# Secret scanner — high-signal patterns (ERE, case-SENSITIVE). One regex per line; '#' starts a comment.
# These match secret VALUES (keys / tokens / private keys), not the word "secret".
# False positive on a real (test) value? Add the EXACT pattern line to .secret-allowlist.txt at the repo root,
# or replace the value with a placeholder. Deliberate bypass: git commit --no-verify (explicit request only, §4.5).
#
# Each pattern carries its own case, on the line right below it:
#   #test:       a sample this pattern MUST catch
#   #test-clean: a sample no pattern may catch
# smoke-test.sh discovers them and drives the REAL hook with them, and it FAILS if a pattern has no case at
# all — an untested regex is how a typo ships as a gate that silently matches nothing. Samples are deliberately
# written with a {{A<n>}} placeholder that the test harness expands to n 'A's at run time. The file therefore
# never contains a contiguous secret-shaped literal — which matters because it ships into every project's
# .claude/, where their scanners would flag it, and because GitHub push protection blocks such a literal on
# sight regardless of how low its entropy is (measured: it rejected the Stripe sample).

# PEM private keys (RSA / EC / OPENSSH / DSA / PGP ...)
-----BEGIN ([A-Z]+ )?PRIVATE KEY-----
#test: -----BEGIN RSA PRIVATE KEY-----
#test: -----BEGIN PRIVATE KEY-----

# AWS access key id
(AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|A3T)[A-Z0-9]{16}
#test: aws_access_key_id = AKI{{A17}}

# GitHub tokens (personal / oauth / user / server / refresh) + fine-grained PAT
gh[pousr]_[A-Za-z0-9]{36,}
#test: token: ghp_{{A36}}
github_pat_[A-Za-z0-9_]{22,}
#test: token: github_pat_{{A24}}

# Google API key
AIza[A-Za-z0-9_-]{35}
#test: key=AIza{{A35}}

# Slack token
xox[baprs]-[A-Za-z0-9-]{10,}
#test: SLACK_TOKEN=xoxb-{{A12}}

# Stripe live secret / restricted key
(sk|rk)_live_[A-Za-z0-9]{20,}
#test: STRIPE=sk_live_{{A24}}

# OpenAI / Anthropic API keys
sk-(ant-|proj-)?[A-Za-z0-9_-]{24,}
#test: API_KEY=sk-ant-{{A24}}

# npm access token
npm_[A-Za-z0-9]{36}
#test: //registry.npmjs.org/:_authToken=npm_{{A36}}

# SendGrid API key
SG\.[A-Za-z0-9_-]{16,32}\.[A-Za-z0-9_-]{16,}
#test: SENDGRID_API_KEY=SG.{{A16}}.{{A20}}

# JSON Web Token (header.payload.signature)
eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{10,}
#test: Authorization: Bearer eyJAAAAAAAAAA.eyJAAAAAA.AAAAAAAAAA

# Values that LOOK secret-adjacent but are not, and must stay committable.
#test-clean: const apiKey = process.env.STRIPE_SECRET_KEY
#test-clean: # set GITHUB_TOKEN in the CI environment, never in the repo
#test-clean: private key handling is documented in docs/security.md
