Deny when the gated text contains PII or a credential-shaped secret:
email, ssn, phone, creditCard (candidate digit runs Luhn-validated —
only a valid check digit denies), awsAccessKey, privateKey (PEM header
only; never tries to span the whole key body), jwt, secretAssignment
(key: value-shaped assignments), and highEntropy (Shannon entropy over
a base64-shaped candidate). Gates all output channels by default, like
denyPatterns — a secret is no less leaked through a reasoning trace.
Best-effort, like denyPatterns' own evasion caveat: normalization and
Unicode tricks (homoglyphs, zero-width characters, alternate encodings)
evade the regex detectors, and entropy scoring is a heuristic, not a
proof of secrecy — natural text can score high and a deliberately-shaped
secret can score low. Do not rely on it alone against adversarial input.
Streaming windows are re-sliced from partway through the accumulated text
on every call; a slice that starts mid-token can introduce a \b word
boundary the full text does not have at that position. Accepted,
consistent with denyPatterns' own windowing — a spurious boundary can only
ever produce an extra scan, never hide a real match, so it fails closed.
Deny when the gated text contains PII or a credential-shaped secret: email, ssn, phone, creditCard (candidate digit runs Luhn-validated — only a valid check digit denies), awsAccessKey, privateKey (PEM header only; never tries to span the whole key body), jwt, secretAssignment (
key: value-shaped assignments), and highEntropy (Shannon entropy over a base64-shaped candidate). Gates all output channels by default, like denyPatterns — a secret is no less leaked through a reasoning trace.Best-effort, like denyPatterns' own evasion caveat: normalization and Unicode tricks (homoglyphs, zero-width characters, alternate encodings) evade the regex detectors, and entropy scoring is a heuristic, not a proof of secrecy — natural text can score high and a deliberately-shaped secret can score low. Do not rely on it alone against adversarial input.
Streaming windows are re-sliced from partway through the accumulated text on every call; a slice that starts mid-token can introduce a
\bword boundary the full text does not have at that position. Accepted, consistent with denyPatterns' own windowing — a spurious boundary can only ever produce an extra scan, never hide a real match, so it fails closed.