# Secrets and PII

A draft that contains any of the patterns below is **BLOCKED** by the
`page-reviewer` skill. Scrub before posting; the reviewer's verdict is not
overridden by "this is a test fixture" or "this is obvious from context".

## Hard blocks

| Pattern | Example | Action |
|---------|---------|--------|
| AWS access key id | `AKIA[0-9A-Z]{16}` | Replace with `<AWS_KEY>` |
| AWS secret access key | `[A-Za-z0-9/+=]{40}` in env files | Replace with `<AWS_SECRET>` |
| Bearer / personal token | `ghp_…`, `glpat-…`, `dapi…` | Replace with `<TOKEN>` |
| Confluence / Jira token | `ATATT…` (Cloud), long base64 | Replace with `<CONFLUENCE_TOKEN>` |
| Slack token | `xoxb-…`, `xoxp-…` | Replace with `<SLACK_TOKEN>` |
| OpenAI key | `sk-…` (40+ chars after) | Replace with `<OPENAI_KEY>` |
| Service-account password | any string in `*.password=…`, `secret: …` | Replace |
| PEM private key | `-----BEGIN … PRIVATE KEY-----` | Replace |
| Cookie value | `connect.sid=…`, `JSESSIONID=…` | Replace |

## Soft blocks (review)

| Pattern | Why | Action |
|---------|-----|--------|
| Customer email | PII | Mask: `j***@example.com` or remove |
| Customer hostname / IP | PII + internal info | Replace with `<HOST>` / `<IP>` |
| Runbook hostname (`*.k8s.sdntest.netcracker.com`) | Internal surface | Use the public URL or `<INTERNAL_HOST>` |
| Phone number | PII | Mask or remove |
| Bank / payment info | PII | Remove |

## Why this is in the skill

BASS Confluence is private to Netcracker, but watchers, exported PDFs, and
incident write-ups leak. Pages are also exported to training data when teams
mirror content into LLMs. "It's on a private space" is not enough.

## If you need a realistic-looking fixture

Generate one with the project's placeholder vocabulary:

- emails: `user1@example.com`, `user2@example.com`
- IPs: `10.0.0.1`, `192.0.2.1`
- tokens: `<TOKEN>`, `<SECRET>`
- hostnames: `host-a.internal`, `host-b.internal`

Do not use the customer's name, the production hostname, or a real-looking
token "because it doesn't matter".

## What the reviewer checks

The `page-reviewer` skill runs a grep pass against this list. A single hit
returns **BLOCK**; the author fixes the draft and re-runs.