{
  "revision": "0.1-security-2026-07-16-2",
  "uri": "https://ap-in-indy.github.io/aiignore/vectors/0.1/security.json",
  "policy": "aiignore: \"0.1\"\ndefaults: {network: deny}\nrules:\n  files:\n    - {id: private, effect: deny, paths: [\"private/**\"]}\n    - {id: release, effect: allow, priority: 20, paths: [\"private/release/**\"]}\n    - {id: generated, effect: read-only, paths: [\"generated/**\"]}\n    - {id: tie-deny, effect: deny, priority: 5, paths: [\"tie/**\"]}\n    - {id: tie-later-allow, effect: allow, priority: 5, paths: [\"tie/public.txt\"]}\n    - {id: windows-case-file, effect: deny, paths: [\"CaseSensitive/**\"]}\n  environment:\n    - {id: tokens, effect: drop, names: [\"*_TOKEN\"], except: [\"PUBLIC_*\"]}\n    - {id: forbidden, effect: deny, names: [\"FORBIDDEN_RUNTIME\"]}\n    - {id: windows-case-env, effect: drop, names: [\"CASE_EXACT\"]}\n  network:\n    - {id: docs, effect: allow, urls: [\"https://**.example.com/docs/**\"]}\n    - {id: upload, effect: deny, priority: 20, urls: [\"https://api.example.com/docs/upload/**\"]}\n    - {id: registry-port, effect: allow, urls: [\"https://registry.test:8443/**\"]}\n    - {id: idn, effect: allow, urls: [\"https://bücher.example/**\"]}\n    - {id: loopback-canonical, effect: allow, urls: [\"http://127.0.0.1/**\"]}\n  strings:\n    - {id: first, effect: redact, patterns: [{type: literal, value: FIRST}]}\n    - {id: second, effect: redact, patterns: [{type: literal, value: SECOND}]}\n    - {id: explicit-safe, effect: allow, priority: 100, patterns: [{type: literal, value: \"SAFE:\"}]}\n    - {id: all-boundaries, effect: redact, patterns: [{type: literal, value: BOUNDARY}], replacement: \"[B]\"}\n",
  "cases": [
    { "id": "file-private-deny", "resource": "file", "candidate": "private/key.txt", "operation": "read", "effect": "deny", "ruleId": "private" },
    { "id": "file-terminal-double-star-zero-segments", "resource": "file", "candidate": "private", "operation": "discover", "effect": "deny", "ruleId": "private", "matched": "private/**" },
    { "id": "file-priority-release", "resource": "file", "candidate": "private/release/notice.txt", "operation": "read", "effect": "allow", "ruleId": "release" },
    { "id": "file-tie-later", "resource": "file", "candidate": "tie/public.txt", "operation": "read", "effect": "allow", "ruleId": "tie-later-allow" },
    { "id": "file-read-only-read", "resource": "file", "candidate": "generated/api.ts", "operation": "read", "effect": "allow", "ruleId": "generated" },
    { "id": "file-read-only-write", "resource": "file", "candidate": "generated/api.ts", "operation": "write", "effect": "deny", "ruleId": "generated" },
    { "id": "file-case-sensitive-default", "resource": "file", "candidate": "casesensitive/key.txt", "operation": "read", "caseInsensitive": false, "effect": "allow", "ruleId": null },
    { "id": "file-case-insensitive-platform", "resource": "file", "candidate": "casesensitive/key.txt", "operation": "read", "caseInsensitive": true, "effect": "deny", "ruleId": "windows-case-file" },
    { "id": "file-empty-invalid", "resource": "file", "candidate": "", "operation": "read", "errorCode": "invalid_path" },
    { "id": "file-escape-invalid", "resource": "file", "candidate": "../outside", "operation": "read", "errorCode": "path_escape" },
    { "id": "file-operation-invalid", "resource": "file", "candidate": "private/key.txt", "operation": "reed", "errorCode": "invalid_file_operation" },
    { "id": "env-drop", "resource": "environment", "candidate": "GITHUB_TOKEN", "effect": "drop", "ruleId": "tokens" },
    { "id": "env-exception", "resource": "environment", "candidate": "PUBLIC_TOKEN", "effect": "allow", "ruleId": null },
    { "id": "env-deny", "resource": "environment", "candidate": "FORBIDDEN_RUNTIME", "effect": "deny", "ruleId": "forbidden" },
    { "id": "env-case-sensitive-default", "resource": "environment", "candidate": "case_exact", "caseInsensitive": false, "effect": "allow", "ruleId": null },
    { "id": "env-case-insensitive-platform", "resource": "environment", "candidate": "case_exact", "caseInsensitive": true, "effect": "drop", "ruleId": "windows-case-env" },
    { "id": "env-empty-invalid", "resource": "environment", "candidate": "", "errorCode": "invalid_environment_name" },
    { "id": "env-equals-invalid", "resource": "environment", "candidate": "BAD=NAME", "errorCode": "invalid_environment_name" },
    { "id": "network-apex", "resource": "network", "candidate": "https://example.com/docs/start", "effect": "allow", "ruleId": "docs" },
