maisecrets menu

maisecrets / Your own rules

Your token formats, your names, your values

The built-in rules know the public token formats and personal data with a shape. They do not know your internal tokens, your customers' names or your case numbers. You can teach maisecrets all three, and the AI can only make detection stricter, never weaker.

What the model sees

A tool result 
Case 4711, Jan Kowalski
api key acme_live_7Hq2Lx9Pz4Rt8Vw3
The model receives 
Case 4711, ⟦NAME_c3⟧
api key ⟦SECRET_c5⟧

The name is on a term list, and a rule of your team knows the token format.

Rules for your token formats

A rule folder holds rules in the gitleaks form (*.json) or one regex per line (*.prefixes). maisecrets rules init DIR makes a team folder with CI files for GitHub and GitLab, so each change is checked. Add the folder with /maisecrets:settings rule_dirs add ~/src/team-rules, or list it in rule_dirs of the machine policy: then users cannot remove it. maisecrets times each new rule and leaves out a rule that backtracks.

Names and case numbers

A name has no shape, so no rule finds it. /maisecrets:term add Jan Kowalski puts it on your list, also “Herr Kowalski” and “Kowalski, Jan”. {{Jan Kowalski}} in a prompt masks a name without the list, for one day by default. A *.terms file in a rule folder is a list for the whole team, with a floor against common words. maisecrets never puts a name back.

Values your own tools found

A NER, an export or a script knows values that have no shape. Your tool writes one JSON line per value:

{"value": "Jan Kowalski", "type": "NAME"}
{"value": "a value without a shape"}

Import it once with bash hooks/run.sh values import FILE in the plugin folder, or let maisecrets read it at each session start: /maisecrets:settings value_files add ~/work/ner-out.jsonl. maisecrets masks each value in any case and spacing, also across a line break. An import only adds; no field of a line can switch a rule off.

Values that are not a hit

~/.maisecrets/allow.txt lists exact values that maisecrets lets through, such as your own address in every git log, and rule: <id> switches one rule off. A rule folder carries no allow list: the AI can write a shared checkout, and the AI may only make detection stricter.

Limits

  • maisecrets reads local folders only. It does not fetch or update a rule folder: how the files get to each machine is your choice.
  • Terms and imported values are matched in text. A name inside a PDF or an image reaches the model as it is, unless read_pdf convert turns the PDF into text.
  • A term or an imported value is masked only. A placeholder of it in a file that the AI writes stays a placeholder.

The rule format and every check: README.