GeoLibre/scripts/credential-patterns.json

{
  "_comment": [
    "Single source of truth for the pre-publish credential scan. Read by",
    "scripts/scan-credentials.mjs (the JS build path) and python/hatch_build.py",
    "(the wheel/sdist path, which may run without Node). Every regex here must",
    "parse under BOTH JavaScript RegExp and Python re -- stick to the common",
    "subset: \\b, character classes, (?:...), and bounded quantifiers.",
    "",
    "Patterns are provider token SHAPES, not GeoLibre's specific values, so a",
    "rotated key trips the guard too. Keep them anchored enough not to fire on",
    "content-hashed asset names or ordinary base64 blobs in the bundle.",
    "",
    "Note the Google pattern ends with a lookahead, not `\\b`. Its charset includes",
    "`-`, and `\\b` requires a word character on the left, so a key ending in `-`",
    "would not match before a quote or end of input -- the scanner would miss it."
  ],
  "patterns": [
    {
      "name": "Google API key",
      "regex": "\\bAIza[0-9A-Za-z_-]{35}(?=$|[^A-Za-z0-9_-])"
    },
    {
      "name": "Mapbox public token",
      "regex": "\\bpk\\.eyJ1Ijoi[A-Za-z0-9._-]{20,}"
    },
    {
      "name": "Mapbox secret token",
      "regex": "\\bsk\\.eyJ1Ijoi[A-Za-z0-9._-]{20,}"
    },
    {
      "name": "JWT (e.g. Cesium Ion)",
      "regex": "\\beyJhbGciOi[A-Za-z0-9._-]{30,}"
    },
    {
      "name": "Clerk/Stripe secret key",
      "regex": "\\bsk_(?:live|test)_[A-Za-z0-9]{16,}"
    },
    {
      "name": "AWS access key id",
      "regex": "\\b(?:AKIA|ASIA)[0-9A-Z]{16}\\b"
    },
    {
      "name": "GitHub token",
      "regex": "\\bgh[pousr]_[A-Za-z0-9]{36,}\\b"
    },
    {
      "name": "Slack token",
      "regex": "\\bxox[abprs]-[A-Za-z0-9-]{10,}"
    },
    {
      "name": "OpenAI key",
      "regex": "\\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}"
    },
    {
      "name": "Anthropic key",
      "regex": "\\bsk-ant-[A-Za-z0-9_-]{32,}"
    }
  ],
  "_credentialEnvNames_comment": [
    "Names that must never appear with a non-empty value attached, whatever the",
    "value looks like -- this catches a provider whose token shape none of the",
    "patterns above match.",
    "",
    "This list is the single source of truth: apps/geolibre-desktop/vite.config.ts",
    "reads it directly for CREDENTIAL_ENV_KEYS, so adding a name here strips it from",
    "redistributable builds and scans for it in one step.",
    "",
    "Public-by-design identifiers (Clerk publishable key, Auth0 client ID and",
    "domain, the GEE OAuth client ID, the GA measurement ID) are deliberately",
    "absent: they are meant to ship in a redistributable build."
  ],
  "credentialEnvNames": [
    "VITE_AMAZON_LOCATION_API_KEY",
    "VITE_ARCGIS_API_KEY",
    "VITE_CESIUM_TOKEN",
    "VITE_GEOCODER_API_KEY",
    "VITE_GOOGLE_MAPS_API_KEY",
    "VITE_HERE_API_KEY",
    "VITE_MAPBOX_ACCESS_TOKEN",
    "VITE_MAPILLARY_ACCESS_TOKEN",
    "VITE_PROTOMAPS_API_KEY",
    "VITE_STADIA_API_KEY",
    "VITE_TIANDITU_API_KEY",
    "VITE_TOMTOM_API_KEY"
  ],
  "_allowedValueHashes_comment": [
    "SHA-256 of values that match a pattern above but are public by design --",
    "a token the upstream library itself ships. Matched on the exact value, so a",
    "real credential in the same file is still caught.",
    "",
    "A vendor bump changes the value and therefore the hash, so the guard will",
    "fire after upgrading. That is intended: decode the payload and confirm it is",
    "still the vendor's own token (CesiumJS's has sub=CesiumJS,",
    "iss=https://api.cesium.com) before replacing the hash here.",
    "See docs/maintenance.md."
  ],
  "allowedValueHashes": {
    "bfda2eec54787709a9cb707e5b8020294cea1701fa6b8587b5e6c35826395d8d": "CesiumJS built-in default Ion access token (sub=CesiumJS, aud='1.146 Release')"
  },
  "scannableExtensions": [".js", ".mjs", ".cjs", ".css", ".html", ".json", ".map", ".txt"]
}