Detection rules

Every pattern VeilGuard checks for, published so you can see exactly what is matched. 171 detectors in 11 packs, rule set version 1.4.2. The browser extension and the Windows app use this same file, and all matching happens on your device. Download it as rules.json.

Before matching, a copy of the text is normalised: zero-width characters and soft hyphens are removed and fullwidth digits, letters and unusual spaces are folded to plain ones, so a split or disguised value is still found (masking still covers the original characters). Long texts are checked to the end in overlapping windows. Published test card numbers and documentation examples such as AKIAIOSFODNN7EXAMPLE are still flagged at their usual level, labelled "example/test value".

Core (PII, secrets, credentials) 112

Detector	Category	Risk	Extra check	Pattern
Email address email	Personal data (PII)	medium		show `\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,24}\b`
Phone number phone	Personal data (PII)	medium		show `(?<![\w+])(?:\+?1[ .-]?)?$?[2-9]\d{2}$?[ .-]\d{3}[ .-]\d{4}\b\|(?<![\w+])\+(?:[2-9]\d{0,2})[ .-]?\d{2,4}[ .-]?\d{3,4}[ .-]?\d{3,4}\b`
Phone number (labelled) phone_ctx	Personal data (PII)	medium		show `(?<![A-Za-z0-9_])(?:phone\|tel\.?\|telephone\|mobile\|cell(?:phone)?\|whatsapp\|my number\|call me (?:at\|on)\|text me (?:at\|on)\|t(?:é\|e)l(?:é\|e)phone\|portable\|tel(?:é\|e)fono\|m(?:ó\|o)vil\|celular\|telefon\|handy(?:nummer)?\|電話番号\|電話\|携帯)(?:\s+(?:number\|no\.?\|#\|nr\.?\|num(?:é\|e)ro\|nummer))?(?:\s+(?:is\|was\|es\|est\|ist))?\s[:#=]?\s(?:は\s*)?(?<v>\+?\(?[0-9][0-9 ().-]{6,18}[0-9])(?![0-9])`
US Social Security number us_ssn	Personal data (PII)	critical		show `(?<![A-Za-z0-9_.-])(?!000\|666\|9[0-9][0-9])[0-9]{3}([- .])(?!00)[0-9]{2}\1(?!0000)[0-9]{4}(?![A-Za-z0-9_-]\|\.[0-9])`
US SSN (labelled) us_ssn_ctx	Personal data (PII)	critical	ssn	show `(?<![A-Za-z0-9_])(?:ssn\|ss#\|ss no\.?\|s\.s\.n\.?\|social security(?:\s+(?:number\|no\.?\|num\|#))?\|social\|n(?:ú\|u)mero de (?:la )?seguridad social\|n(?:ú\|u)mero de seguro social\|seguro social)(?:\s+(?:is\|was\|es\|number\|no\.?\|#))\s[:#=]?\s*(?<v>[0-9](?:[ .-]{0,3}[0-9]){8})(?![0-9])`
UK National Insurance number uk_nino	Personal data (PII)	high		show `\b(?!BG\|GB\|NK\|KN\|TN\|NT\|ZZ)[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] ?\d{2} ?\d{2} ?\d{2} ?[A-D]\b\|(?<![A-Za-z0-9_])(?:[Nn]ational [Ii]nsurance(?: [Nn]umber\| [Nn]o\.?)?\|NI(?: number\| no\.?)?\|NINO\|[Nn]ino)(?:\s+is)?\s[:#=]?\s(?!bg\|gb\|nk\|kn\|tn\|nt\|zz)[a-ceghj-pr-tw-z][a-ceghj-npr-tw-z] ?[0-9]{2} ?[0-9]{2} ?[0-9]{2} ?[a-d](?![A-Za-z0-9])`
Passport number (labelled) passport_ctx	Personal data (PII)	high		show `(?<![A-Za-z0-9_])(?:[Pp]assport\|PASSPORT\|[Rr]eisepass(?:nummer)?\|REISEPASS\|[Pp]asseport\|PASSEPORT\|[Pp]asaporte\|PASAPORTE\|パスポート)(?:\s(?:[Nn]umber\|NUMBER\|[Nn]o\.?\|NO\.?\|[Nn]r\.?\|#\|[Nn]ummer\|n[º°]\|番号))?(?:\s+(?:is\|was\|es\|est\|ist))?\s[:#=]?\s(?:は\s)?(?<v>(?=[A-Z0-9]*[0-9])[A-Z0-9]{6,9})(?![A-Za-z0-9])`
Driver's licence (labelled) drivers_license_ctx	Personal data (PII)	high		show `(?<![A-Za-z0-9_])(?:(?:(?:driver'?s?\|driving)\s+licen[cs]e\|f(?:ü\|u)hrerschein(?:nummer)?\|permis de conduire\|licencia de conducir\|運転免許証?)(?:\s(?:number\|no\.?\|nr\.?\|#\|nummer\|番号))?(?:\s+(?:is\|was\|es\|est\|ist))?\s[:#=]?\s(?:は\s)?\|DL\s(?:number\|no\.?)?\s[:#=]\s)(?<v>(?=[A-Z0-9-][0-9])[A-Z0-9][A-Z0-9-]{4,15})(?![A-Za-z0-9-])`
Date of birth dob_ctx	Personal data (PII)	medium		show (?<![A-Za-z0-9_])(?:dob\|d\.o\.b\.?\|date of birth\|birth ?date\|birthday\|born(?: on)?\|fecha de nacimiento\|date de naissance\|n(?:é\|e)e? le\|geb\.?\|geboren(?: am)?\|geburtsdatum\|生年月日\|誕生日)(?:\s+(?:is\|was\|es\|est\|ist))?\s[:=]?\s(?:は\s*)?(?<v>[0-9]{1,2}[/.-][0-9]{1,2}[/.-][0-9]{2,4}\|[0-9]{4}[/.-][0-9]{1,2}[/.-][0-9]{1,2}\|[0-9]{4}年[0-9]{1,2}月[0-9]{1,2}日\|[0-9]{1,2}(?:st\|nd\|rd\|th)?\s+(?:of\s+)?[A-Za-z]{3,9}\.?,?\s+[0-9]{4}\|[A-Za-z]{3,9}\.?\s+[0-9]{1,2}(?:st\|nd\|rd\|th)?,?\s+[0-9]{4})(?![0-9])
Street address street_address	Personal data (PII)	medium		show `\b\d{1,5}[A-Za-z]? (?:[A-Z][a-z]+ ){1,3}(?:Street\|St\|Avenue\|Ave\|Road\|Rd\|Boulevard\|Blvd\|Lane\|Ln\|Drive\|Dr\|Court\|Ct\|Way\|Place\|Pl\|Close\|Crescent\|Terrace\|Gardens\|Grove\|Mews\|Square\|Sq\|Parkway\|Pkwy\|Highway\|Hwy\|Circle\|Cir\|Trail\|Terr\|Row\|Hill)\.?\b`
AWS access key ID aws_access_key	API keys & tokens	critical		show `\b(?:AKIA\|ASIA\|AGPA\|AIDA\|AROA\|ANPA\|ANVA\|AIPA)[0-9A-Z]{16}\b`
AWS secret access key aws_secret_key	API keys & tokens	critical		show `(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:aws_secret_access_key\|aws_secret_key\|aws_secret\|secret_access_key\|secretaccesskey)["']?\s[:=]\s["']?(?<v>[A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])`
AWS session token aws_session_token	API keys & tokens	high		show `(?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:aws_session_token\|aws_security_token\|session_?token\|x-amz-security-token)["']?\s[:=]\s["']?(?<v>[A-Za-z0-9/+=]{100,})\|\b(?:IQoJb3JpZ2lu\|FwoGZXIvYXdz)[A-Za-z0-9/+=]{60,}`
Amazon Bedrock API key aws_bedrock_key	API keys & tokens	critical		show `\bABSK[A-Za-z0-9+/]{109,269}={0,2}`
GitHub token github_token	API keys & tokens	critical		show `\b(?:gh[pousr]_[A-Za-z0-9]{36,255}\|github_pat_[A-Za-z0-9_]{22,255})\b`
