Detector catalogue: formats, checksums and API key patterns

How to read an entry

Each detector has a pack, a data category and, for most identifiers, a validator. A validator recomputes a check digit or letter, or tests the layout and any date inside the number, so that a string with the right shape but the wrong arithmetic is left alone. A keyword-gated detector masks a value only when one of its words appears shortly before it. Opt-in detectors stay off when their pack is turned on.

A passing check shows that a value is well formed. It does not show that the number was issued to anyone, and Maskflare masks well-formed numbers either way.

What is in the catalogue

How detection works

1. The pattern finds candidates: a layout such as nine digits in groups, or a prefix and a fixed length.
2. The validator, where there is one, checks the arithmetic or the embedded date. Candidates that fail are dropped.
3. Keyword rules decide the ambiguous cases. A short number with no check digit needs a label in front of it; an unseparated run of digits is rejected when a word such as order or invoice is nearer than the identifier's own keywords.
4. Credential detectors add an entropy floor and an allow list of placeholders so that templates and examples are not masked.
5. Each surviving match is replaced by a token according to the rule's action: mask, redact, partial, hash, format-preserving encryption, generalize, alert, warn or block.

The same engine runs in the AI gateway, the desktop agent and the browser protection, so a detector behaves the same wherever the text comes from. The reference for every detector, with its pack and gating, is in the detector reference; the detection engine itself is described under Vault.