skills/plugins/library-navigator/skills/sp-security-codes/SKILL.md

name, description

name	description
sp-security-codes	Detect and sanitise sensitive security-code leakage in strings — API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS keys.

Architecture

Component	Responsibility
SecurityCodeDetector	Detects secrets in arbitrary strings via 10+ built-in pattern detectors
SecurityCodeSanitizer	Masks detected secrets with 4 strategies: full-redact, partial, hash, tokenize
detectAws / detectJwt / detectStripe / detectGithub / detectGoogle / detectOpenAI	Built-in pattern matchers for specific secret types
detectCreditCard	Luhn-validated credit card detection
detectPem / detectSsh	PEM-encoded blocks and SSH key detection
detectEntropy	High-entropy heuristic for unknown secret tokens
luhnCheck	Luhn checksum validator
SECURITY_CODES_CODES + SecurityCodesError	Structured error registry

File Structure

packages/security-stack/security/security-codes/src/
  core/code-detector/     SecurityCodeDetector with pluggable detector API
  core/code-sanitizer/    SecurityCodeSanitizer with 4 masking strategies
  patterns/               AWS, JWT, Stripe, GitHub, Google, OpenAI, credit-card, PEM, SSH, entropy
  utils/                  luhnCheck utility
  errors/                 SECURITY_CODES_CODES and SecurityCodesError
  types/                  TypeScript interfaces

Sibling packages

• Zero @suaveplan/* runtime dependencies — leaf package
• @suaveplan/testing — unit test infrastructure

Patterns

Quick Start

import { SecurityCodeDetector, SecurityCodeSanitizer } from "@suaveplan/security-codes";

const detector = new SecurityCodeDetector();
const matches = detector.detect("aws_key=AKIAIOSFODNN7EXAMPLE");

const sanitizer = new SecurityCodeSanitizer();
const { output } = sanitizer.sanitize("aws_key=AKIAIOSFODNN7EXAMPLE");
// output === 'aws_key=[REDACTED]'

Custom patterns

detector.registerPattern({
  name: "custom-api-key",
  regex: /custom-key-[a-z0-9]{32}/gi,
  confidence: 0.9,
});

Constraints

• 10 built-in pattern detectors covering most common secret types
• Overlap deduplication: higher-confidence matches win
• 4 masking strategies: full-redact, partial, hash, tokenize
• OTel metrics: security_codes.detect.total and security_codes.detect.duration_ms
• Zero @suaveplan/* runtime dependencies

Checklist

• Verify SecurityCodeDetector detects all 10 built-in secret types
• Confirm SECURITY_CODES_CODES registered via defineCodes("SECURITY_CODES", [...])
• Check subpath exports in package.json align with src/ modules
• Run bunx turbo lint typecheck test build --filter=@suaveplan/security-codes
• Confirm sanitizer produces expected masked output for each strategy