# Secret hygiene patterns used by .github/workflows/ci.yml.
# One extended-regex per line. Lines starting with `#` and blank lines are ignored.
# Keep this file out of the scan via --exclude in the workflow.

# OpenAI keys and config tokens
sk-[A-Za-z0-9_-]{20,}
OPENAI_API_KEY[[:space:]]*=sk-
APP_SECRET[[:space:]]*=

# AWS access keys
AKIA[0-9A-Z]{16}
ASIA[0-9A-Z]{16}

# GitHub tokens
ghp_[A-Za-z0-9]{36}
ghs_[A-Za-z0-9]{36}
ghu_[A-Za-z0-9]{36}
gho_[A-Za-z0-9]{36}
github_pat_[A-Za-z0-9_]{20,}

# Slack tokens and webhooks
xox[abprs]-[A-Za-z0-9-]{10,}
hooks\.slack\.com/services/

# Discord webhooks
discord(app)?\.com/api/webhooks/

# Google API keys
AIza[0-9A-Za-z_-]{35}

# Generic private key blocks
-----BEGIN [A-Z ]*PRIVATE KEY-----