Patterns

Patterns

How patterns work

Each pattern is a YAML file in the community/<category>/ directory. At build time the bundler compiles them into a compressed bundle (core/patterns.bundle) embedded in the binary.

A pattern file looks like:

name: my-api-key
match: 'MY_[A-Z0-9]{32}'
enabled: true   # optional, defaults to true

Field	Required	Description
name	yes	Unique identifier shown in findings
match	yes	RE2-compatible regular expression
enabled	no	Set to false to ship a pattern but disable it by default

Community library structure

community/
  secrets/       # API keys, tokens, credentials
  tokens/        # Bearer tokens, JWTs, session tokens
  ...

Writing your own pattern

1. Create a .yaml file under community/<category>/
2. Rebuild the bundle: go run ./bundler
3. Test: go test ./...
4. Verify against a real sample: echo "MY_ABC123..." | atheon scan /dev/stdin

Pattern tips

• Anchor with context — sk-[a-z0-9]{48} is better than [a-z0-9]{48} alone
• Use word boundaries — \b reduces false positives
• Test entropy — high-entropy strings mixed with a vendor prefix (e.g. ghp_, sk-, xoxb-) have very low false-positive rates
• Keep RE2 compatible — no lookaheads, no backreferences

Enabling / disabling patterns

# List disabled patterns
atheon list patterns --disabled

# Patterns can be toggled in the YAML source via enabled: false

Inline suppression

To suppress a finding on a specific line:

const testKey = "sk-abc123..." // atheon:ignore