maisecrets
Copyright 2026 Andreas Kruse (Sprinterli)

This product includes the betterleaks ruleset (maisecrets/detection/rules/betterleaks.toml),
Copyright (c) 2026 Zachary Rice, MIT License (see maisecrets/detection/rules/LICENSE-betterleaks),
consumed as data. The vendored version is recorded in maisecrets/detection/rules/BETTERLEAKS_VERSION.
Its filter expressions are read by maisecrets/detection/rule_filter.py.

maisecrets' own secret rules (maisecrets/detection/rules/own_secret_rules.json) are derived from patterns
of the gitleaks ruleset v8.30.1, Copyright (c) 2019 Zachary Rice, MIT License (see
maisecrets/detection/rules/LICENSE-gitleaks). gitleaks itself is no longer vendored.

This product includes PII detection patterns derived from Microsoft Presidio
(maisecrets/detection/rules/presidio.json: regexes, scores and context words of its
pattern recognizers), Copyright (c) Microsoft Corporation, MIT License (see
maisecrets/detection/rules/LICENSE-presidio). The checksum validators for the generic
and German entities in maisecrets/detection/core.py are ports of Presidio's, verified
by scripts/check_validators_against_presidio.py.

This product includes regular expressions derived from Yelp detect-secrets
(maisecrets/detection/rules/detect_secrets.json: the KeywordDetector and
BasicAuthDetector patterns), Copyright Yelp, Inc., Apache License 2.0 (see
maisecrets/detection/rules/LICENSE-detect-secrets). Its heuristic filters for keyword
hits are ported in maisecrets/detection/core.py.

This product includes a word list created from SCOWL (maisecrets/detection/rules/words_en.txt: the base
words of 4 to 8 letters of the en_US Hunspell dictionary, SCOWL size 60, release rel-2026.02.25,
https://github.com/en-wl/wordlist/releases/tag/rel-2026.02.25), Copyright 2000-2026 by Kevin
Atkinson, under the SCOWL license (a permissive license; see maisecrets/detection/rules/LICENSE-scowl).
scripts/sync_words.py rebuilds it from the pinned release asset and records the version in
maisecrets/detection/rules/SCOWL_VERSION. The password rule uses it to tell a word from a password.

This product includes the English word list of BIP39 (maisecrets/detection/rules/bip39_english.txt), taken
unchanged from trezor/python-mnemonic, Copyright (c) 2013-2016 Pavol Rusnak, MIT License (see
maisecrets/detection/rules/LICENSE-bip39). The seed phrase rule uses it.

The formats of the token rules added in 0.6.20 (maisecrets/detection/rules/prefixes.txt and OWN_RULES in
maisecrets/detection/core.py) follow GitLab's secret detection rules (MIT License), Kingfisher and Nosey
Parker (Apache License 2.0), or the vendor's documentation; the regular expressions are written here.

The token rules added in 0.7.9 to 0.7.11 (the blocks "0.7.9" and "0.7.9, researched" of
maisecrets/detection/rules/prefixes.txt, the signature and provider rules of own_secret_rules.json) are adapted from
the patterns of Kingfisher and Nosey Parker (Apache License 2.0; the provider-word rules name their Kingfisher rule),
gitleaks and betterleaks (MIT License, see LICENSE-gitleaks and LICENSE-betterleaks), GitLab's secret detection rules
(MIT License), Microsoft's security-utilities (MIT License; the identifiable Azure keys and the Common Annotated
Security Key), Trivy, Google OSV-SCALIBR (Veles) and titus (Apache License 2.0) and nuclei-templates (MIT License),
or are written from each provider's own documentation or its published code (the blocks "0.7.10, provider
code" and "0.7.11, provider code, round 2": SDKs, servers and token libraries, read for the
token format only). The regular expressions are rewritten here in the form of the files above.

The remaining rules in maisecrets/detection/core.py (OWN_RULES, REGIONAL_RULES), maisecrets/detection/checksums.py
and the display rules in maisecrets/pii_display.py are written for this project.

Parts of the detection are adapted from a public fork of maisecrets on GitHub (Apache License
2.0; the commits that took them name it): the card words of other
languages, the IBAN forms with hyphens and in lower case, the context rule for a bare German VAT ID,
the normaliser of maisecrets/detection/normalise.py (changed: five of its stages, one module, scanned
only around the changed lines and in the tool channel only), the design of the country rules
(REGIONAL_RULES in maisecrets/detection/core.py) and the checksums of the AHV number, the Swiss UID and the
codice fiscale in maisecrets/detection/checksums.py. The formats of the Telegram bot token, the Discord bot
token and the Mailchimp API key follow Yelp detect-secrets (Apache License 2.0, see
maisecrets/detection/rules/LICENSE-detect-secrets); the regular expressions are written here.

scripts/measure_datasets.py measures detection on public labelled datasets; it ships in no release. Its label
cleaning (checksums, placeholders, reserved domains, the rule that no cut drops a group of a value, the label
tables) and its Mendeley sheet reader and text repair are adapted from the bench of the same public fork of
maisecrets (Apache License 2.0); docs/BENCHMARKS.md names it. The datasets are not part of this repository.
