suaveplan/openspec/archive/2026-04-19-enterprise-security-codes/proposal.md

OpenSpec Change: enterprise-security-codes

• Change ID: enterprise-security-codes
• Package: @suaveplan/security-codes
• Category: universal
• Target path: universal/auth/security-codes
• Status: PROPOSED
• Date: 2026-04-19
• Reference spec: /mnt/s/web/suaveplan/enterprise/security-codes.md

Summary

Greenfield rebuild of @suaveplan/security-codes — detects and sanitises sensitive security-code leakage in strings (API keys, JWTs, credit cards, GitHub tokens, Stripe keys, SSH keys, PEM blocks, AWS access keys, etc.) with a pluggable detector and a redactor producing structured, reversible or one-way masks.

Current-state audit (genesis)

Package does not exist yet — fresh build.

Dependencies

• Workspace: none (leaf)
• External (via catalog): zod → catalog:forms; tslib → catalog:build; @opentelemetry/api → catalog:observability
• Dev (via catalog): vitest, @vitest/coverage-istanbul, fast-check, mitata → catalog:testing

Preserved public surface

• SecurityCodeDetector — detect(input, options?): SecurityCodeMatch[]
• SecurityCodeSanitizer — sanitize(input, options?): { output, matches }
• Type exports: SecurityCodeMatch, SecurityCodeType, DetectorOptions, SanitizerOptions, MaskingStrategy
• Built-in detectors: AWS access key, JWT, credit card (Luhn-validated), GitHub classic/fine-grained PAT, Stripe secret/publishable, Google API key, OpenAI sk-…, PEM block, SSH key, generic high-entropy string heuristic

New genesis additions

• Codes: SECURITY_CODES.DETECTION_FAILED, SECURITY_CODES.INVALID_PATTERN, SECURITY_CODES.SANITIZATION_FAILED.
• Zod schemas for DetectorOptions, SanitizerOptions, SecurityCodeMatch.
• OTel counter security_codes.detect.total{type}, histogram security_codes.detect.duration_ms.
• Property tests: sanitise twice is idempotent; detect→sanitise→detect yields zero remaining matches for masked outputs.

Impact

• Adds one new package: universal/auth/security-codes
• Adds one new spec capability: security-codes