apiVersion: pyro/v1
kind: Profile
profile:
  id: local-secrets
  name: Local secret guard
  description: Local-only checks for common private-key and credential shapes.
    Does not detect every secret and does not use a model.
  model: jev-latest
  reviewThreshold: 0.55
  blockThreshold: 0.82
  decisionStrategy: maximum
  minimumReviewSignals: 1
  minimumBlockSignals: 1
  failMode: closed
  maxInputChars: 100000
  timeoutMs: 8000
  persistInputs: false
  notifyOn:
    - review
    - block
  shadowProfileIds: []
  localRules:
    - id: private-key
      name: Private key material
      description: Block PEM private-key headers.
      enabled: true
      scope: all_text
      match: regex
      pattern: -----BEGIN (RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----
      caseSensitive: true
      action: block
      risk: 1
    - id: credential-token
      name: Credential-shaped token
      description: Review common token prefixes. May match examples and test tokens.
      enabled: true
      scope: all_text
      match: regex
      pattern: (sk-[A-Za-z0-9_-]{20,}|AKIA[A-Z0-9]{16}|ghp_[A-Za-z0-9]{30,})
      caseSensitive: true
      action: review
      risk: 0.9
  detectors: []