Every credential shape the registry knows: the four of the `secrets` group plus Anthropic, Google, Slack, Twilio, SendGrid, Azure, npm, PyPI, GitLab, Mailgun, DigitalOcean, the Google OAuth client id, the AWS secret key, JWTs, bearer tokens, SSH public keys, PEM private key blocks and PEM certificate blocks, and the three credentials that live inside a URL: a Slack webhook, a database URL and HTTP basic auth. A certificate is here because it carries the subject's name, organisation and often an email address in clear text. Several of these contain long digit runs, so a phone or card pattern in the same detector claims part of them: declare this group first, or keep it in a detector of its own. The URL-shaped three start where a URL starts and must be declared ahead of it, which is why the `logs` group leaves URL out entirely.
Tags: international, secrets, software-dev, code-assistant, logs