Skip to main content

Security Policies

Shield uses a rule-based engine to identify secrets in your application logs and build output. These rules are called Security Policies.

Default Protection (Offline)

When using the Shield CLI without a cloud-linked project, it comes pre-configured with a baseline of high-accuracy detection patterns. This ensures every user gets immediate protection without any configuration.

Supported Default Patterns

NameDescriptionSeverity
AWS Access KeyStandard AWS Access Key IDs (AKIA…)critical
GitHub TokensClassic, OAuth, and Fine-grained Personal Access Tokenscritical
Stripe KeysLive and Test Secret Keyscritical / high
Google API KeyGoogle Cloud Platform API keyscritical
Private KeysRSA, EC, and SSH private key blockscritical
Azure Connection StringAzure Storage account keyscritical
OpenAI API KeyOpenAI API keys (sk-…)critical
NPM TokenNPM access tokenscritical
GitLab Personal TokenGitLab Personal Access Tokens (glpat-…)critical
PyPI API TokenPython Package Index API tokenscritical
JWT TokensJSON Web Tokens (base64 encoded)high
Slack WebhooksIncoming Webhook URLshigh
Twilio Auth TokenTwilio authentication tokenshigh
SendGrid KeysSendGrid API credentialsmedium
Generic DetectorsBroad patterns for api_key, secret, and passwordmedium
Default patterns are hardcoded in the CLI and cannot be modified or disabled while offline.

Cloud-Managed Policies (Linked)

Once you link your project to the Dotset Dashboard, your security architecture upgrades to a Cloud-Managed model.

Centralized Source of Truth

When a project is linked, the CLI discards its local hardcoded defaults and fetches your project’s specific policies from the Cloud. This gives you absolute control over the redaction engine.

Advanced Features

Linking your project unlocks the full power of the Shield engine:
  • Custom Regex Patterns: Create your own detection rules for proprietary token formats or internal secrets.
  • Enable/Disable Rules: Easily toggle specific default rules if they cause false positives in your particular environment.
  • Adjust Severity: Change the severity level (Critical, High, Medium, Low) for any pattern to match your team’s risk profile.
  • Blocked Strings: Add specific sensitive strings (like internal project IDs or employee names) that should always be redacted.
  • Allowlisting: Define patterns or specific values that should be ignored by the redactor, preventing redundant alerts for public information.

Priority and Overrides

If a value matches multiple policies, Shield intelligently merges the redaction ranges and reports the pattern with the highest severity. By managing policies in the Cloud, you ensure that every developer and CI runner in your organization is using the exact same security rules, synced in real-time.