Skip to main content

Security Policies

Mantle uses a rule-based engine to identify secrets in your application logs and build output. These rules are called Security Policies.

Built-in Protection

Mantle comes pre-configured with a curated set of high-accuracy detection patterns for common secret types:

Supported Patterns

NameDescriptionSeverity
AWS Access KeyStandard AWS Access Key IDs (AKIA…)critical
GitHub TokensClassic, OAuth, and Fine-grained Personal Access Tokenscritical
Stripe KeysLive and Test Secret Keyscritical / high
Google API KeyGoogle Cloud Platform API keyscritical
Private KeysRSA, EC, and SSH private key blockscritical
Azure Connection StringAzure Storage account keyscritical
OpenAI API KeyOpenAI API keys (sk-…)critical
NPM TokenNPM access tokenscritical
GitLab Personal TokenGitLab Personal Access Tokens (glpat-…)critical
PyPI API TokenPython Package Index API tokenscritical
JWT TokensJSON Web Tokens (base64 encoded)high
Slack WebhooksIncoming Webhook URLshigh
Twilio Auth TokenTwilio authentication tokenshigh
SendGrid KeysSendGrid API credentialsmedium
Generic DetectorsBroad patterns for api_key, secret, and passwordmedium

Dynamic Detection

In addition to pattern-based detection, Mantle also performs:
  • Exact value matching: Any secret loaded from your providers is matched exactly
  • High-entropy detection: Identifies strings that look like secrets based on character distribution
  • Assignment pattern detection: Catches patterns like password= or api_key: in output

Priority and Merging

If a value matches multiple patterns, Mantle:
  1. Merges overlapping redaction ranges
  2. Reports the pattern with the highest severity
This ensures comprehensive protection without redundant alerts.