GitLab token gitlab_token	API keys & tokens	critical		show `\b(?:gl(?:pat\|dt\|rt\|ptt\|soat\|cbt\|ffct\|ft\|imt\|oas\|agent)-[A-Za-z0-9_-]{20,}\|GR1348941[A-Za-z0-9_-]{20})`
OpenAI API key openai_key	API keys & tokens	critical		show `\bsk-(?:proj-\|svcacct-\|admin-)?[A-Za-z0-9_-]{20,}T3BlbkFJ[A-Za-z0-9_-]{20,}\b\|\bsk-(?:proj\|svcacct\|admin)-[A-Za-z0-9_-]{40,}\b`
Anthropic API key or OAuth token anthropic_key	API keys & tokens	critical		show `\bsk-ant-(?:api\|admin\|oat\|ort)\d{2}-[A-Za-z0-9_-]{80,}`
Groq API key groq_key	API keys & tokens	critical		show `\bgsk_[A-Za-z0-9]{52}\b`
xAI (Grok) API key xai_key	API keys & tokens	critical		show `\bxai-[A-Za-z0-9_]{80}\b`
Perplexity API key perplexity_key	API keys & tokens	critical		show `\bpplx-[A-Za-z0-9]{48}\b`
OpenRouter API key openrouter_key	API keys & tokens	critical		show `\bsk-or-v1-[a-f0-9]{64}\b`
Replicate API token replicate_token	API keys & tokens	critical		show `\br8_[A-Za-z0-9_-]{37}(?![A-Za-z0-9_-])`
ElevenLabs API key elevenlabs_key	API keys & tokens	critical		show `\bsk_[a-f0-9]{48}\b`
LangSmith API key langsmith_key	API keys & tokens	critical		show `\blsv2_(?:pt\|sk)_[a-f0-9]{32}_[a-f0-9]{10}\b`
Pinecone API key pinecone_key	API keys & tokens	critical		show `\bpcsk_[A-Za-z0-9]{5,6}_[A-Za-z0-9]{63}\b`
Supabase access token or secret key supabase_token	API keys & tokens	critical		show `\bsbp_[a-z0-9]{40}\b\|\bsb_secret_[A-Za-z0-9_-]{20,}`
Vercel token vercel_token	API keys & tokens	high	Randomness ≥ 3.0	show `\bvc[pikar]_[A-Za-z0-9]{24,}\b`
Stripe webhook signing secret stripe_webhook_secret	API keys & tokens	critical		show `\bwhsec_[A-Za-z0-9+/=]{32,}`
Slack app-level token slack_app_token	API keys & tokens	critical		show `\bxapp-\d-[A-Za-z0-9]+-\d+-[a-z0-9]+`
Discord bot token discord_bot_token	API keys & tokens	high		show `\b[MNO][A-Za-z\d_-]{23,25}\.[A-Za-z\d_-]{6}\.[A-Za-z\d_-]{27,38}\b`
PyPI upload token pypi_token	API keys & tokens	critical		show `\bpypi-AgEIcHlwaS5vcmc[A-Za-z0-9_-]{50,}`
Docker Hub access token docker_pat	API keys & tokens	critical		show `\bdckr_(?:pat_[A-Za-z0-9_-]{27}\|oat_[A-Za-z0-9_-]{32})(?![A-Za-z0-9_-])`
Microsoft Entra ID (Azure AD) client secret azure_ad_client_secret	API keys & tokens	critical		show `(?<![A-Za-z0-9_~.])[A-Za-z0-9_~.]{3}\dQ~[A-Za-z0-9_~.-]{31,34}(?![A-Za-z0-9_~.-])`
Azure shared access signature (SAS) azure_sas	API keys & tokens	high		show `[?&]sv=\d{4}-\d{2}-\d{2}&[^\s"'<>]{0,300}?\bsig=[A-Za-z0-9%/+]{40,}(?:%3D\|=){0,2}`
Google OAuth access token google_oauth_token	API keys & tokens	high		show `\bya29\.[A-Za-z0-9_-]{50,}`
age encryption secret key age_secret_key	API keys & tokens	critical		show `AGE-SECRET-KEY-1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}`
Shopify access token or shared secret shopify_token	API keys & tokens	critical		show `\bshp(?:at\|ca\|pa\|ss)_[a-fA-F0-9]{32}\b`
Databricks access token databricks_token	API keys & tokens	critical		show `\bdapi[a-f0-9]{32}(?:-\d)?\b`
Doppler token doppler_token	API keys & tokens	critical		show `\bdp\.pt\.[A-Za-z0-9]{43}\b`
HashiCorp Vault token vault_token	API keys & tokens	critical		show `\bhv[sbr]\.[A-Za-z0-9_-]{90,}`
Pulumi access token pulumi_token	API keys & tokens	critical		show `\bpul-[a-f0-9]{40}\b`
Postman API key postman_key	API keys & tokens	critical		show `\bPMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}\b`
Linear API key linear_key	API keys & tokens	critical		show `\blin_api_[A-Za-z0-9]{40}\b`
Notion integration token notion_token	API keys & tokens	critical		show `\bntn_\d{11}[A-Za-z0-9]{35}\b`
1Password service account token onepassword_token	API keys & tokens	critical		show `\bops_eyJ[A-Za-z0-9+/]{250,}={0,3}`
Mailgun API key mailgun_key	API keys & tokens	high		show `\bmailgun[\w.-]{0,30}["']?\s[:=,]\s["']?key-[a-f0-9]{32}\b`
Google API key google_api_key	API keys & tokens	high		show `\bAIza[0-9A-Za-z_-]{35}\b`
Google OAuth client secret google_oauth_secret	API keys & tokens	critical		show `\bGOCSPX-[A-Za-z0-9_-]{28}\b`
Slack token slack_token	API keys & tokens	critical		show `\bxox[abposre]-[A-Za-z0-9-]{10,}\|\bxoxe\.xox[bp]-\d-[A-Za-z0-9]{100,}`
Slack webhook URL slack_webhook	API keys & tokens	high		show `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]{20,}`
Stripe secret key stripe_key	API keys & tokens	critical		show `\b(?:sk\|rk)_(?:live\|prod)_[A-Za-z0-9]{20,}\b`
Twilio API key twilio_key	API keys & tokens	high		show `\bSK[0-9a-f]{32}\b`
SendGrid API key sendgrid_key	API keys & tokens	critical		show `\bSG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}\b`
Hugging Face token huggingface_token	API keys & tokens	high		show `\b(?:hf_[A-Za-z0-9]{34,}\|api_org_[A-Za-z]{34})\b`
npm access token npm_token	API keys & tokens	high		show `\bnpm_[A-Za-z0-9]{36}\b`
Telegram bot token telegram_bot	API keys & tokens	high		show `\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b`
Discord webhook URL discord_webhook	API keys & tokens	high		show `https://(?:ptb\.\|canary\.)?discord(?:app)?\.com/api/webhooks/\d+/[A-Za-z0-9_-]{50,}`
