Marcos Silva
53 lines
2.2 KiB
Markdown
53 lines
2.2 KiB
Markdown
# Secrets and PII
|
|
|
|
A draft that contains any of the patterns below is **BLOCKED** by the
|
|
`page-reviewer` skill. Scrub before posting; the reviewer's verdict is not
|
|
overridden by "this is a test fixture" or "this is obvious from context".
|
|
|
|
## Hard blocks
|
|
|
|
| Pattern | Example | Action |
|
|
|---------|---------|--------|
|
|
| AWS access key id | `AKIA[0-9A-Z]{16}` | Replace with `<AWS_KEY>` |
|
|
| AWS secret access key | `[A-Za-z0-9/+=]{40}` in env files | Replace with `<AWS_SECRET>` |
|
|
| Bearer / personal token | `ghp_…`, `glpat-…`, `dapi…` | Replace with `<TOKEN>` |
|
|
| Confluence / Jira token | `ATATT…` (Cloud), long base64 | Replace with `<CONFLUENCE_TOKEN>` |
|
|
| Slack token | `xoxb-…`, `xoxp-…` | Replace with `<SLACK_TOKEN>` |
|
|
| OpenAI key | `sk-…` (40+ chars after) | Replace with `<OPENAI_KEY>` |
|
|
| Service-account password | any string in `*.password=…`, `secret: …` | Replace |
|
|
| PEM private key | `-----BEGIN … PRIVATE KEY-----` | Replace |
|
|
| Cookie value | `connect.sid=…`, `JSESSIONID=…` | Replace |
|
|
|
|
## Soft blocks (review)
|
|
|
|
| Pattern | Why | Action |
|
|
|---------|-----|--------|
|
|
| Customer email | PII | Mask: `j***@example.com` or remove |
|
|
| Customer hostname / IP | PII + internal info | Replace with `<HOST>` / `<IP>` |
|
|
| Runbook hostname (`*.k8s.sdntest.netcracker.com`) | Internal surface | Use the public URL or `<INTERNAL_HOST>` |
|
|
| Phone number | PII | Mask or remove |
|
|
| Bank / payment info | PII | Remove |
|
|
|
|
## Why this is in the skill
|
|
|
|
BASS Confluence is private to Netcracker, but watchers, exported PDFs, and
|
|
incident write-ups leak. Pages are also exported to training data when teams
|
|
mirror content into LLMs. "It's on a private space" is not enough.
|
|
|
|
## If you need a realistic-looking fixture
|
|
|
|
Generate one with the project's placeholder vocabulary:
|
|
|
|
- emails: `user1@example.com`, `user2@example.com`
|
|
- IPs: `10.0.0.1`, `192.0.2.1`
|
|
- tokens: `<TOKEN>`, `<SECRET>`
|
|
- hostnames: `host-a.internal`, `host-b.internal`
|
|
|
|
Do not use the customer's name, the production hostname, or a real-looking
|
|
token "because it doesn't matter".
|
|
|
|
## What the reviewer checks
|
|
|
|
The `page-reviewer` skill runs a grep pass against this list. A single hit
|
|
returns **BLOCK**; the author fixes the draft and re-runs.
|