# OpenSpec Change: enterprise-security-codes

- **Change ID**: enterprise-security-codes
- **Package**: `@suaveplan/security-codes`
- **Category**: universal
- **Target path**: `universal/auth/security-codes`
- **Status**: PROPOSED
- **Date**: 2026-04-19
- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/security-codes.md`

## Summary
Greenfield rebuild of `@suaveplan/security-codes` — detects and sanitises sensitive security-code leakage in strings (API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, etc.) with a pluggable detector and a redactor producing structured, reversible or one-way masks.

## Current-state audit (genesis)
Package does not exist yet — fresh build.

## Dependencies
- Workspace: none (leaf)
- External (via catalog): `zod` → `catalog:forms`; `tslib` → `catalog:build`; `@opentelemetry/api` → `catalog:observability`
- Dev (via catalog): `vitest`, `@vitest/coverage-istanbul`, `fast-check`, `mitata` → `catalog:testing`

## Preserved public surface
- `SecurityCodeDetector` — `detect(input, options?): SecurityCodeMatch[]`
- `SecurityCodeSanitizer` — `sanitize(input, options?): { output, matches }`
- Type exports: `SecurityCodeMatch`, `SecurityCodeType`, `DetectorOptions`, `SanitizerOptions`, `MaskingStrategy`
- Built-in detectors: AWS access key, JWT, credit card (Luhn-validated), GitHub classic/fine-grained PAT, Stripe secret/publishable, Google API key, OpenAI `sk-…`, PEM block, SSH key, generic high-entropy string heuristic

## New genesis additions
- Codes: `SECURITY_CODES.DETECTION_FAILED`, `SECURITY_CODES.INVALID_PATTERN`, `SECURITY_CODES.SANITIZATION_FAILED`.
- Zod schemas for `DetectorOptions`, `SanitizerOptions`, `SecurityCodeMatch`.
- OTel counter `security_codes.detect.total{type}`, histogram `security_codes.detect.duration_ms`.
- Property tests: sanitise twice is idempotent; detect→sanitise→detect yields zero remaining matches for masked outputs.

## Impact
- Adds one new package: `universal/auth/security-codes`
- Adds one new spec capability: `security-codes`