Azure / SQL connection string with key or password azure_conn_string	API keys & tokens	critical		show `DefaultEndpointsProtocol=https?;AccountName=[^;\s]+;AccountKey=[A-Za-z0-9+/=]{40,}\|Endpoint=sb://[^;\s]+;SharedAccessKeyName=[^;\s]+;SharedAccessKey=[A-Za-z0-9+/=]{40,}\|AccountEndpoint=https://[^;\s]+;AccountKey=[A-Za-z0-9+/=]{40,}\|\b(?:Server\|Data Source)=[^;\n]{1,200};(?:[^;\n]{0,200};){0,8}?\s*(?:Password\|Pwd)=[^;\s]{4,}`
JSON Web Token jwt	API keys & tokens	high		show `\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b`
Bearer token bearer_token	API keys & tokens	high		show `\b[Bb]earer\s+[A-Za-z0-9._~+/-]{24,}=*`
Private key (PEM / PuTTY), incl. truncated pastes private_key_pem	API keys & tokens	critical		show `-----BEGIN (?:[A-Z0-9]+ )PRIVATE KEY(?: BLOCK)?-----(?:[\s\S]?-----END (?:[A-Z0-9]+ )PRIVATE KEY(?: BLOCK)?-----\|(?:[A-Za-z0-9+/=: \t\r\n-]\|\\n))\|PuTTY-User-Key-File-\d+: [^\n]+(?:\r?\n[^\n]+)*`
Generic API key / secret assignment generic_api_key	API keys & tokens	high	Real value, randomness ≥ 3.0	show (?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:api[_-]?key\|apikey\|secret(?:[_-]?key)?\|client[_-]?secret\|access[_-]?token\|auth[_-]?token\|refresh[_-]?token\|private[_-]?key\|signing[_-]?key\|webhook[_-]?secret\|x-api-key\|xi-api-key)["']?\s[:=]\s["'`]?(?<v>[A-Za-z0-9_\-./+=~]{16,})
API key or token written in a sentence api_key_prose	API keys & tokens	high	Real value, randomness ≥ 2.5	show (?<![A-Za-z0-9_])(?:api[ _-]?keys?\|apikeys?\|api[ _-]?tokens?\|secret[ _-]?keys?\|access[ _-]?tokens?\|auth[ _-]?tokens?\|bearer[ _-]?tokens?\|private[ _-]?keys?\|(?:openai\|open ai\|anthropic\|claude\|gemini\|google\|aws\|azure\|gcp\|github\|gitlab\|stripe\|slack\|twilio\|sendgrid\|mistral\|groq\|cohere\|deepseek\|hugging ?face\|hf\|perplexity\|xai\|grok\|replicate\|pinecone\|supabase\|vercel\|cloudflare\|heroku\|npm\|pypi\|docker\|discord\|telegram\|notion\|linear\|shopify\|firebase\|mapbox\|openrouter)(?:[ _-]?api)?[ _-]?(?:keys?\|tokens?\|secrets?)\|clave (?:de (?:la )?)?api\|cl(?:é\|e)s? (?:d'\|de l'\|de )?api\|api[ -]?schl(?:ü\|u)ssel\|api ?キー\|アクセストークン)(?:\s+(?:is\|was\|for\|of\|here\|my\|our\|the\|new\|test\|prod\|dev\|staging\|live\|token\|value\|es\|est\|ist\|de\|la\|el)){0,3}\s[:=]?\s["'`]?(?<v>(?=[A-Za-z0-9_\-./+=~]*[0-9_\-])[A-Za-z0-9][A-Za-z0-9_\-./+=~]{11,})
Token or secret written in a sentence secret_prose	API keys & tokens	high	Real value, randomness ≥ 2.5	show (?<![A-Za-z0-9_])(?:tokens?\|secrets?\|client[ _-]?secret\|credentials?\|creds\|passkey\|licen[cs]e[ _-]?key\|product[ _-]?key\|recovery[ _-]?(?:key\|code)\|backup[ _-]?codes?\|session[ _-]?(?:id\|token\|cookie))(?:\s+(?:is\|was\|for\|of\|here\|my\|our\|the\|new\|test\|prod\|dev\|staging\|live\|token\|value\|es\|est\|ist\|de\|la\|el)){0,3}\s[:=]?\s["'`]?(?<v>(?=[A-Za-z0-9_\-./+=~][0-9])(?=[A-Za-z0-9_\-./+=~][A-Za-z])[A-Za-z0-9][A-Za-z0-9_\-./+=~]{7,})
Database URL with password db_url_creds	Passwords & credentials	critical		show `\b(?:postgres(?:ql)?\|mysql\|mongodb(?:\+srv)?\|redis\|amqp\|mssql\|sqlserver)://[^\s:/@]+:[^\s@/]+@[^\s/]+`
Credentials embedded in URL url_basic_auth	Passwords & credentials	high		show `\b(?:https?\|ftps?\|sftp\|smtps?\|ldaps?\|ssh\|rediss?\|amqps?\|jdbc:[a-z]+)://[^\s:/@]+:[^\s@/]{3,}@[^\s/]+`
Password password_assign	Passwords & credentials	critical	Real value (not a placeholder or reference)	show (?<![A-Za-z0-9])(?:[A-Za-z0-9]{1,40}[_.-]){0,6}(?:password\|passwd\|pwd\|passcode\|pass_?phrase)["']?(?:\s[:=]\s["'`]?\|\s+is\s+["'`])(?<v>(?!/)[^\s"'`,;]{6,})
Password (written in a sentence) password_prose	Passwords & credentials	critical	Real value (not a placeholder or reference)	show (?<![A-Za-z0-9_])(?:password\|passwd\|pwd\|pw\|pass\|passcode\|passphrase\|passwort\|kennwort\|contrase(?:ñ\|n)a\|clave\|mot de passe\|mdp\|パスワード)(?:\s+(?:for\|to\|on\|of\|f(?:ü\|u)r\|para\|pour\|de\|du)\s+(?:(?:my\|the\|our\|mi\|la\|el\|mon\|ma\|le\|mein\|meine\|das\|die\|der)\s+)?[A-Za-z0-9._@-]{1,40})?(?:\s[:=]\s\|\s+(?:is\|was\|es\|est\|ist\|lautet)\s+(?:now\s+)?\|\sは\s\|\s+(?=[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-][A-Za-z])(?=[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-][0-9]))["'`]?(?<v>(?![$%{<(_./])(?=[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-][0-9!#$%&+=?@^~])[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-]{6,64})
Username and password pair credentials_pair	Passwords & credentials	critical	Real value (not a placeholder or reference)	show (?<![A-Za-z0-9_])(?:creds\|credentials\|login(?:\s/\spass(?:word)?)?\|user(?:name)?\s/\spass(?:word)?)\s[:=]\s[^\s/:]{1,64}(?:\s/\s\|:)["'`]?(?<v>(?![$%{<(_./])(?=[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-][A-Za-z])(?=[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-][0-9!#$%&+=?@^~])[A-Za-z0-9!#$%&()+./<=>?@^_{\|}~\[\]\\-]{6,64})
PIN or passcode pin_ctx	Passwords & credentials	high		show `(?<![A-Za-z0-9_])(?:(?:pin\|cvv2?\|cvc)\s(?:[:=]\|\s(?:is\|was\|es\|est\|ist\|lautet)\s\|は)\s\|(?:passcode\|pass code\|pin[ -]?code\|pin number\|code pin\|暗証番号\|(?:my\|bank\|card\|atm\|debit\|sim)\s+pin)(?:\s(?:[:=]\|\s(?:is\|was\|es\|est\|ist\|lautet)\s\|は)\s\|\s+))["']?(?<v>[0-9]{3,8})(?![0-9])`
Internal IP address ipv4_private	Network & infrastructure	low		show `\b(?:10\.(?:\d{1,3}\.){2}\d{1,3}\|192\.168\.\d{1,3}\.\d{1,3}\|172\.(?:1[6-9]\|2\d\|3[01])\.\d{1,3}\.\d{1,3})\b`
