Rule set sha256:adf208a05da8
rego-gdpr32-1-001
One rule of the rule set with digest adf208a05da8edfde9ef5c5a1359104382ac794a5b4ec0d0aaca2fd21e90574c. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-gdpr32-1-001 |
|---|---|
| Rule version | faad208e3bea696efa5aad4779fbb0353a252728c878236cf02a248c3ba9d0f2 |
| Provision | Regulation (EU) 2016/679, Article 32(1) ELI: http://data.europa.eu/eli/reg/2016/679/art_32/par_1/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-16 |
rules/rego/complyedge/data_protection/api_key.rego
- Citation
- Regulation (EU) 2016/679 (GDPR), Article 32(1)
- Condition
- The text carries a live credential in a vendor's published key format: AWS access key id (AKIA/ASIA + 16), GitHub token (ghp_/gho_/ghu_/ghs_/ghr_ + 36, github_pat_), OpenAI (sk- / sk-proj-), Anthropic (sk-ant-), Stripe live keys (sk_live_ / rk_live_), Slack (xoxb-/xoxp-/xoxa-/xoxr-/xoxs-), Google API key (AIza + 35), a JSON Web Token (three base64url segments starting eyJ), or an "Authorization: Bearer" header with a 20+ character token. Stripe TEST keys, AWS's documented example key (ending EXAMPLE), the key id inside a presigned S3 URL, and a JWT that is a URL query value (a magic link addressed to its recipient) do not fire.
- Condition type
- deterministic (format match plus checksum; no judgment of meaning)
- Status in the file
- approved