Enable all secret detectors by default (#106)

diff --git a/config.example.yaml b/config.example.yaml
index 426f122234f24b57f348aa1b9a91d957fbfa9b9a..7f2933ce46e2aa3566eb6210592e1d7c6e2d09a4 100644 (file)
--- a/config.example.yaml
+++ b/config.example.yaml
@@ -119,36 +119,18 @@ secrets_detection:
   #   route_local:  Route to local provider (only works in route mode)
   action: mask
 
-  # Secret types to detect
-  # Private Keys (enabled by default):
-  #   - OPENSSH_PRIVATE_KEY: OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----)
-  #   - PEM_PRIVATE_KEY:     PEM formats (RSA, PRIVATE KEY, ENCRYPTED PRIVATE KEY)
-  #
-  # API Keys (opt-in):
-  #   - API_KEY_SK:          Secret keys with sk- or sk_ prefix (OpenAI, Anthropic, Stripe, RevenueCat)
-  #   - API_KEY_AWS:         AWS Access Keys (AKIA...)
-  #   - API_KEY_GITHUB:      GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
-  #
-  # Tokens (opt-in):
-  #   - JWT_TOKEN:           JSON Web Tokens (eyJ...)
-  #   - BEARER_TOKEN:        Bearer tokens in Authorization-style contexts
-  #
-  # Environment Variables (opt-in):
-  #   - ENV_PASSWORD:        DB_PASSWORD=..., ADMIN_PWD=... (8+ char values)
-  #   - ENV_SECRET:          APP_SECRET=..., JWT_SECRET=... (8+ char values)
-  #   - CONNECTION_STRING:   postgres://user:pass@host, mongodb://...
+  # All supported secret types are enabled by default. Remove entries to narrow detection.
   entities:
     - OPENSSH_PRIVATE_KEY
     - PEM_PRIVATE_KEY
-    # Uncomment to detect API keys and tokens:
-    # - API_KEY_SK
-    # - API_KEY_AWS
-    # - API_KEY_GITHUB
-    # - JWT_TOKEN
-    # - BEARER_TOKEN
-    # - ENV_PASSWORD
-    # - ENV_SECRET
-    # - CONNECTION_STRING
+    - API_KEY_SK
+    - API_KEY_AWS
+    - API_KEY_GITHUB
+    - JWT_TOKEN
+    - BEARER_TOKEN
+    - ENV_PASSWORD
+    - ENV_SECRET
+    - CONNECTION_STRING
 
   # Maximum characters to scan per request (performance limit)
   # Note: Secrets placed after this limit won't be detected.

diff --git a/docs/api-reference/status.mdx b/docs/api-reference/status.mdx
index 2bde66e97817ae640e1bf06010abcd21a8615722..15aeabe96bf02d9fa5b5cb979bb7b2ad828a6f94 100644 (file)
--- a/docs/api-reference/status.mdx
+++ b/docs/api-reference/status.mdx
@@ -89,7 +89,18 @@ curl http://localhost:3000/info
   "secrets_detection": {
     "enabled": true,
     "action": "mask",
-    "entities": ["OPENSSH_PRIVATE_KEY", "PEM_PRIVATE_KEY"],
+    "entities": [
+      "OPENSSH_PRIVATE_KEY",
+      "PEM_PRIVATE_KEY",
+      "API_KEY_SK",
+      "API_KEY_AWS",
+      "API_KEY_GITHUB",
+      "JWT_TOKEN",
+      "BEARER_TOKEN",
+      "ENV_PASSWORD",
+      "ENV_SECRET",
+      "CONNECTION_STRING"
+    ],
     "max_scan_chars": 200000,
     "log_detected_types": true
   },

diff --git a/docs/concepts/secrets-detection.mdx b/docs/concepts/secrets-detection.mdx
index 749ddfc894f5256be2d456ffaf7a71df0beca0f9..6060036edab418151216e0b5e929df4262eb8fd6 100644 (file)
--- a/docs/concepts/secrets-detection.mdx
+++ b/docs/concepts/secrets-detection.mdx
@@ -7,14 +7,16 @@ PasteGuard detects secrets before PII detection and can block, mask, or route re
 
 ## Supported Secret Types
 
-### Private Keys (enabled by default)
+All supported secret types are enabled by default.
+
+### Private Keys
 
 | Type | Pattern |
 |------|---------|
 | `OPENSSH_PRIVATE_KEY` | `-----BEGIN OPENSSH PRIVATE KEY-----` |
 | `PEM_PRIVATE_KEY` | `-----BEGIN RSA PRIVATE KEY-----`, etc. |
 
-### API Keys (opt-in)
+### API Keys
 
 | Type | Pattern |
 |------|---------|
@@ -22,14 +24,14 @@ PasteGuard detects secrets before PII detection and can block, mask, or route re
 | `API_KEY_AWS` | `AKIA...` (20 chars) |
 | `API_KEY_GITHUB` | `ghp_...`, `gho_...`, `ghu_...`, `ghs_...`, `ghr_...` (40+ chars) |
 