Internal hostname internal_hostname	Network & infrastructure	low		show `\b[a-z0-9-]+(?:\.[a-z0-9-]+)*\.(?:internal\|corp\|local\|lan\|intranet)\b`
US ITIN us_itin	Government & national IDs	critical		show `(?<![A-Za-z0-9_-])9[0-9]{2}([- ])(?:5[0-9]\|6[0-5]\|7[0-9]\|8[0-8]\|9[0-24-9])\1[0-9]{4}(?![A-Za-z0-9_-])\|(?<![A-Za-z0-9_])(?:itin\|individual taxpayer identification number)(?:\s+(?:is\|was\|number\|no\.?\|#))\s[:#=]?\s*9[0-9]{2}[- ]?(?:5[0-9]\|6[0-5]\|7[0-9]\|8[0-8]\|9[0-24-9])[- ]?[0-9]{4}(?![0-9])`
Canadian Social Insurance Number canada_sin	Government & national IDs	critical	SIN checksum	show `(?<![A-Za-z0-9_])(?:sin\|social insurance(?: number\| no\.?)?\|num(?:é\|e)ro d'assurance sociale\|nas)(?:\s+(?:is\|was\|est))?\s[:#=]?\s[0-9]{3}[ -]?[0-9]{3}[ -]?[0-9]{3}(?![0-9])`
Australian Tax File Number aus_tfn	Government & national IDs	critical	TFN check digit	show `\b(?:tfn\|tax file(?: number\| no\.?)?)\s[:#=]?\s\d{3}[ -]?\d{3}[ -]?\d{2,3}\b`
Aadhaar number india_aadhaar	Government & national IDs	critical	Verhoeff check digit	show `\baadhaa?r(?: no\.?\| number)?\s[:#=]?\s[2-9]\d{3}\s?\d{4}\s?\d{4}\b`
National ID number (labelled) national_id_ctx	Government & national IDs	high		show `\b(?:[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd]\|[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy]\|[Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Ff][Ii][Cc][Aa][Tt][Ii][Oo][Nn]\|[Ii][Dd] [Cc][Aa][Rr][Dd]\|[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Cc][Aa][Rr][Dd]\|[Cc][Ii][Tt][Ii][Zz][Ee][Nn] [Ii][Dd]\|[Cc][Oo][Dd][Ii][Cc][Ee] [Ff][Ii][Ss][Cc][Aa][Ll][Ee])(?: [Nn][Oo]\.?\| [Nn][Uu][Mm][Bb][Ee][Rr]\| #)?\s[:#=]\s(?<v>(?=[A-Z0-9 .-]*\d)[A-Z0-9][A-Z0-9 .-]{5,18}[A-Z0-9])\b`
Passport machine-readable zone passport_mrz	Government & national IDs	critical		show `\bP[A-Z<][A-Z]{3}[A-Z<]{30,39}\s*[A-Z0-9<]{9}\d[A-Z]{3}\d{6}`
German tax ID (Steuer-ID) de_steuer_id	Government & national IDs	critical	Steuer-ID check digit	show `\b(?:steuer-?id(?:entifikationsnummer)?\|steuerliche identifikationsnummer\|identifikationsnummer\|steuer-?identnummer\|idnr\|tax id(?:entification number)?\|tin)\.?(?: ?nr\.?\| no\.?\| number)?\s[:#=]?\s[1-9]\d ?\d{3} ?\d{3} ?\d{3}\b`
French social security number (NIR) fr_nir	Government & national IDs	critical	NIR key (mod 97)	show `\b[12] ?\d{2} ?(?:0[1-9]\|1[0-2]\|[2-9]\d) ?(?:\d{2}\|2[AB]) ?\d{3} ?\d{3} ?\d{2}\b`
Spanish DNI es_dni	Government & national IDs	critical	DNI/NIE check letter	show `\b\d{8}-?[A-Z]\b`
Spanish foreigner ID (NIE) es_nie	Government & national IDs	critical	DNI/NIE check letter	show `\b[XYZ]-?\d{7}-?[A-Z]\b`
Italian tax code (codice fiscale) it_codice_fiscale	Government & national IDs	critical	Codice fiscale check letter	show `\b[A-Z]{6}[0-9LMNP-V]{2}[A-EHLMPR-T][0-9LMNP-V]{2}[A-Z][0-9LMNP-V]{3}[A-Z]\b`
Dutch citizen service number (BSN) nl_bsn	Government & national IDs	critical	BSN 11-test	show `\b(?:bsn\|burger ?service ?nummer\|sofi-?nummer\|citizen service number)(?: ?nr\.?\| no\.?\| number\| nummer)?\s[:#=]?\s(?:\d{9}\|\d{4}\.\d{2}\.\d{3}\|\d{3} \d{3} \d{3})\b`
Polish PESEL number pl_pesel	Government & national IDs	critical	PESEL check digit	show `\bpesel(?: ?nr\.?\| no\.?\| number)?\s[:#=]?\s\d{11}\b`
Brazilian CPF br_cpf	Government & national IDs	critical	CPF check digits	show `\b\d{3}\.\d{3}\.\d{3}-\d{2}\b\|\bcpf(?: n[º°o]\.?\| number\| no\.?)?\s[:#=]?\s\d{11}\b`
Mexican CURP mx_curp	Government & national IDs	critical	CURP check digit	show `\b[A-Z][AEIOUX][A-Z]{2}\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])[HMX](?:AS\|BC\|BS\|CC\|CL\|CM\|CS\|CH\|DF\|DG\|GT\|GR\|HG\|JC\|MC\|MN\|MS\|NT\|NL\|OC\|PL\|QT\|QR\|SP\|SL\|SR\|TC\|TS\|TL\|VZ\|YN\|ZS\|NE)[B-DF-HJ-NP-TV-Z]{3}[A-Z\d]\d\b`
Singapore NRIC / FIN sg_nric	Government & national IDs	critical	NRIC/FIN check letter	show `\b[STFGM]\d{7}[A-Z]\b`
Japanese My Number jp_my_number	Government & national IDs	critical	My Number check digit	show `(?:\bmy ?number\|マイナンバー\|個人番号\|\bindividual number)(?: card\|カード)?(?: no\.?\| number\|番号)?(?:\s+is\|は)?\s[:#=：]?\s\d{4}[ -]?\d{4}[ -]?\d{4}\b`
Korean resident registration number kr_rrn	Government & national IDs	critical	RRN check digit	show `\b\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])-[1-8]\d{6}\b`
Korean resident registration number (labelled) kr_rrn_ctx	Government & national IDs	critical		show `(?:주민등록번호\|주민번호\|\brrn\|\bresident registration(?: number\| no\.?)?)\s[:#=]?\s\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])-?[1-8]\d{6}\b`
Israeli ID number (Teudat Zehut) il_teudat_zehut	Government & national IDs	critical	ID check digit	show `(?:ת[."״']?ז\.?\|תעודת זהות\|מספר זהות\|\bteudat zehut\|\bisraeli? id(?:entity)?(?: card)?(?: number\| no\.?)?)\s[:#=]?\s\d{8,9}\b`
South African ID number za_id	Government & national IDs	critical	Date + Luhn checksum	show `\b(?:(?:south african\|sa\|rsa) )?id(?:entity)?(?: number\| no\.?\| #)?\s[:#=]?\s\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])\d{4}[012]\d{2}\b`
New Zealand IRD number nz_ird	Government & national IDs	critical	IRD check digit	show `\b(?:ird\|inland revenue(?: department)?\|nz tax(?: file)?)(?: number\| no\.?\| #)?\s[:#=]?\s\d{2,3}[ -]?\d{3}[ -]?\d{3}\b`
