Built-in Rules

Sensitive Data Scanner ships 75 built-in detection rules, all active by default. Every rule can be disabled or re-enabled per installation from the Rule Catalog, and custom rules can be added alongside them.

A few rules match formats broad enough that their hit rate depends on the Jira instance - postal addresses, IP addresses, employee IDs, national identifiers, domestic bank accounts, residence permits. If one of them buries the genuine secrets under false positives on your content, disable it in the Rule Catalog.

Precedence between rules

• Provider-specific credential matches win over generic assignment and high-entropy candidates when their spans overlap. An AWS key is reported as an AWS key, not as "high entropy token".
• The Swiss QR-IBAN, Swiss IBAN, Swiss identity-document MRZ, and Swiss phone rules take precedence over their generic counterparts.

Validation beyond the regex

Several rules check more than a shape, so a number that merely looks right is not reported:

• Swiss AHV/AVS numbers require the 756 prefix and a valid EAN-13 check digit.
• Swiss QR references require the recursive Modulo-10 check digit.
• Swiss QR-IBANs additionally require a QR-IID in the reserved 30000-31999 range.

Rule versioning

Built-in rules are versioned and immutable. A new release appends a new rule version rather than editing the old one, and preserves whatever active/inactive choice an administrator has made.

One consequence is worth knowing: toggling a built-in rule on or off appends a version of your own, which raises its version number above the shipped catalog's. Startup reconciliation only appends when the catalog version is higher than the stored one, so a built-in rule you have toggled stops picking up catalog updates automatically. Rule detail shows the full version history, and you can roll back to any earlier version.

Built-in rules can be enabled without a test run - their regexes ship pre-validated and covered by tests. The test-before-activation gate applies to custom rules only.

The catalog

Core secret patterns

6 rules.

Rule	ID	Category	Severity
AWS access key candidate	secret.aws-access-key-candidate	Secret	High
Bearer token candidate	secret.bearer-token-candidate	Secret	High
PEM private key block	secret.pem-private-key-block	Secret	Critical
JWT candidate	secret.jwt-candidate	Secret	High
Password assignment	secret.password-assignment	Secret	Medium
High entropy token candidate	secret.high-entropy-token-candidate	Secret	Medium

Core PII patterns

2 rules.

Rule	ID	Category	Severity
Email address	pii.email-address	PII	Low
Phone number candidate	pii.phone-number-candidate	PII	Low

Core financial patterns

5 rules.

Rule	ID	Category	Severity
IBAN candidate	financial.iban-candidate	Financial	Medium
Credit card candidate	financial.credit-card-candidate	Financial	High
BIC/SWIFT code candidate	financial.bic-candidate	Financial	Low
US ABA routing number candidate	financial.us-routing-number-candidate	Financial	Medium
Crypto wallet address candidate	financial.crypto-wallet-candidate	Financial	Medium

Core telecom patterns

4 rules.

Rule	ID	Category	Severity
IMEI candidate	telecom.imei-candidate	Telecom	Medium
SIM ICCID candidate	telecom.iccid-candidate	Telecom	Medium
MAC address candidate	telecom.mac-address-candidate	Telecom	Low
SIP URI candidate	telecom.sip-uri-candidate	Telecom	Low

Provider credentials

29 rules.

Rule	ID	Category	Severity
AWS secret access key	credential.aws-secret-access-key	Credential	Critical
AWS session token	credential.aws-session-token	Credential	Critical
GitHub token	credential.github-token	Credential	Critical
GitLab token	credential.gitlab-token	Credential	Critical
Slack token	credential.slack-token	Credential	High
Slack webhook	credential.slack-webhook	Credential	High
Stripe secret key	credential.stripe-secret-key	Credential	Critical
Stripe test key	credential.stripe-test-key	Credential	Low
Google API key	credential.google-api-key	Credential	High
GCP service account private key	credential.gcp-service-account	Credential	Critical
Azure storage key	credential.azure-storage-key	Credential	Critical
Azure SAS token	credential.azure-sas-token	Credential	High
SendGrid API key	credential.sendgrid-api-key	Credential	Critical
npm access token	credential.npm-access-token	Credential	High
PyPI API token	credential.pypi-api-token	Credential	High
OpenAI API key	credential.openai-api-key	Credential	Critical
Hugging Face token	credential.huggingface-token	Credential	High
Twilio API key	credential.twilio-api-key	Credential	High
Mailgun API key	credential.mailgun-api-key	Credential	High
Shopify access token	credential.shopify-access-token	Credential	High
DigitalOcean token	credential.digitalocean-token	Credential	High
Telegram bot token	credential.telegram-bot-token	Credential	High
Discord credential	credential.discord-token	Credential	High
Cloudflare API token	credential.cloudflare-token	Credential	High
Atlassian API token	credential.atlassian-api-token	Credential	High
Database URI with password	credential.database-uri	Credential	Critical
Basic-auth URL	credential.basic-auth-url	Credential	High
Docker registry auth	credential.docker-config-auth	Credential	Critical
Kubernetes Secret	credential.kubernetes-secret	Credential	High

Generic secret assignments

4 rules.

Rule	ID	Category	Severity
API key assignment	secret.generic-api-key-assignment	Secret	High
Client secret assignment	secret.generic-client-secret-assignment	Secret	High
Token assignment	secret.generic-token-assignment	Secret	High
Crypto seed phrase	secret.crypto-seed-phrase	Secret	Critical

Extended PII

11 rules.

Rule	ID	Category	Severity
US Social Security number	pii.us-social-security-number	PII	High
National identifier candidate	pii.national-identifier-candidate	PII	High
Passport MRZ	pii.passport-mrz	PII	High
Date of birth	pii.date-of-birth	PII	Medium
IP address	pii.ip-address	PII	Low
Physical address	pii.physical-address	PII	Low
GPS coordinate	pii.gps-coordinate	PII	Medium
Medical record number	pii.medical-record-number	PII	High
Health insurance identifier	pii.health-insurance-identifier	PII	High
Employee identifier	pii.employee-identifier	PII	Low
Vehicle identification number	pii.vehicle-identification-number	PII	Medium

Extended financial

3 rules.

Rule	ID	Category	Severity
Domestic bank account	financial.domestic-bank-account	Financial	Medium
Tax identifier	financial.tax-identifier	Financial	Medium
Card security code	financial.card-security-code	Financial	High

Extended telecom

3 rules.

Rule	ID	Category	Severity
IMSI candidate	telecom.imsi-candidate	Telecom	Medium
eSIM EID candidate	telecom.esim-eid-candidate	Telecom	Medium
MSISDN candidate	telecom.msisdn-contextual	Telecom	Low

Switzerland-specific

8 rules.

Rule	ID	Category	Severity
Swiss AHV/AVS number	pii.ch-ahv-number	PII	High
Swiss identity document MRZ	pii.ch-identity-document-mrz	PII	High
Swiss or Liechtenstein IBAN	financial.ch-iban	Financial	Medium
Swiss QR-IBAN	financial.ch-qr-iban	Financial	Medium
Swiss QR reference	financial.ch-qr-reference	Financial	Low
Swiss phone number	pii.ch-phone-number	PII	Low
Swiss address	pii.ch-address	PII	Low
Swiss residence permit	pii.ch-residence-permit	PII	Medium

What is deliberately not a rule

The Swiss UID/VAT number (CHE-... with MWST, TVA, or IVA) is a public business identifier, not sensitive data, and is intentionally absent from the security catalog.

Extending the catalog

• Custom rules - write your own regex, test it against positive and negative examples, then activate.
• Ruleset transfer - move custom rules between environments.