# Privacy Blocklist — Athena-Public
# Used by: pre-commit hook, privacy_scan.py, bilateral sync
#
# Format: one regex pattern per line. Lines starting with # are comments.
# Case-insensitive matching is applied automatically.
#
# ─────────────────────────────────────────────────────────────────────────────
# THIS FILE IS PUBLIC. Anything written here is published by the gate meant to
# protect it — and a blocklist is worse than a leak, because it is an *index*
# of what is being hidden. It tells a reader which names and which topics to go
# looking for elsewhere.
#
# So this file holds STRUCTURAL patterns only: format matchers that describe a
# shape and name nobody — email, phone, credential formats, local paths.
#
# Anything containing a literal word — a person, a client, a private folder, a
# topic — belongs in PRIVACY_EXTRA_PATTERNS instead: `.env` locally, repo
# secrets in CI. The source of truth for that list lives in the private
# workspace at `.agent/config/privacy_patterns.txt` and is pushed to the repo
# secret by `scripts/sync_privacy_secret.py`.
#
# This is enforced, not requested: privacy_scan.py audits this file on every
# run and exits 1 if a literal word appears here. See audit_committed_blocklist().
# ─────────────────────────────────────────────────────────────────────────────

# === PERSONAL CONTACT (format matchers — name no one) ===
[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}
\b(\+?65[\s-]?)?[89]\d{3}[\s-]?\d{4}\b

# === LOCAL FILE PATHS ===
file:///Users/winstonkoh
/Users/winstonkoh/Desktop
/Users/winstonkoh/Project Athena

# === SECRETS / CREDENTIALS ===
# Value-format patterns — match actual secret material, not documentation
# that merely names a variable. Added 2026-06-10 after a bypass test
# (TD-027 item 4) proved a SUPABASE_SERVICE_ROLE_KEY assignment passed
# the PII-only blocklist. Use pds:allow for documented fake examples.
eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{4,}
sk-[A-Za-z0-9_\-]{20,}
AKIA[0-9A-Z]{16}
AIza[0-9A-Za-z_\-]{30,}
ghp_[A-Za-z0-9]{36}
-----BEGIN [A-Z ]*PRIVATE KEY-----
(SERVICE_ROLE|API_KEY|SECRET_KEY|ACCESS_TOKEN|SERVICE_KEY)[A-Z_]*\s*[=:]\s*['"]?[A-Za-z0-9_\-\.]{16,}
