |
Slack webhook URL | bundle-default |
command |
release gate |
cat.SEC-TWILIO |
Twilio API key | bundle-default |
command |
release gate |
cat.credential.directory_credential_acquisition |
Exact directory credential acquisition | bundle-default |
segment |
release gate |
cat.credential.directory_ticket_request |
Exact Kerberos ticket request | bundle-default |
segment |
release gate |
cat.credential.macos_login_keychain_dump |
Dump decrypted credentials from the macOS login keychain | bundle-default |
segment |
release gate |
cat.credential.pkcs12_private_key_extract |
Extract an unencrypted private key from a PKCS#12 bundle | bundle-default |
segment |
release gate |
cat.credential.windows_lsass_memory_dump |
Dump Windows LSASS credential memory | bundle-default |
command |
release gate |
cat.credential.windows_ntds_ifm_dump |
Export the full Active Directory database with NTDS IFM | bundle-default |
segment |
release gate |
cat.exec.agent_runtime_bypass_flags |
Agent runtime safety bypass flags | bundle-default |
segment |
release gate |
cat.exec.remote_ip_download_execute_same_artifact |
Literal public-IP download executed from the same path | bundle-default |
segment |
release gate |
cat.impact.cloud_s3_data_delete |
Recursively delete an exact AWS S3 prefix or bucket | bundle-default |
segment |
release gate |
cat.impact.cryptomining_launch |
Cryptocurrency miner launch | bundle-default |
segment |
release gate |
cat.impact.fork_bomb |
Unbounded fork bomb | bundle-default |
command |
release gate |
cat.impact.linux_magic_sysrq_destruction |
Trigger destructive Linux Magic SysRq action | bundle-default |
segment |
release gate |
cat.impact.posix_host_halt |
Power off or reboot the POSIX host with halt | bundle-default |
segment |
release gate |
cat.impact.windows_delete_all_shadow_copies |
Delete all Windows Volume Shadow Copies | bundle-default |
segment |
release gate |
cat.impact.windows_recovery_disable_pair |
Disable Windows boot recovery and failure handling | bundle-default |
segment |
release gate |
cat.impact.windows_recovery_store_destruction |
Destroy Windows recovery stores | bundle-default |
segment |
release gate |
cat.integrity.history_tamper |
Shell history clear or disable | bundle-default |
segment |
release gate |
cat.persistence.git_hook_write |
Active Git hook mutation | bundle-default |
segment |
release gate |
cat.persistence.global_ld_preload_install |
Global dynamic-loader preload installation | bundle-default |
command |
release gate |
cat.persistence.privileged_account_change |
Privileged account or group change | bundle-default |
segment |
release gate |
cat.persistence.windows_accessibility_feature_hijack |
Hijack a Windows accessibility feature for SYSTEM command access | bundle-default |
segment |
release gate |
cat.privilege.cloud_iam_administrator_attachment |
Attach AWS AdministratorAccess to an exact IAM principal | bundle-default |
segment |
release gate |
cat.privilege.container_runtime_socket_access |
Container runtime socket access | bundle-default |
segment |
release gate |
cat.privilege.custom_root_suid_implant |
Compile and install a custom root-setuid executable | bundle-default |
segment |
release gate |
cat.privilege.host_namespace_entry |
Host PID-1 namespace or root entry | bundle-default |
command |
release gate |
cat.privilege.kubernetes_cluster_admin_binding |
Grant Kubernetes cluster-admin to an exact service account | bundle-default |
segment |
release gate |
cat.privilege.sudoers_unrestricted_nopasswd |
Unrestricted passwordless sudo grant | bundle-default |
segment |
release gate |
cat.privilege.temporary_setuid_executable |
Create a setuid executable in a temporary directory | bundle-default |
segment |
release gate |
cat.secrets.browser_session_store_read |
Browser credential or session store read | bundle-default |
segment |
release gate |
cat.secrets.workload_identity_token_read |
Workload identity token read | bundle-default |
segment |
release gate |
cat.tamper.cloud_audit_control_destruction |
Destroy an exact cloud audit-logging control | bundle-default |
segment |
release gate |
cat.tamper.complete_firewall_relaxation |
Completely relax the host iptables firewall | bundle-default |
segment |
release gate |
cat.tamper.complete_firewall_relaxation_attempt |
Attempt to completely relax the host iptables firewall | bundle-default |
segment |
release gate |
cat.tamper.endpoint_security_product_disable |
Disable or uninstall an exact endpoint-security product | bundle-default |
segment |
release gate |
cat.tamper.linux_security_control_disable |
Disable a Linux host security control | bundle-default |
segment |
release gate |
cat.tamper.macos_unified_log_erase |
Erase all macOS unified logs | bundle-default |
segment |
release gate |
cat.tamper.posix_log_and_shell_history_destruction |
System log and shell history destroyed together | bundle-default |
command |
release gate |
cat.tamper.posix_logging_hardening_disable |
Disable exact POSIX logging or host-hardening controls | bundle-default |
segment |
release gate |
cat.tamper.posix_system_log_destruction |
Destroy canonical POSIX system logs | bundle-default |
segment |
release gate |
cat.tamper.windows_amsi_disable |
Disable or bypass exact Windows AMSI controls | bundle-default |
segment |
release gate |
cat.tamper.windows_audit_policy_wipe |
Clear Windows audit policy and all-user policy | bundle-default |
segment |
release gate |
cat.tamper.windows_credential_protection_weaken |
Weaken exact Windows credential-protection controls | bundle-default |
segment |
release gate |
cat.tamper.windows_defender_component_disable |
Disable an exact Windows Defender component | bundle-default |
segment |
release gate |
cat.tamper.windows_defender_multi_control_disable |
Disable multiple Windows Defender controls | bundle-default |
segment |
release gate |
cat.tamper.windows_recursive_everyone_full_control |
Recursively grant Everyone inheritable full control on Windows | bundle-default |
segment |
release gate |
cat.tamper.windows_registry_security_control_disable |
Disable Windows security controls through the registry | bundle-default |
segment |
release gate |
cat.tamper.windows_telemetry_disable |
Disable exact Windows ETW or event telemetry controls | bundle-default |
segment |
release gate |
cat.tamper.windows_usn_journal_delete |
Delete a Windows NTFS USN change journal | bundle-default |
segment |
release gate |