Deny when the gated text contains PII or a credential-shaped secret:
email, ssn, phone, creditCard (candidate digit runs Luhn-validated —
only a valid check digit denies), awsAccessKey, privateKey (PEM header
only; never tries to span the whole key body), jwt, secretAssignment
(key: value-shaped assignments), and highEntropy (Shannon entropy over
a base64-shaped candidate). Gates all output channels by default, like
denyPatterns — a secret is no less leaked through a reasoning trace.
Best-effort, like denyPatterns' own evasion caveat: normalization and
Unicode tricks (homoglyphs, zero-width characters, alternate encodings)
evade the regex detectors, and entropy scoring is a heuristic, not a
proof of secrecy — natural text can score high and a deliberately-shaped
secret can score low. Do not rely on it alone against adversarial input.
Streaming windows are re-sliced from partway through the accumulated text.
When every enabled detector is ssn or awsAccessKey, a match of theirs
cut from a longer word at a window start is not reported; with any other
detector enabled, it still denies. Other cut tokens can still deny, and
where a window starts changes which overlapping candidates a scan reads, so
a streaming scan can miss a match a full-text scan finds.
Deny when the gated text contains PII or a credential-shaped secret: email, ssn, phone, creditCard (candidate digit runs Luhn-validated — only a valid check digit denies), awsAccessKey, privateKey (PEM header only; never tries to span the whole key body), jwt, secretAssignment (
key: value-shaped assignments), and highEntropy (Shannon entropy over a base64-shaped candidate). Gates all output channels by default, like denyPatterns — a secret is no less leaked through a reasoning trace.Best-effort, like denyPatterns' own evasion caveat: normalization and Unicode tricks (homoglyphs, zero-width characters, alternate encodings) evade the regex detectors, and entropy scoring is a heuristic, not a proof of secrecy — natural text can score high and a deliberately-shaped secret can score low. Do not rely on it alone against adversarial input.
Streaming windows are re-sliced from partway through the accumulated text. When every enabled detector is
ssnorawsAccessKey, a match of theirs cut from a longer word at a window start is not reported; with any other detector enabled, it still denies. Other cut tokens can still deny, and where a window starts changes which overlapping candidates a scan reads, so a streaming scan can miss a match a full-text scan finds.