China resident identity card number cn_resident_id	Government & national IDs	critical	ISO 7064 MOD 11-2 check	show `(?<![0-9A-Za-z])[1-9]\d{5}(?:18\|19\|20)\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])\d{3}[\dXx](?![0-9A-Za-z])`
Hong Kong identity card number hk_id	Government & national IDs	critical	HKID check digit	show `(?:\b(?:HKID\|HK ID\|[Hh][Oo][Nn][Gg] [Kk][Oo][Nn][Gg] (?:ID\|[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Cc][Aa][Rr][Dd])(?: [Nn][Oo]\.?\| [Nn][Uu][Mm][Bb][Ee][Rr])?)\s[:#=]?\s\|香港身份證(?:號碼)?\s[:#=：]?\s\|(?<![A-Za-z0-9])(?=[A-Z]{1,2}\d{6}$[0-9A]$))(?<v>[A-Z]{1,2}\d{6}$?[0-9A]$?)(?![A-Za-z0-9])`
India PAN (Permanent Account Number) in_pan	Government & national IDs	high		show `\b(?:PAN\|[Pp][Ee][Rr][Mm][Aa][Nn][Ee][Nn][Tt] [Aa][Cc][Cc][Oo][Uu][Nn][Tt] [Nn][Uu][Mm][Bb][Ee][Rr]\|[Pp][Aa][Nn] [Cc][Aa][Rr][Dd]\|[Pp][Aa][Nn] [Nn][Oo]\.?\|[Ii][Nn][Cc][Oo][Mm][Ee] [Tt][Aa][Xx](?: [Pp][Aa][Nn])?)(?: [Nn][Oo]\.?\| [Nn][Uu][Mm][Bb][Ee][Rr])?\s[:#=-]?\s(?<v>[A-Z]{3}[ABCFGHLJPT][A-Z]\d{4}[A-Z])\b`
Mexico RFC (tax ID) mx_rfc	Government & national IDs	high	RFC check character	show `(?<![A-Za-z0-9Ñ&])[A-ZÑ&]{3,4}\d{2}(?:0[1-9]\|1[0-2])(?:0[1-9]\|[12]\d\|3[01])[A-Z0-9]{2}[0-9A](?![A-Za-z0-9])`
Sweden personnummer se_personnummer	Government & national IDs	critical	Date + Luhn checksum	show `(?:\b(?:[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Uu][Mm][Mm][Ee][Rr]\|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Rr]\|[Ss][Aa][Mm][Oo][Rr][Dd][Nn][Ii][Nn][Gg][Ss][Nn][Uu][Mm][Mm][Ee][Rr]\|PNR\|[Ss][Ww][Ee][Dd][Ii][Ss][Hh] [Pp][Ee][Rr][Ss][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Nn][Uu][Mm][Bb][Ee][Rr])\.?\s[:#=]?\s)(?<v>(?:19\|20)?\d{2}(?:0[1-9]\|1[0-2])\d{2}[-+]?\d{4})\b`
Norway fødselsnummer no_fodselsnummer	Government & national IDs	critical	Date + two mod-11 check digits	show `\b(?:[Ff]ø[Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]\|[Ff][Oo][Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]\|[Ff][Oo][Ee][Dd][Ss][Ee][Ll][Ss][Nn][Uu][Mm][Mm][Ee][Rr]\|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Uu][Mm][Mm][Ee][Rr]\|[Ff]\.[Nn][Rr]\.?\|[Ff][Nn][Rr]\.?\|[Nn][Oo][Rr][Ww][Ee][Gg][Ii][Aa][Nn] [Nn][Aa][Tt][Ii][Oo][Nn][Aa][Ll] [Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy] [Nn][Uu][Mm][Bb][Ee][Rr])\s[:#=]?\s(?<v>\d{6} ?\d{5})\b`
Denmark CPR number dk_cpr	Government & national IDs	critical	Date check	show `\b[Cc][Pp][Rr](?:-?[Nn][Rr]\.?\|-?[Nn][Uu][Mm][Mm][Ee][Rr]\| [Nn][Uu][Mm][Bb][Ee][Rr])?\s[:#=]?\s(?<v>(?:0[1-9]\|[12]\d\|3[01])(?:0[1-9]\|1[0-2])\d{2}-?\d{4})\b`
Finland personal identity code (HETU) fi_hetu	Government & national IDs	critical	Date + mod-31 check character	show `\b(?:0[1-9]\|[12]\d\|3[01])(?:0[1-9]\|1[0-2])\d{2}[-+A-FU-Y]\d{3}[0-9A-FHJ-NPR-Y]\b`
Switzerland AHV/AVS number ch_ahv	Government & national IDs	critical	EAN-13 check digit	show `\b756[. ]?\d{4}[. ]?\d{4}[. ]?\d{2}\b`
Ireland PPS number ie_ppsn	Government & national IDs	critical	Mod-23 check letter	show `\b(?:PPSN?\|[Pp][Pp][Ss] [Nn][Oo]\.?\|[Pp][Pp][Ss] [Nn][Uu][Mm][Bb][Ee][Rr]\|[Pp][Ee][Rr][Ss][Oo][Nn][Aa][Ll] [Pp][Uu][Bb][Ll][Ii][Cc] [Ss][Ee][Rr][Vv][Ii][Cc][Ee] [Nn][Uu][Mm][Bb][Ee][Rr])\s[:#=]?\s(?<v>\d{7}[A-W][A-IW]?)\b`
Turkey T.C. Kimlik number tr_tckn	Government & national IDs	critical	Two check digits	show `(?:\b(?:T\.?C\.? ?[Kk][Ii][Mm][Ll][Ii][Kk](?: [Nn][Oo]\.?\| [Nn][Uu][Mm][Aa][Rr][Aa][Ss]ı\| [Nn][Uu][Mm][Aa][Rr][Aa][Ss][Ii])?\|TCKN\|TC [Nn][Oo]\.?\|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Oo]\.?\|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Uu][Mm][Aa][Rr][Aa][Ss]ı\|[Kk][Ii][Mm][Ll][Ii][Kk] [Nn][Uu][Mm][Aa][Rr][Aa][Ss][Ii]\|[Tt][Uu][Rr][Kk][Ii][Ss][Hh] [Ii][Dd] [Nn][Uu][Mm][Bb][Ee][Rr]))\s[:#=]?\s(?<v>[1-9]\d{10})\b`
UAE Emirates ID number ae_emirates_id	Government & national IDs	critical	Luhn checksum	show `\b784[- ]?\d{4}[- ]?\d{7}[- ]?\d\b`
Person name person_name	Personal data (PII)	medium	First + surname lists	show `\b[A-Z][a-z]{1,14}(?: [A-Z]\.?)? [A-Z][a-z]{1,19}(?:-[A-Z][a-z]{1,19})?\b`
Person name (labelled) person_name_ctx	Personal data (PII)	medium		show \b(?:[Ff][Uu][Ll][Ll] [Nn][Aa][Mm][Ee]\|[Ff][Ii][Rr][Ss][Tt] [Nn][Aa][Mm][Ee]\|[Ll][Aa][Ss][Tt] [Nn][Aa][Mm][Ee]\|[Ss][Uu][Rr][Nn][Aa][Mm][Ee]\|[Nn][Aa][Mm][Ee]\|[Pp][Aa][Tt][Ii][Ee][Nn][Tt]\|[Ee][Mm][Pp][Ll][Oo][Yy][Ee][Ee]\|[Ss][Tt][Uu][Dd][Ee][Nn][Tt]\|[Cc][Uu][Ss][Tt][Oo][Mm][Ee][Rr]\|[Cc][Ll][Ii][Ee][Nn][Tt]\|[Aa][Pp][Pp][Ll][Ii][Cc][Aa][Nn][Tt]\|[Cc][Aa][Nn][Dd][Ii][Dd][Aa][Tt][Ee]\|[Tt][Ee][Nn][Aa][Nn][Tt]\|[Bb][Ee][Nn][Ee][Ff][Ii][Cc][Ii][Aa][Rr][Yy]\|[Cc][Ll][Aa][Ii][Mm][Aa][Nn][Tt]\|[Aa][Cc][Cc][Oo][Uu][Nn][Tt] [Hh][Oo][Ll][Dd][Ee][Rr]\|[Cc][Aa][Rr][Dd][Hh][Oo][Ll][Dd][Ee][Rr])\s[:=]\s(?!(?:Null\|None\|String\|Name\|True\|False\|Undefined\|This\|Self)\b)[A-Z][a-zA-Z'-]{1,20}(?:[ ,]+[A-Z][a-zA-Z'-]{1,20}){0,3}
Person name (title) person_salutation	Personal data (PII)	medium		show `\b(?:Mr\|Mrs\|Ms\|Miss\|Mx\|Dr\|Prof)\.? [A-Z][a-z]{1,14}(?: [A-Z][a-z]{1,19}){0,2}\b`
UK postcode uk_postcode	Personal data (PII)	low		show `\b(?:[A-Z]{1,2}\d[A-Z\d]?) ?\d[A-Z]{2}\b`
Home address (labelled) address_ctx	Personal data (PII)	medium		show `\b(?:home address\|address\|addr\|residence\|lives at\|mailing address)\s[:=]\s\d{1,5}[A-Za-z]? [A-Za-z0-9 .,'-]{4,80}`

