Enhance regex patterns and keyword exclusions for improved secret detection accuracy

Author: rafabd1

core/patterns/patterns.go

@@ -243,11 +243,12 @@ var DefaultPatterns = &PatternDefinitions{
 			MinLength:   8,
 		},
 		"private_key_var": {
-			Regex:       `['"]?(?:private_?key|secret_?key)['"]?\s*[:=]\s*['"]([^'"]{20,})['"]`,
+			Regex:       `(?i)['"]?(?:private_?key|secret_?key)['"]?\s*[:=]\s*['"]([a-zA-Z0-9+/=_-]{20,})['"]`,
 			Description: "Private Key Variable",
 			Enabled:     true,
 			Category:    "crypto",
 			MinLength:   20,
+			KeywordExcludes: []string{"click_", "export_", "track_", "event_", "action_", "_event", "_click", "_track", "switch_", "show_", "hide_"},
 		},
 
 		// GitHub tokens - High risk for code repository access
@@ -387,20 +388,20 @@ var DefaultPatterns = &PatternDefinitions{
 
 		// Payment services
 		"paypal_client_id": {
-			Regex:       `(?i)(?:paypal|braintree).{0,20}(?:[:=]\s*)['"]([A-Za-z0-9_-]{20,64})['"]`,
+			Regex:       `(?i)(?:paypal|braintree)[_-]?(?:client[_-]?)?(?:id|key|secret)\s*[:=]\s*['"]([A-Za-z0-9_-]{20,64})['"]`,
 			Description: "PayPal/Braintree Client ID",
 			Enabled:     true,
 			Category:    "payment",
 			MinLength:   20,
-			KeywordExcludes: []string{"example", "placeholder", "user", "password", "sample", "kill_"},
+			KeywordExcludes: []string{"example", "placeholder", "user", "password", "sample", "kill_", "button", "class", "style", "css"},
 		},
 		"paypal_client_secret": {
-			Regex:       `(?i)(?:paypal|braintree).{0,20}(?:[:=]\s*)['"]([A-Za-z0-9_-]{20,64})['"]`,
+			Regex:       `(?i)(?:paypal|braintree)[_-]?(?:client[_-]?)?secret\s*[:=]\s*['"]([A-Za-z0-9_-]{20,64})['"]`,
 			Description: "PayPal/Braintree Client Secret",
 			Enabled:     true,
 			Category:    "payment",
 			MinLength:   20,
-			KeywordExcludes: []string{"example", "placeholder", "user", "password", "sample", "kill_"},
+			KeywordExcludes: []string{"example", "placeholder", "user", "password", "sample", "kill_", "button", "class", "style", "css"},
 		},
 		"braintree_token": {
 			Regex:       `access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}`,
@@ -517,41 +518,42 @@ var DefaultPatterns = &PatternDefinitions{
 			KeywordExcludes: []string{"example", "test", "demo", "noreply", "no-reply", "@example.com", "@test.com", "verification-card-", "name@email.com", "name@domain.com", "@author", "license", "(c)", "copyright", "author:", "maintainer:", "created by", "contact:", "<", "first.last@company.com", ".png')", ".jpg')", ".gif')", ".svg')", ".webp')", ".png\"')", ".jpg\"')", ".gif\"')", ".svg\"')", ".webp\"')", "@2x.png", "@3x.png"},
 		},
 		"phone_number": {
-			Regex:       `(?i)(?:(?:\\b(?:phone|mobile|tel(?:ephone)?)\\b(?:[^\\w\\d\\n\\r<]{0,10}(?:[:= ]{1,3}|\\s+(?:to|at|us\\s+at)\\s+))(\\+?\\d{1,3}[-.\s]?)?(\\(\\d{3}\\)|\\d{3})[-.\s]?\\d{3}[-.\s]?\\d{4})|(?:(\\+?\\d{1,3}[-.\s]?)?(?:\\(\\d{3}\\)[-.\s]?\\d{3}[-.\s]?\\d{4}|\\d{3}[-.\s]+\\d{3}[-.\s]+\\d{4}|\\d{3}[-.\s]+\\d{7}|\\d{6}[-.\s]+\\d{4})))\\b`,
-			Description: "Phone Number",
+			Regex:       `(?i)(?:phone|mobile|tel(?:ephone)?|fax|cell)\s*[:=]\s*['"]?(\+?1?[-.\s]?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4})['"]?`,
+			Description: "Phone Number (US format, keyword dependent)",
 			Enabled:     true,
 			Category:    "pii",
 			MinLength:   10,