    { "id": "network-terminal-double-star-zero-segments", "resource": "network", "candidate": "https://example.com/docs", "effect": "allow", "ruleId": "docs", "matched": "https://**.example.com/docs/**" },
    { "id": "network-subdomain", "resource": "network", "candidate": "https://api.example.com/docs/start", "effect": "allow", "ruleId": "docs" },
    { "id": "network-path-priority", "resource": "network", "candidate": "https://api.example.com/docs/upload/key", "effect": "deny", "ruleId": "upload" },
    { "id": "network-lookalike", "resource": "network", "candidate": "https://example.com.evil.test/docs/start", "effect": "deny", "ruleId": null },
    { "id": "network-exact-port", "resource": "network", "candidate": "https://registry.test:8443/pkg", "effect": "allow", "ruleId": "registry-port" },
    { "id": "network-wrong-port", "resource": "network", "candidate": "https://registry.test/pkg", "effect": "deny", "ruleId": null },
    { "id": "network-idn", "resource": "network", "candidate": "https://xn--bcher-kva.example/catalog", "effect": "allow", "ruleId": "idn" },
    { "id": "network-alternate-ip", "resource": "network", "candidate": "http://2130706433/status", "errorCode": "invalid_url" },
    { "id": "network-userinfo-invalid", "resource": "network", "candidate": "https://user@example.com/docs/start", "errorCode": "invalid_url" },
    { "id": "network-encoded-separator-invalid", "resource": "network", "candidate": "https://example.com/docs%2fprivate", "errorCode": "invalid_url" },
    { "id": "network-whitespace-invalid", "resource": "network", "candidate": " https://example.com/docs/start", "errorCode": "invalid_url" },
    { "id": "network-single-slash-invalid", "resource": "network", "candidate": "https:/example.com/docs/start", "errorCode": "invalid_url" },
    { "id": "network-triple-slash-invalid", "resource": "network", "candidate": "https:///example.com/docs/start", "errorCode": "invalid_url" },
    { "id": "network-backslash-invalid", "resource": "network", "candidate": "https://example.com\\docs\\start", "errorCode": "invalid_url" },
    { "id": "network-empty-port-invalid", "resource": "network", "candidate": "https://example.com:/docs/start", "errorCode": "invalid_url" },
    { "id": "network-scheme-invalid", "resource": "network", "candidate": "file:///etc/passwd", "errorCode": "invalid_url" },
    { "id": "string-compose", "resource": "string", "candidate": "FIRST and SECOND", "scope": "tool_output", "effect": "redact", "ruleId": "second", "output": "[REDACTED:first] and [REDACTED:second]" },
    { "id": "string-allow-override", "resource": "string", "candidate": "SAFE: FIRST", "scope": "tool_output", "effect": "allow", "ruleId": "explicit-safe" },
    { "id": "scope-user-prompt", "resource": "string", "candidate": "BOUNDARY", "scope": "user_prompt", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-model-input", "resource": "string", "candidate": "BOUNDARY", "scope": "model_input", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-model-output", "resource": "string", "candidate": "BOUNDARY", "scope": "model_output", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-tool-input", "resource": "string", "candidate": "BOUNDARY", "scope": "tool_input", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-tool-output", "resource": "string", "candidate": "BOUNDARY", "scope": "tool_output", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-file-read", "resource": "string", "candidate": "BOUNDARY", "scope": "file_read", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-file-write", "resource": "string", "candidate": "BOUNDARY", "scope": "file_write", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-environment-value", "resource": "string", "candidate": "BOUNDARY", "scope": "environment_value", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-network-request", "resource": "string", "candidate": "BOUNDARY", "scope": "network_request", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-network-response", "resource": "string", "candidate": "BOUNDARY", "scope": "network_response", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-log", "resource": "string", "candidate": "BOUNDARY", "scope": "log", "effect": "redact", "ruleId": "all-boundaries", "output": "[B]" },
    { "id": "scope-invalid", "resource": "string", "candidate": "BOUNDARY", "scope": "logs", "errorCode": "invalid_string_scope" }
  ]
}