Finance & Accounting 14

Detector	Category	Risk	Extra check	Pattern
Payment card number (Visa, Mastercard, Amex, Discover) credit_card	Financial data	critical	Card network (IIN), length + Luhn · Context words	show `(?<!\d)(?:\d{4}[ -]\d{6}[ -]\d{4,5}\|\d{4}(?:[ -]\d{4}){2,3}(?:[ -]\d{1,4})?\|\d{12,19}\|(?:\d ){12,18}\d(?! \d))(?!\d)`
IBAN bank account iban	Financial data	high	IBAN mod-97	show `\b[A-Z]{2}\d{2}(?:[ -]?[A-Z0-9]{4}){2,7}(?:[ -]?[A-Z0-9]{1,4})?\b`
Bank account number us_bank_ctx	Financial data	high		show `(?<![A-Za-z0-9_])(?:(?:bank\|checking\|savings\|chequing\|current)\s+account\|account\|acct\|a/c\|kontonummer\|konto\|num(?:é\|e)ro de compte\|n(?:ú\|u)mero de cuenta\|口座番号)(?:\s+(?:number\|no\.?\|num\|#\|nr\.?))?(?:\s+(?:is\|was\|es\|est\|ist))?\s[:#=]?\s(?:は\s*)?(?<v>[0-9]{6,17})(?![0-9])`
Payment card number (JCB, Diners, UnionPay, Maestro, Mir) credit_card_other	Financial data	critical	Card network (IIN), length + Luhn · Context words	show `(?<!\d)(?:\d{4}[ -]\d{6}[ -]\d{4,5}\|\d{4}(?:[ -]\d{4}){2,3}(?:[ -]\d{1,4})?\|\d{12,19}\|(?:\d ){12,18}\d(?! \d))(?!\d)`
Card magnetic-stripe (track) data card_track_data	Financial data	critical		show `%B\d{13,19}\^[^^]{2,26}\^\d{4}\|;\d{13,19}=\d{4}\d*\?`
Card expiry date card_expiry	Financial data	medium		show `\b(?:exp(?:iry\|iration)?(?: date)?\|valid (?:thru\|through)\|expires)\s[:=]?\s(?:0[1-9]\|1[0-2])\s/\s(?:\d{2}\|20\d{2})\b`
SWIFT / BIC code swift_bic	Financial data	high	Country code check	show `\b(?:[Ss][Ww][Ii][Ff][Tt]\|[Bb][Ii][Cc])(?: [Cc][Oo][Dd][Ee])?\s[:#=]?\s(?<v>[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b`
US bank routing number (ABA) aba_routing	Financial data	high	ABA checksum	show `(?<![A-Za-z0-9_])(?:routing\|aba\|rtn)(?: number\| no\.?\| #)?(?:\s+(?:is\|was))?\s[:#=]?\s[0-9]{9}(?![0-9])`
UK sort code & account uk_sort_code	Financial data	high		show `\bsort ?code\s[:#=]?\s\d{2}-?\d{2}-?\d{2}(?:[,;\s]+(?:a/?c\|account)(?: no\.?\| number)?\s[:#=]?\s\d{8})?`
US employer tax ID (EIN) us_ein	Financial data	high		show `\b(?:ein\|fein\|tax id\|tin\|employer id(?:entification)?(?: number)?)\s[:#=]?\s\d{2}-\d{7}\b`
VAT registration number vat_number	Financial data	medium		show `\b[Vv][Aa][Tt](?: [Rr][Ee][Gg](?:[Ii][Ss][Tt][Rr][Aa][Tt][Ii][Oo][Nn])?)?(?: [Nn][Oo]\.?\| [Nn][Uu][Mm][Bb][Ee][Rr]\| [Ii][Dd])?\s[:#=]?\s(?<v>[A-Z]{2}(?=[A-Z0-9]*\d)[A-Z0-9]{8,12})\b`
Salary / compensation figure salary_comp	Financial data	medium		show `\b(?:salary\|annual comp(?:ensation)?\|base pay\|total comp\|bonus\|payroll)\b[^\n.]{0,30}?[$£€]\s?\d{1,3}(?:,\d{3})+(?:\.\d{2})?`
Payment instruction change (BEC risk) invoice_bank_change	Financial data	high		show `\b(?:updated?\|new\|changed?)\s+(?:bank(?:ing)?\|wire\|remittance\|payment)\s+(?:details\|instructions\|account)\b`
Brazilian company ID (CNPJ) br_cnpj	Financial data	high	CNPJ check digits	show `\b[0-9A-Z]{2}\.[0-9A-Z]{3}\.[0-9A-Z]{3}/[0-9A-Z]{4}-\d{2}\b\|\bcnpj(?: n[º°o]\.?\| number\| no\.?)?\s[:#=]?\s[0-9A-Z]{12}\d{2}\b`

