Regex + proximity checks + mathematical validators (Luhn, MOD-97, Verhoeff). Not ML — fast, auditable, and predictable. Extensible via TOML pattern overlays.
How detection works: Each detector is a named pattern with a regex, optional proximity keywords (to reduce false positives), and an optional validator function (e.g., Luhn check for credit cards). You can override any built-in pattern or add new ones via a TOML overlay file — no recompilation needed.
# custom-patterns.toml
[[detector]]
name = "internal_employee_id"
pattern = "EMP-[0-9]{6}"
severity = "medium"
keywords = ["employee", "staff", "hr"]
Remaining 45 detectors cover: database connection strings (PostgreSQL, MySQL, MongoDB, Redis), JWT tokens, generic high-entropy strings, IPv4/IPv6 addresses, MAC addresses, and miscellaneous infrastructure credentials. Full list in the docs.