-			KeywordExcludes: []string{"version", "id", "example", "test", "port", "e.g.", "_filter", "className", "jsx-", "mask", "000-000-0000", "prod", "phones/", "watermark", "123-456-7890", "tel:", "adobe_mc", "TS=", "gtag", "AW-", "DC-", "Lg(e,"},
+			MaxLength:   20,
+			KeywordExcludes: []string{"version", "id", "example", "test", "port", "e.g.", "_filter", "className", "jsx-", "mask", "000-000-0000", "prod", "phones/", "watermark", "123-456-7890", "tel:", "adobe_mc", "TS=", "gtag", "AW-", "DC-", "Lg(e,", "000-0000", "111-1111", "999-9999"},
 		},
 		"ipv4_address": {
-			Regex:       `(?i)(?:[a-zA-Z0-9._-]*?(?:ip|address|host|server)[a-zA-Z0-9._-]*?\s*[:=]\s*['"]?)\s*(\b(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\b)`,
+			Regex:       `(?i)(?:^|[^0-9.])(?:ip[_-]?addr(?:ess)?|host[_-]?(?:name|addr)?|server[_-]?(?:ip|addr))\s*[:=]\s*['"]?((?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9][0-9]|[1-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]))['"]?`,
 			Description: "IPv4 Address (associated with a keyworded key, e.g., server_ip: 1.2.3.4)",
 			Enabled:     true,
 			Category:    "pii",
 			MinLength:   7,
 			MaxLength:   15,
-			KeywordMatches: []string{"ip", "address", "host"},
-			KeywordExcludes: []string{"0.0.0.0", "127.0.0.1", "localhost", "firefox/", "version", "rfc", "section-", "webpack_require__", "module", "/***/", "/*", "javascript/", "// ", "Symbol(", "RegExp.prototype", ",.", "c0 .", "M.exports={", "c-id=", "{\"2.16.840.", "@see Recommendation", "ITU-T H.", "Section "},
+			KeywordMatches: []string{"ip", "address", "host", "server"},
+			KeywordExcludes: []string{"0.0.0.0", "127.0.0.1", "localhost", "1.3.6.1", "2.16.840", "1.2.840", "oid", "urn:", "OID"},
 		},
 		"ipv6_address": {
-			Regex:       `\b(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\b`,
-			Description: "IPv6 Address",
+			Regex:       `(?i)(?:ipv6|ip6)[_-]?(?:addr(?:ess)?)?\s*[:=]\s*['"]?((?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){6}:[0-9a-fA-F]{1,4})['"]?`,
+			Description: "IPv6 Address (Keyword Dependent)",
 			Enabled:     true,
 			Category:    "pii",
-			MinLength:   7,
-			KeywordMatches: []string{"ip", "address", "host"},
-			KeywordExcludes: []string{"::1", "localhost", "//", "/*", "* ", "EPSG::", "urn:ogc:def:crs:", "fab::", "cdk-keyboard-focused"},
+			MinLength:   15,
+			KeywordMatches: []string{"ipv6", "ip6"},
+			KeywordExcludes: []string{"::1", "0000:0000", "fingerprint", "sha-256", "sha256", "hash"},
 		},
 		"mac_address": {
-			Regex:       `\b(?:[0-9A-Fa-f]{2}[:-]){5}(?:[0-9A-Fa-f]{2})\b`,
-			Description: "MAC Address",
+			Regex:       `(?i)(?:mac[_-]?address|ethernet[_-]?addr|hw[_-]?addr)\s*[:=]\s*['"]?([0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2})['"]?`,
+			Description: "MAC Address (Keyword Dependent, colon format only)",
 			Enabled:     true,
 			Category:    "pii",
 			MinLength:   17,
 			MaxLength:   17,
-			KeywordMatches: []string{"mac", "address", "ethernet"},
-			KeywordExcludes: []string{"path", "svg", "translate", "d=\"", "d='", "stroke", "fill", "points"},
+			KeywordMatches: []string{"mac", "ethernet", "hardware"},
+			KeywordExcludes: []string{"00:00:00:00:00:00", "ff:ff:ff:ff:ff:ff", "FF:FF:FF:FF:FF:FF", "fingerprint", "sha"},
 		},
 		"us_zip_code": {
 			Regex:       `(?i)(?:zip|postal|post_?code|address)\\s*[:=]\\s*(\\d{5}(?:-\\d{4})?)\\b`,