{
  "description": "Single source of truth for secret detection. Used by hooks, skills, and git hooks.",

  "apiKeys": [
    { "name": "AWS Access Key", "pattern": "AKIA[0-9A-Z]{16}", "severity": "critical" },
    { "name": "OpenAI API Key", "pattern": "sk-[a-zA-Z0-9]{48}", "severity": "critical" },
    { "name": "Anthropic API Key", "pattern": "sk-ant-[a-zA-Z0-9-]{90,}", "severity": "critical" },
    { "name": "GitHub Token (PAT)", "pattern": "ghp_[a-zA-Z0-9]{36}", "severity": "critical" },
    { "name": "GitHub OAuth Token", "pattern": "gho_[a-zA-Z0-9]{36}", "severity": "critical" },
    { "name": "GitLab Token", "pattern": "glpat-[a-zA-Z0-9-]{20}", "severity": "critical" },
    { "name": "Slack Bot Token", "pattern": "xoxb-[0-9]{10,}-[a-zA-Z0-9]{24}", "severity": "critical" },
    { "name": "Slack User Token", "pattern": "xoxp-[0-9]{10,}-[a-zA-Z0-9]{24}", "severity": "critical" },
    { "name": "SendGrid API Key", "pattern": "SG\\.[a-zA-Z0-9_-]{22}\\.[a-zA-Z0-9_-]{43}", "severity": "critical" },
    { "name": "Stripe Secret Key", "pattern": "sk_live_[a-zA-Z0-9]{24,}", "severity": "critical" },
    { "name": "Stripe Restricted Key", "pattern": "rk_live_[a-zA-Z0-9]{24,}", "severity": "critical" },
    { "name": "Square Access Token", "pattern": "sq0atp-[a-zA-Z0-9_-]{22}", "severity": "critical" },
    { "name": "Google API Key", "pattern": "AIza[0-9A-Za-z_-]{35}", "severity": "critical" },
    { "name": "Twilio API Key", "pattern": "SK[a-f0-9]{32}", "severity": "critical" },
    { "name": "Mailgun API Key", "pattern": "key-[a-zA-Z0-9]{32}", "severity": "critical" }
  ],

  "credentials": [
    { "name": "Hardcoded password", "pattern": "password\\s*[:=]\\s*['\"][^'\"]{4,}['\"]", "severity": "critical" },
    { "name": "Hardcoded secret", "pattern": "secret\\s*[:=]\\s*['\"][^'\"]{4,}['\"]", "severity": "critical" },
    { "name": "Hardcoded API key", "pattern": "api[_-]?key\\s*[:=]\\s*['\"][^'\"]{4,}['\"]", "severity": "critical" },
    { "name": "Hardcoded token", "pattern": "auth[_-]?token\\s*[:=]\\s*['\"][^'\"]{4,}['\"]", "severity": "critical" },
    { "name": "OAuth client secret", "pattern": "client[_-]?secret\\s*[:=]\\s*['\"][^'\"]{4,}['\"]", "severity": "critical" }
  ],

  "databaseUrls": [
    { "name": "MongoDB connection string", "pattern": "mongodb(\\+srv)?://[^/\\s]{8,}", "severity": "critical" },
    { "name": "PostgreSQL connection string", "pattern": "postgres(ql)?://[^/\\s]{8,}", "severity": "critical" },
    { "name": "MySQL connection string", "pattern": "mysql://[^/\\s]{8,}", "severity": "critical" },
    { "name": "Redis connection string", "pattern": "redis://[^/\\s]{8,}", "severity": "critical" },
    { "name": "RabbitMQ connection string", "pattern": "amqp://[^/\\s]{8,}", "severity": "critical" }
  ],

  "privateKeys": [
    { "name": "RSA/EC/DSA Private Key", "pattern": "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", "severity": "critical" },
    { "name": "PGP Private Key", "pattern": "-----BEGIN PGP PRIVATE KEY BLOCK-----", "severity": "critical" }
  ],

  "dangerousFiles": [
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    "*.pem", "*.key", "*.p12", "*.pfx",
    "credentials.json", "secrets.json", "service-account.json",
    "id_rsa", "id_ed25519", "id_ecdsa",
    ".npmrc", ".netrc", ".htpasswd"
  ],

  "falsePositives": [
    "process.env.",
    "os.environ",
    "ENV[",
    "<PLACEHOLDER>",
    "YOUR_KEY_HERE",
    "xxx",
    "changeme",
    ".env.example",
    ".env.template"
  ]
}