Open-source detection rules and semantic prompts for PasteGuard — a Chrome extension that warns users before sensitive data hits AI chat services (ChatGPT, Claude, Gemini, Copilot, DeepSeek, Perplexity, Grok, Mistral).
This repository contains only the detection logic. The Chrome extension UI is closed-source for v0.1; the rules are open so anyone can audit exactly what PasteGuard considers sensitive — and so you can fork them for your own DLP.
.
├── regex/ 25 regex-based detectors covering API keys, PII, secrets
├── semantic/ prompt template + JSON schema for the Gemini Nano layer
├── tests/ unit tests + the false-positive fixture corpus
├── PRIVACY.md extension privacy policy (mirror of pasteguard.io/privacy)
└── LICENSE MIT
Quick links: Install · Privacy policy · Support · Audit a detector · Contributing
Suppose you want to verify what PasteGuard does with AWS access keys. Each detector lives in its own file under regex/. Open regex/aws.ts:
// AWS access key IDs always start with a specific 4-char prefix:
// AKIA (long-term), ASIA (temporary), AGPA/AROA/AIPA/ANPA/ABIA/ACCA (other classes).
// Followed by exactly 16 uppercase alphanumeric characters.
const AWS_ACCESS_KEY_RE = /\b(?:AKIA|ASIA|AGPA|AROA|AIPA|ANPA|ABIA|ACCA)[A-Z0-9]{16}\b/g;Then check tests/regex/aws.spec.ts for what's tested:
- Positive cases: real-looking keys at start / middle / end of paste
- False-positive cases: similar-looking strings that must NOT trigger (e.g. random 20-char uppercase strings without the prefix)
Every detector follows the same shape. The whole corpus is auditable in under an hour.
PasteGuard's main claim is "zero outbound network requests from the extension." You can verify this in 30 seconds:
- Install PasteGuard from the Chrome Web Store
- Open any AI chat site (chatgpt.com, claude.ai, etc.)
- Open DevTools → Network tab
- Filter to exclude the host page's own traffic:
-scheme:chrome-extension -domain:chatgpt.com -domain:openai.com -domain:oaistatic.com - Click the 🚫 Clear button on the Network panel
- Paste a fake AWS key:
AKIAIOSFODNN7EXAMPLE - The PasteGuard modal appears.
- The Network panel stays empty. Status bar reads "0 / N requests."
If you ever see PasteGuard make a network request that isn't a chunk load from chrome-extension://, that's a bug — open a security issue immediately.
| Detector | Pattern shape |
|---|---|
| Anthropic | sk-ant-(api|admin)\d{2}-[A-Za-z0-9_-]{93,} |
| OpenAI (modern) | sk-(proj|svcacct|admin)-[A-Za-z0-9_-]{20,} |
| OpenAI (legacy) | sk-[A-Za-z0-9]{48} |
| Google AI / GCP | AIza[0-9A-Za-z_-]{35} |
| Google service-account JSON | co-occurrence of "type":"service_account" + "private_key":"-----BEGIN |
| Hugging Face | hf_[A-Za-z0-9]{34,40} |
| Replicate | r8_[A-Za-z0-9]{37} |
| Groq | gsk_[A-Za-z0-9]{52} |
| Perplexity | pplx-[A-Za-z0-9]{48,} |
| OpenRouter | sk-or-(v1-)?[A-Za-z0-9]{64} |
| Detector | Pattern shape |
|---|---|
| AWS access key | (AKIA|ASIA|AGPA|AROA|AIPA|ANPA|ABIA|ACCA)[A-Z0-9]{16} |
| AWS secret key (heuristic) | 40-char base64 near aws / secret / session_token |
| PEM private key | -----BEGIN (?:RSA |EC |OPENSSH |...)? PRIVATE KEY----- |
| Database connection string | (mongodb|postgres|mysql|redis|amqp)://USER:PASS@HOST |
| Detector | Pattern shape |
|---|---|
| Stripe API key | (sk|pk|rk)_(live|test)_[A-Za-z0-9]{24,} |
| Stripe webhook secret | whsec_[A-Za-z0-9]{32,} |
| GitHub classic PAT / OAuth | gh[opsur]_[A-Za-z0-9]{36,} |
| GitHub fine-grained PAT | github_pat_[A-Z0-9_]{82} |
| Slack token | xox[abpsr]-…-…-… |
| npm publish token | npm_[A-Za-z0-9]{36} |
| JWT | three base64url segments + verified "alg" JSON header |
| Detector | Pattern shape |
|---|---|
| US SSN — formatted | \d{3}[- ]\d{2}[- ]\d{4} (rejects all-zero placeholders) |
| US SSN — context-aware unformatted | 9 digits within 32 chars of SSN / social security |
| Credit card | 13–19 digits, Luhn-validated |
| IBAN | country code + 2 check digits + 10–30 alphanum, mod-97 validated |
| US passport | 9 chars, requires passport keyword within 30 chars |
| Detector | Pattern |
|---|---|
| High-entropy string | 32+ char base64-ish strings with Shannon entropy ≥ 4.5 (off by default) |
| Custom rules | user-defined regex patterns set in the extension's Options page (with ReDoS static lint at save time) |
The optional semantic layer runs Chrome's on-device Gemini Nano AI to catch sensitive content that regex can't:
- Customer / company names in context ("Our customer Acme Corp is reporting…")
- Internal codenames ("Project Falcon launches Q3")
- Confidential business signals (pricing, salary, M&A, layoffs, unreleased products)
The system prompt and JSON-schema response constraint are in semantic/prompts.ts. The model runs entirely on the user's device — text never leaves the browser.
tests/false-positives.ts is the trust contract. It's a collection of real-world paste samples — code snippets, JSON dumps, lorem ipsum, email signatures, log lines — that must not trigger any detector. CI rejects any rule change that breaks a fixture.
If you find a real paste that PasteGuard flags incorrectly, open an issue with the snippet (redacted as needed) and we'll add it to the corpus.
See PRIVACY.md. Short version: zero outbound network calls from the extension code, no telemetry, no account required, detection runs 100% on-device. The PRIVACY.md here is the canonical source — the styled version at pasteguard.io/privacy mirrors it.
The rules are MIT-licensed — copy, fork, audit, propose improvements. Particularly welcome:
- New vendor API key patterns as services launch (Mistral, Cohere, Together, Fireworks, etc.)
- Industry-specific patterns knowledge workers commonly paste (legal case IDs, medical record formats, financial security IDs)
- False-positive fixtures — if you hit a real paste that should NOT trigger, add it to the corpus
Each new detector PR needs:
- The regex / heuristic in
regex/<category>.ts - At least 3 positive cases + 3 false-positive cases in the test file
- A line in this README's detection table
This repo tracks the published Chrome Web Store extension version. Tags here match the extension's manifest.json version. Rule changes ship here first, then in the extension's next release.
Current: v0.1.1
MIT. Use the rules anywhere — your own DLP, your own browser extension, your CI checks. Attribution appreciated but not required.