rego-gdpr32-1-001

rules/rego/complyedge/data_protection/api_key.rego

Citation

Regulation (EU) 2016/679 (GDPR), Article 32(1)(b)

Condition

The text carries a live credential in a vendor's published key format: AWS access key id (AKIA/ASIA + 16), GitHub token (ghp_/gho_/ghu_/ghs_/ghr_ + 36, github_pat_), OpenAI (sk- / sk-proj-), Anthropic (sk-ant-), Stripe live keys (sk_live_ / rk_live_), Slack (xoxb-/xoxp-/xoxa-/xoxr-/xoxs-), Google API key (AIza + 35), a JSON Web Token (three base64url segments starting eyJ), or an "Authorization: Bearer" header with a 20+ character token. Stripe TEST keys, AWS's documented example key (ending EXAMPLE), the key id inside a presigned S3 URL, and a JWT that is a URL query value (a magic link addressed to its recipient) do not fire.

Layer 1 detects

AKIA or ASIA then 16 capitals or digits (not after AWSAccessKeyId= or Credential=); ghp_, gho_, ghu_, ghs_ or ghr_ then 36 letters or digits; github_pat_ then 50 or more; sk-, sk-proj- or sk-ant-<letters or digits>- then 20 or more letters, digits, _ or -; sk_live_ or rk_live_ then 16 or more; xoxb-, xoxp-, xoxa-, xoxr- or xoxs- then 10 or more; AIza then 35; three dot-separated segments of at least 8 base64url characters, the first two starting eyJ, not directly after = (a URL query value); and "Authorization: Bearer" in any case then a token of 20 or more characters. Any match ending EXAMPLE does not fire. It matches formats, not purpose: a credential in a format not named here is missed (a HubSpot private app token, pat-eu1- and so on), and it does not read why the value is in the text. No model reviews a hit: a match keeps the block in Layer 2 as well.

Condition type

deterministic (format match only, no checksum exists for these values; no judgment of meaning)

Status in the file

approved