@suaveplan/security-codes - Detect and sanitise sensitive security-code leakage in strings: API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, and more

Summary

Detect and sanitise sensitive security-code leakage in strings. Handles API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, OpenAI keys, Google API keys, and high-entropy heuristics.

Documentation tree

code-detector — (no submodules)
- code-detector — (no submodules)
code-sanitizer — (no submodules)
- code-sanitizer — (no submodules)
errors — (no submodules)
- security-codes-error — (no submodules)
aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
types — (no submodules)
- security-codes — (no submodules)
utils — (no submodules)
- luhn — (no submodules)

- [code-detector](./src/core/code-detector/code-detector.md) — _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — _(no submodules)_- [code-sanitizer](./src/core/code-sanitizer/code-sanitizer.md) — _(no submodules)_- [errors](./src/errors/security-codes-error.md) — _(no submodules)_- [security-codes-error](./src/errors/security-codes-error.md) — _(no submodules)_- [aws](./src/patterns/aws.md) — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…

credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules)- code-sanitizer — (no submodules)- errors — (no submodules)- security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules)- code-sanitizer — (no submodules)- errors — (no submodules)- security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
types — (no submodules)- security-codes — (no submodules)- utils — (no submodules)- luhn — (no submodules)- code-detector — (no submodules)- code-sanitizer — (no submodules) - code-sanitizer — (no submodules)- errors — (no submodules) - security-codes-error — (no submodules)- aws — Detects AWS Access Key IDs within arbitrary string input. AWS Access Key IDs are 20-character alphanumeric identifiers…
credit-card — Detects credit card numbers embedded in arbitrary strings using a combination of regex matching and the Luhn checksum a…
entropy — Detects high-entropy strings that are likely secret tokens, API keys, or passwords using Shannon entropy analysis. This…
github — Detects GitHub Personal Access Tokens (PATs) — both classic tokens (ghp_…) and the newer fine-grained tokens (`github…
google — Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are…
jwt — Detects JSON Web Tokens (JWTs) embedded in arbitrary strings. JWTs are bearer tokens with a well-defined three-part bas…
openai — Detects OpenAI API keys in arbitrary strings. OpenAI API keys follow the format sk-<48 chars> for standard keys and `…
pem — Detects PEM-encoded blocks in arbitrary strings. PEM (Privacy Enhanced Mail) is the standard encoding for TLS certifica…
ssh — Detects SSH private keys and public keys embedded in arbitrary strings. SSH private keys grant direct shell access to a…
stripe — Detects Stripe API keys — both secret keys (sk_live_ / sk_test_) and publishable keys (pk_live_ / pk_test_) — e…
types — (no submodules) - security-codes — (no submodules)- utils — (no submodules) - luhn — (no submodules)

Features

10 built-in pattern detectors covering the most common secret types
Pluggable detector API — register custom patterns at runtime
4 masking strategies — full-redact, partial, hash, tokenize
Overlap deduplication — higher-confidence matches win
OTel metrics — security_codes.detect.total and security_codes.detect.duration_ms
Zero @suaveplan/ runtime dependencies* — leaf package, no circular risk

Install

bun add @suaveplan/security-codes

Quick Start

import { SecurityCodeDetector, SecurityCodeSanitizer } from '@suaveplan/security-codes';

const detector = new SecurityCodeDetector();
const matches = detector.detect('aws_key=AKIAIOSFODNN7EXAMPLE');

const sanitizer = new SecurityCodeSanitizer();
const { output } = sanitizer.sanitize('aws_key=AKIAIOSFODNN7EXAMPLE');
// output === 'aws_key=[REDACTED]'

15 KiB Raw Permalink Blame History