Secrets and PII

A draft that contains any of the patterns below is BLOCKED by the page-reviewer skill. Scrub before posting; the reviewer's verdict is not overridden by "this is a test fixture" or "this is obvious from context".

Hard blocks

Pattern	Example	Action
AWS access key id	`AKIA[0-9A-Z]{16}`	Replace with `<AWS_KEY>`
AWS secret access key	`[A-Za-z0-9/+=]{40}` in env files	Replace with `<AWS_SECRET>`
Bearer / personal token	`ghp_…`, `glpat-…`, `dapi…`	Replace with `<TOKEN>`
Confluence / Jira token	`ATATT…` (Cloud), long base64	Replace with `<CONFLUENCE_TOKEN>`
Slack token	`xoxb-…`, `xoxp-…`	Replace with `<SLACK_TOKEN>`
OpenAI key	`sk-…` (40+ chars after)	Replace with `<OPENAI_KEY>`
Service-account password	any string in `*.password=…`, `secret: …`	Replace
PEM private key	`-----BEGIN … PRIVATE KEY-----`	Replace
Cookie value	`connect.sid=…`, `JSESSIONID=…`	Replace

Soft blocks (review)

Pattern	Why	Action
Customer email	PII	Mask: `j***@example.com` or remove
Customer hostname / IP	PII + internal info	Replace with `<HOST>` / `<IP>`
Runbook hostname (`*.k8s.sdntest.netcracker.com`)	Internal surface	Use the public URL or `<INTERNAL_HOST>`
Phone number	PII	Mask or remove
Bank / payment info	PII	Remove

Why this is in the skill

BASS Confluence is private to Netcracker, but watchers, exported PDFs, and incident write-ups leak. Pages are also exported to training data when teams mirror content into LLMs. "It's on a private space" is not enough.

If you need a realistic-looking fixture

Generate one with the project's placeholder vocabulary:

emails: user1@example.com, user2@example.com
IPs: 10.0.0.1, 192.0.2.1
tokens: <TOKEN>, <SECRET>
hostnames: host-a.internal, host-b.internal

Do not use the customer's name, the production hostname, or a real-looking token "because it doesn't matter".

What the reviewer checks

The page-reviewer skill runs a grep pass against this list. A single hit returns BLOCK; the author fixes the draft and re-runs.

2.2 KiB Raw Blame History