Healthcare & MedTech 9

Detector	Category	Risk	Extra check	Pattern
Australian Medicare number au_medicare	Patient health data (PHI)	critical	Medicare check digit	show `\bmedicare(?: card)?(?: number\| no\.?\| #)?\s[:#=]?\s[2-6]\d{3} ?\d{5} ?\d(?:[ /-]?\d)?\b`
Medical record number (MRN) medical_record	Patient health data (PHI)	critical		show `\b(?:[Mm][Rr][Nn]\|[Mm][Ee][Dd][Ii][Cc][Aa][Ll] [Rr][Ee][Cc][Oo][Rr][Dd](?: [Nn][Uu][Mm][Bb][Ee][Rr]\| [Nn][Oo]\.?\| #)?\|[Pp][Aa][Tt][Ii][Ee][Nn][Tt] (?:[Ii][Dd]\|[Nn][Uu][Mm][Bb][Ee][Rr]\|[Nn][Oo]\.?)\|[Cc][Hh][Aa][Rr][Tt] (?:[Nn][Oo]\.?\|[Nn][Uu][Mm][Bb][Ee][Rr]))\s[:#=]?\s(?<v>(?=[A-Z0-9-]*\d)[A-Z0-9][A-Z0-9-]{4,14})\b`
US National Provider Identifier (NPI) npi_number	Patient health data (PHI)	high	NPI checksum	show `\bnpi(?: number\| no\.?\| #)?\s[:#=]?\s\d{10}\b`
DEA registration number dea_number	Patient health data (PHI)	high	DEA checksum · Context words	show `\b[ABCDEFGHJKLMPRSTUX][A-Z9]\d{7}\b`
Medicare Beneficiary Identifier medicare_mbi	Patient health data (PHI)	critical		show `\b[1-9][AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y0-9]\d[AC-HJKMNP-RT-Y][AC-HJKMNP-RT-Y0-9]\d[AC-HJKMNP-RT-Y]{2}\d{2}\b`
NHS number nhs_number	Patient health data (PHI)	critical	NHS mod-11	show `\bnhs(?: number\| no\.?\| #)?\s[:#=]?\s\d{3}[ -]?\d{3}[ -]?\d{4}\b`
Health insurance member / policy ID health_plan_id	Patient health data (PHI)	high		show `\b(?:[Mm][Ee][Mm][Bb][Ee][Rr] [Ii][Dd]\|[Ss][Uu][Bb][Ss][Cc][Rr][Ii][Bb][Ee][Rr] [Ii][Dd]\|[Pp][Oo][Ll][Ii][Cc][Yy] (?:[Nn][Oo]\.?\|[Nn][Uu][Mm][Bb][Ee][Rr])\|[Ii][Nn][Ss][Uu][Rr][Aa][Nn][Cc][Ee] [Ii][Dd]\|[Hh][Ee][Aa][Ll][Tt][Hh] [Pp][Ll][Aa][Nn] (?:[Ii][Dd]\|[Nn][Oo]\.?)\|[Gg][Rr][Oo][Uu][Pp] (?:[Nn][Oo]\.?\|[Nn][Uu][Mm][Bb][Ee][Rr]))\s[:#=]?\s(?<v>(?=[A-Z0-9-]*\d)[A-Z0-9][A-Z0-9-]{5,19})\b`
Diagnosis code (ICD-10) icd10_dx	Patient health data (PHI)	high		show `\b(?:diagnos(?:is\|ed)\|dx\|icd-?10(?:-cm)?)\s(?:code)?\s[:#=]?\s*[A-TV-Z]\d[0-9AB](?:\.[0-9A-TV-Z]{1,4})?\b`
Patient clinical details phi_clinical	Patient health data (PHI)	high		show `\bpatient\b[^.\n]{0,80}\b(?:diagnosed with\|prescribed\|presents with\|history of\|positive for\|admitted (?:for\|with)\|hiv\|cancer\|diabetes\|pregnan\w\|psychiatric\|overdose\|dementia\|schizophreni\w\|opioid)\b`

Contracts & Legal 4

Detector	Category	Risk	Pattern
Confidentiality marking confidential_marker	Contracts & confidential	medium	show `\b(?:strictly confidential\|highly confidential\|proprietary (?:and\|&) confidential\|company confidential\|internal use only\|do not (?:distribute\|forward\|share)\|confidential(?:ity)? notice\|not for (?:external\|public) (?:distribution\|release))\b`
Attorney-client privileged privileged_legal	Contracts & confidential	high	show `\b(?:attorney[- ]client privileged?\|privileged (?:&\|and) confidential\|attorney work[- ]product\|legally privileged)\b`
Contract / agreement text contract_text	Contracts & confidential	high	show `\b(?:this (?:agreement\|contract\|amendment)\|master (?:services\|subscription) agreement\|statement of work\|non-disclosure agreement\|mutual nda\|term sheet\|letter of intent\|share purchase agreement\|asset purchase agreement\|employment agreement\|settlement agreement)\b[\s\S]{0,600}?\b(?:hereinafter\|whereas\|governing law\|indemnif\w+\|limitation of liability\|the parties\|effective date)\b`
Material non-public information mnpi	Contracts & confidential	high	show `\b(?:material non-?public information\|mnpi\|under embargo\|embargoed until\|pre-?release (?:earnings\|results)\|insider information\|draft (?:earnings\|10-?[kq]) (?:release\|filing)\|pending (?:acquisition\|merger) of)\b`

Web3 & Crypto 7

Detector	Category	Risk	Extra check	Pattern
Ethereum / EVM private key eth_private_key	Crypto keys & wallets	critical	Randomness ≥ 3.0 · Context words	show `\b(?:0x)?[0-9a-fA-F]{64}\b`
Bitcoin WIF private key btc_wif	Crypto keys & wallets	critical	Base58Check checksum	show `\b[5KL][1-9A-HJ-NP-Za-km-z]{50,51}\b`
Extended private key (xprv) xprv	Crypto keys & wallets	critical	Base58Check checksum	show `\b[xyzt]prv[1-9A-HJ-NP-Za-km-z]{100,112}\b`
Nostr private key (nsec) nostr_nsec	Crypto keys & wallets	critical		show `\bnsec1[02-9ac-hj-np-z]{58}\b`
Solana private key solana_private_key	Crypto keys & wallets	critical	Randomness ≥ 4.5 · Context words	show `\b[1-9A-HJ-NP-Za-km-z]{86,88}\b`
Wallet recovery (seed) phrase (BIP-39, 10 languages) seed_phrase	Crypto keys & wallets	critical	BIP-39 word lists (10 languages) + checksum	show `\b(?:[a-z]{3,8}\s+){11,23}[a-z]{3,8}\b`
Crypto wallet address eth_address	Crypto keys & wallets	low		show `\b0x[0-9a-fA-F]{40}\b\|\bbc1[02-9ac-hj-np-z]{25,62}\b`

Banking & Financial Services 5

Detector	Category	Risk	Pattern
Card security code (CVV) card_cvv_ctx	Financial data	critical	show `\b(?:cvv2?\|cvc2?\|cid\|card security code\|security code)\s[:=#]?\s\d{3,4}\b`
Loan / mortgage account number loan_account_ctx	Financial data	high	show `\b(?:loan\|mortgage\|credit line\|heloc)(?: account)?(?: number\| no\.?\| #\| id)?\s[:#=]\s[A-Z0-9-]{6,20}\b`
Brokerage / investment account brokerage_account_ctx	Financial data	high	show `\b(?:brokerage\|investment\|trading\|isa\|401$k$\|ira\|pension)(?: account)?(?: number\| no\.?\| #)?\s[:#=]\s[A-Z0-9-]{6,17}\b`
SWIFT payment message fields swift_mt_message	Financial data	high	show `(?:^\|\n):(?:20\|32A\|50K\|59\|57A\|52A):[^\n]{3,}`
KYC / AML case material kyc_marker	Financial data	medium	show `\b(?:suspicious activity report\|\bSAR\b filing\|know your customer\|KYC (?:file\|record\|review)\|AML (?:alert\|case\|investigation)\|sanctions (?:hit\|match\|screening result))\b`

