| Category | Name | Severity | Pattern | Replacement |
|---|---|---|---|---|
| Cloud & Auth | AWS Access Key ID | Critical | \bAKIA[0-9A-Z]{10,20}\b | [AWS_ID] |
| Cloud & Auth | AWS Access Key ID (Assignment) | Critical | (?i)(access_key_id|aws_access_key_id)\s*[:… | $1: [SECRET] |
| Cloud & Auth | AWS Secret Access Key | Critical | (?i)(aws_secret_access_key|secret|password… | $1=[SECRET] |
| Cloud & Auth | JWT | Critical | \beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za… | [JWT] |
| Cloud & Auth | Secrets (Generic) | Critical | (?i)(password|passwd|secret|token|api_key|… | $1$2[SECRET] |
| Cloud & Auth | Private Key | Critical | (?s)-----BEGIN [A-Z ]+ PRIVATE KEY-----.*?… | [KEY] |
| Cloud & Auth | URI Credentials | High | (?i)([a-z0-9]+:\/\/.*?:)(.*)(@.*) | $1[SECRET]$3 |
| Cloud & Auth | Universal Secret Catch | High | (['"])[^\s'"]{8,64}['"] | [SECRET] |
| Network | IPv4 Address | High | \b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:… | [IPv4] |
| Network | IPv6 Address | High | (?i)\b(?:[0-9a-f]{1,4}:){3,7}[0-9a-f]{1,4}… | [IPv6] |
| Network | MAC Address | Medium | \b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\… | [MAC] |
| Sensitive Data | Credit Card | High | \b(?:\d[ -]*?){13,16}\b | [CARD] |
| Sensitive Data | Email Address | High | \b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-… | [EMAIL] |
| System | File Path | Medium | (?i)(?:[a-z]:\\(?:[^'"])+|/(?:[\w.-]+/)+[\… | [PATH] |
Out-of-the-Box Intelligence
14 Forensic Presets
Fourteen pre-configured rules cover the most common sensitive patterns: AWS keys, JWT and Bearer tokens, IPv4 and IPv6, PII (emails, SSN, credit cards), private keys, and credentials in URLs. Rules are categorized (Cloud & Auth, Network, Sensitive Data, System) and tagged by severity—Critical, High, and Medium—so you can tune what gets redacted without touching regex.