# VibeGuard Default Rules
#
# Official rule set distributed with VibeGuard.
# Subscribe via the default config or download manually.
#
# Format:
#   keyword <CATEGORY> <TEXT...>     — exact substring match (case-sensitive)
#   regex   <CATEGORY> <PATTERN...>  — Go RE2 regex; first capture group is replaced if present
#
# Categories are normalized to [A-Z0-9_].

# =============================================================================
# Email
# =============================================================================
regex EMAIL (?i)(?:^|[^a-z0-9._%+-])([a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,})(?:$|[^a-z0-9._%+-])

# =============================================================================
# Phone Numbers
# =============================================================================

# China mobile phone
regex CHINA_PHONE (?:^|\D)(1[3-9]\d{9})(?:$|\D)

# International phone (with country code)
regex PHONE (?:^|[^0-9+])(\+\d{1,3}[\s.-]?\(?\d{1,4}\)?[\s.-]?\d{1,4}[\s.-]?\d{1,9})(?:$|[^0-9])

# Labeled phone (e.g. "phone: 123-456-7890")
regex PHONE (?i)(?:phone|tel|mobile|fax)\s*[:=]\s*(\+?\d[\d\s().-]{7,20}\d)

# =============================================================================
# National IDs
# =============================================================================

# China National ID (18 digits, last may be X)
regex CHINA_ID (?:^|\D)(\d{17}[\dXx])(?:$|\D)

# US Social Security Number
regex SSN (?:^|\D)(\d{3}-\d{2}-\d{4})(?:$|\D)

# =============================================================================
# Financial
# =============================================================================

# Credit card (16 digits, grouped)
regex CREDIT_CARD (?:^|[^0-9])(\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4})(?:$|[^0-9])

# Credit card (Amex: 4-6-5)
regex CREDIT_CARD (?:^|[^0-9])(\d{4}[- ]?\d{6}[- ]?\d{5})(?:$|[^0-9])

# IBAN (international bank account)
regex IBAN (?i)(?:^|[^a-z0-9])([a-z]{2}\d{2}(?:\s?[a-z0-9]){11,30})(?:$|[^a-z0-9])

# =============================================================================
# Network Identifiers
# =============================================================================

# IPv4 address (with 0-255 validation)
regex IPV4 (?:^|[^0-9])((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})(?:$|[^0-9])

# IPv6 address (simplified, common formats)
regex IPV6 (?i)(?:^|[^0-9a-f:])([0-9a-f]{1,4}(?::[0-9a-f]{1,4}){7}|(?:[0-9a-f]{1,4}:){1,7}:|::(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})(?:$|[^0-9a-f:])

# MAC address (colon or dash separated)
regex MAC (?i)(?:^|[^0-9a-f])((?:[0-9a-f]{2}[:-]){5}[0-9a-f]{2})(?:$|[^0-9a-f])

# UUID (v1-v5)
regex UUID (?i)(?:^|[^0-9a-f])([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})(?:$|[^0-9a-f])

# =============================================================================
# Secrets & API Keys
# =============================================================================

# Generic API key in query/header (key=value pattern)
regex API_KEY (?i)(?:api[_-]?key|apikey|access[_-]?key|secret[_-]?key)\s*[=:]\s*['"]?([a-z0-9_\-./+]{16,128})['"]?

# Bearer token
regex BEARER_TOKEN (?i)(?:bearer|token)\s+([a-z0-9_\-./+=]{20,512})

# JWT (three base64url segments)
regex JWT (?:^|[^a-zA-Z0-9_-])(eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,})(?:$|[^a-zA-Z0-9_-])

# AWS Access Key ID
regex AWS_KEY (?:^|[^A-Z0-9])(AKIA[0-9A-Z]{16})(?:$|[^A-Z0-9])

# AWS Secret Access Key (40-char base64)
regex AWS_SECRET (?i)(?:aws[_-]?secret[_-]?access[_-]?key|secret[_-]?key)\s*[=:]\s*['"]?([a-z0-9/+=]{40})['"]?

# GitHub personal access token (classic & fine-grained)
regex GITHUB_TOKEN (?:^|[^a-zA-Z0-9_])(gh[ps]_[a-zA-Z0-9]{36,255}|github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59})(?:$|[^a-zA-Z0-9_])

# Slack token
regex SLACK_TOKEN (?:^|[^a-zA-Z0-9-])(xox[bpras]-[a-zA-Z0-9-]{10,250})(?:$|[^a-zA-Z0-9-])

# Generic high-entropy secret (32+ hex chars labeled as secret/password/token)
regex SECRET (?i)(?:secret|password|passwd|token|credential)\s*[=:]\s*['"]?([a-f0-9]{32,128})['"]?

# =============================================================================
# Private Keys
# =============================================================================

# PEM private key header
regex PRIVATE_KEY (-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY-----)

# =============================================================================
# Cryptocurrency
# =============================================================================

# Bitcoin address (legacy + bech32)
regex CRYPTO (?:^|[^a-zA-Z0-9])([13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[ac-hj-np-z02-9]{25,90})(?:$|[^a-zA-Z0-9])

# Ethereum address
regex CRYPTO (?i)(?:^|[^0-9a-f])(0x[0-9a-f]{40})(?:$|[^0-9a-f])