Government & Public Sector 5

Detector	Category	Risk	Pattern
Government classification marking gov_classification	Classified & export-controlled	critical	show `\b(?:TOP SECRET(?://[A-Z/ ,-]+)?\|SECRET//[A-Z/ ,-]+\|CONFIDENTIAL//[A-Z/ ,-]+\|$TS$\|$S//NF$\|$S$//\|NOFORN\|ORCON\|REL TO [A-Z, ]{3,})`
Controlled Unclassified Information (CUI) cui_marking	Classified & export-controlled	high	show `\b(?:CUI(?://[A-Z-]+)?\|CONTROLLED UNCLASSIFIED INFORMATION\|FOUO\|FOR OFFICIAL USE ONLY\|LAW ENFORCEMENT SENSITIVE\|SENSITIVE BUT UNCLASSIFIED\|LIMITED OFFICIAL USE)\b`
UK government security marking uk_gov_marking	Classified & export-controlled	high	show `\b(?:OFFICIAL[- ]SENSITIVE\|UK OFFICIAL[- ]SENSITIVE\|UK SECRET\|UK TOP SECRET\|UK EYES ONLY)\b`
Government case / benefits reference gov_case_ref	Government & national IDs	medium	show `\b(?:case (?:number\|no\.?\|ref(?:erence)?)\|benefits? (?:claim )?(?:number\|reference)\|alien (?:registration )?number\|a-number\|uscis (?:number\|#)\|visa (?:number\|no\.?)\|immigration (?:reference\|case))\s[:#=]?\s[A-Z]{0,3}[0-9][A-Z0-9-]{5,15}\b`
Medicaid / benefits ID (labelled) us_medicaid_ctx	Government & national IDs	high	show `\b(?:[Mm][Ee][Dd][Ii][Cc][Aa][Ii][Dd]\|[Ss][Nn][Aa][Pp]\|[Ee][Bb][Tt]\|[Ww][Ii][Cc]) (?:[Ii][Dd]\|[Nn][Uu][Mm][Bb][Ee][Rr]\|[Cc][Aa][Rr][Dd])(?: [Nn][Oo]\.?\| #)?\s[:#=]?\s(?<v>(?=[A-Z0-9]*\d)[A-Z0-9]{8,14})\b`

Military & Defence 6

Detector	Category	Risk	Extra check	Pattern
NATO / allied classification nato_marking	Classified & export-controlled	critical		show `\b(?:COSMIC TOP SECRET\|NATO SECRET\|NATO CONFIDENTIAL\|NATO RESTRICTED\|ATOMAL\|FVEY\|FIVE EYES ONLY)\b`
Export-controlled (ITAR / EAR) export_control	Classified & export-controlled	high		show `\b(?:ITAR[- ](?:controlled\|restricted\|technical data)\|subject to (?:the )?(?:ITAR\|EAR)\|export controlled\|EAR99\|ECCN\s[:#]?\s\d[A-E]\d{3}\|USML Category [IVXL]+\|22 CFR 120)\b`
DoD ID / EDIPI (labelled) dod_id	Government & national IDs	high		show `\b(?:dod id\|edipi\|cac (?:id\|number)\|service number\|military id)(?: no\.?\| #)?\s[:#=]?\s\d{10}\b`
NATO Stock Number (NSN) nsn	Contracts & confidential	medium	Context words	show `\b\d{4}-\d{2}-\d{3}-\d{4}\b`
Military grid coordinates (MGRS) mgrs_coordinate	Classified & export-controlled	high		show `\b\d{1,2}[C-HJ-NP-X] ?[A-HJ-NP-Z]{2} ?\d{4,5} ?\d{4,5}\b`
CAGE code (labelled) cage_code	Contracts & confidential	low		show `\bcage(?: code)?\s[:#=]\s[A-Z0-9]{5}\b`

Education 3

Detector	Category	Risk	Extra check	Pattern
Student ID (labelled) student_id_ctx	Personal data (PII)	high		show `\b(?:[Ss][Tt][Uu][Dd][Ee][Nn][Tt]\|[Pp][Uu][Pp][Ii][Ll]\|[Ll][Ee][Aa][Rr][Nn][Ee][Rr]\|[Ee][Nn][Rr][Oo][Ll][Mm][Ee][Nn][Tt]\|[Ee][Nn][Rr][Oo][Ll][Ll][Mm][Ee][Nn][Tt])(?: [Ii][Dd]\| [Nn][Uu][Mm][Bb][Ee][Rr]\| [Nn][Oo]\.?\| #)\s[:#=]?\s(?<v>(?=[A-Z0-9-]*\d)[A-Z0-9-]{5,15})\b`
UK Unique Pupil Number (UPN) uk_upn	Personal data (PII)	high	Context words	show `\b[A-HJ-NP-RTV-Z]\d{11}[0-9A-HJ-NP-RTV-Z]\b`
Education record (grades, SEN, discipline) education_record	Personal data (PII)	medium		show `\b(?:gpa\s[:=]\s\d\.\d{1,2}\|transcript for\|report card\|iep\b\|individuali[sz]ed education (?:plan\|program)\|special educational needs\|sen(?:d)? (?:status\|support)\|ehcp\|504 plan\|disciplinary record\|exclusion record\|safeguarding (?:concern\|referral)\|ferpa)\b`

Insurance & HR 3

Detector	Category	Risk	Pattern
Insurance policy / claim number insurance_policy_ctx	Financial data	high	show `\b(?:policy\|claim\|member\|subscriber)(?: number\| no\.?\| #\| id)\s[:#=]?\s[A-Z]{0,4}[0-9][A-Z0-9-]{5,18}\b`
Employee ID (labelled) employee_id_ctx	Personal data (PII)	medium	show `\b(?:[Ee][Mm][Pp][Ll][Oo][Yy][Ee][Ee]\|[Ss][Tt][Aa][Ff][Ff]\|[Pp][Aa][Yy][Rr][Oo][Ll][Ll]\|[Pp][Ee][Rr][Ss][Oo][Nn][Nn][Ee][Ll]\|[Bb][Aa][Dd][Gg][Ee])(?: [Ii][Dd]\| [Nn][Uu][Mm][Bb][Ee][Rr]\| [Nn][Oo]\.?\| #)\s[:#=]?\s(?<v>(?=[A-Z0-9-]*\d)[A-Z0-9-]{4,12})\b`
HR-sensitive matter hr_sensitive	Contracts & confidential	high	show `\b(?:performance improvement plan\|disciplinary (?:hearing\|action\|meeting)\|grievance (?:hearing\|investigation)\|termination (?:letter\|meeting\|of employment)\|redundancy (?:list\|selection)\|severance (?:agreement\|package)\|sick(?:ness)? absence record\|fit note\|occupational health report\|background check result\|right to work check)\b`

Telecoms 3

Detector	Category	Risk	Extra check	Pattern
Device IMEI imei	Government & national IDs	medium	Luhn checksum · Context words	show `\b\d{15}\b`
SIM card number (ICCID) iccid	Government & national IDs	medium	Luhn checksum	show `\b89\d{17,18}\b`
Subscriber identity (IMSI) imsi_ctx	Government & national IDs	medium		show `\bimsi\s[:#=]?\s\d{14,15}\b`