# English credential labels that the detect-secrets denylist lacks. Always on.
# Fields, tab-separated: a lowercase literal every match contains, the regex, examples.
# pass: only at the start of a word, so compass: and bypass: stay prose (a generated matrix of
# 2,500 inputs missed 17 % on pass and token, 2026-09-27).
# Not the English words passes, passed, passing, passive, passage, passenger: the keyword rules allow word
# characters after the label, and `the passes:` in prose was a hit (a fork, danszymkowiak/maisecrets 9dae6fa).
pass	(?<![a-z])pass(?!(?:es|ed|ing|ive|ages?|engers?)(?![a-z]))	pass, db_pass, Pass
# token: MY_TOKEN keeps its underscore boundary. The exclusions follow the allowlist of generic-api-key
# for generic-api-key (csrf_token, public_token, token_file, token_url): those name no secret.
token	(?<![a-z])(?<!csrf_)(?<!csrf-)(?<!xsrf_)(?<!public_)(?<!page_)(?<!next_)token(?![_.-]?(?:file|url|uri|endpoint|type|count|limit|length|size|id|name)(?![a-z]))	token, MY_TOKEN, access_token, Token