-### Tokens (opt-in)
+### Tokens
 
 | Type | Pattern |
 |------|---------|
 | `JWT_TOKEN` | `eyJ...` (three base64 segments) |
 | `BEARER_TOKEN` | `Bearer ...` (40+ char tokens) |
 
-### Environment Variables (opt-in)
+### Environment Variables
 
 | Type | Pattern |
 |------|---------|

diff --git a/docs/configuration/secrets-detection.mdx b/docs/configuration/secrets-detection.mdx
index acdf45d02f0d59a8382016b96abdc902f9adbc15..98ed6ca524230f22e50c58d2aed8a0db7c6677a1 100644 (file)
--- a/docs/configuration/secrets-detection.mdx
+++ b/docs/configuration/secrets-detection.mdx
@@ -10,6 +10,14 @@ secrets_detection:
   entities:
     - OPENSSH_PRIVATE_KEY
     - PEM_PRIVATE_KEY
+    - API_KEY_SK
+    - API_KEY_AWS
+    - API_KEY_GITHUB
+    - JWT_TOKEN
+    - BEARER_TOKEN
+    - ENV_PASSWORD
+    - ENV_SECRET
+    - CONNECTION_STRING
   max_scan_chars: 200000
   log_detected_types: true
 ```
@@ -20,7 +28,7 @@ secrets_detection:
 |--------|---------|-------------|
 | `enabled` | `true` | Enable secrets detection |
 | `action` | `mask` | Action when secrets found |
-| `entities` | Private keys | Secret types to detect |
+| `entities` | All supported types | Secret types to detect |
 | `max_scan_chars` | `200000` | Max characters to scan (0 = unlimited) |
 | `log_detected_types` | `true` | Log detected types (never logs content) |
 
@@ -56,7 +64,10 @@ secrets_detection:
 
 ## Secret Types
 
-### Private Keys (enabled by default)
+All supported secret types are enabled by default. Set `entities` to a smaller
+list if you want to scan only specific categories.
+
+### Private Keys
 
 ```yaml
 secrets_detection:
@@ -65,7 +76,7 @@ secrets_detection:
     - PEM_PRIVATE_KEY      # RSA, PRIVATE KEY, ENCRYPTED PRIVATE KEY
 ```
 
-### API Keys (opt-in)
+### API Keys
 
 ```yaml
 secrets_detection:
@@ -75,7 +86,7 @@ secrets_detection:
     - API_KEY_GITHUB   # ghp_, gho_, ghu_, ghs_, ghr_ (40+ chars)
 ```
 
-### Tokens (opt-in)
+### Tokens
 
 ```yaml
 secrets_detection:
@@ -84,7 +95,7 @@ secrets_detection:
     - BEARER_TOKEN   # Bearer ... (40+ char tokens)
 ```
 
-### Environment Variables (opt-in)
+### Environment Variables
 
 ```yaml
 secrets_detection:

diff --git a/src/config.test.ts b/src/config.test.ts
index cd83f5460f5ed6a086daff62e94bfd00d88114d8..0d5c102cc2000f1366df4eb087497e9e2502e529 100644 (file)
--- a/src/config.test.ts
+++ b/src/config.test.ts
@@ -56,6 +56,36 @@ pii_detection:
     }
   });
 
+  test("enables all supported secret entity types by default", () => {
+    const path = writeConfig(`
+mode: mask
+providers:
+  openai: {}
+  anthropic: {}
+pii_detection:
+  detector_url: http://localhost:5002
+`);
+
+    try {
+      const config = loadConfig(path);
+
+      expect(config.secrets_detection.entities).toEqual([
+        "OPENSSH_PRIVATE_KEY",
+        "PEM_PRIVATE_KEY",
+        "API_KEY_SK",
+        "API_KEY_AWS",
+        "API_KEY_GITHUB",
+        "JWT_TOKEN",
+        "BEARER_TOKEN",
+        "ENV_PASSWORD",
+        "ENV_SECRET",
+        "CONNECTION_STRING",
+      ]);
+    } finally {
+      cleanupConfig(path);
+    }
+  });
+
   test("accepts masking allowlist and denylist patterns", () => {
     const path = writeConfig(`
 mode: mask

diff --git a/src/config.ts b/src/config.ts
index a2e6673301a9a6a735b0a97b206c765c0e49bd81..2c9a9a66b456739ce382593a8666a938fea353fd 100644 (file)
--- a/src/config.ts
+++ b/src/config.ts
@@ -172,7 +172,7 @@ const SecretEntityTypes = [
 const SecretsDetectionSchema = z.object({
   enabled: z.boolean().default(true),
   action: z.enum(["block", "mask", "route_local"]).default("mask"),
-  entities: z.array(z.enum(SecretEntityTypes)).default(["OPENSSH_PRIVATE_KEY", "PEM_PRIVATE_KEY"]),
+  entities: z.array(z.enum(SecretEntityTypes)).default([...SecretEntityTypes]),
   max_scan_chars: z.coerce.number().int().min(0).default(200000),
   log_detected_types: z.boolean().default(true),
   scan_roles: z.array(z.string()).optional(),