oc_connect.egress Namespace Reference

Classes
class	EgressFinding
class	EgressBlockedError

Functions
float	shannon_entropy (str value)
tuple[EgressFinding,...]	scan_text (str text)
None	require_safe (str text)

Variables
int	_MIN_ENTROPY_LENGTH = 24
float	_ENTROPY_THRESHOLD = 4.5
	_GITHUB_SHAPE = re.compile("gh" + "[pousr]_" + "[A-Za-z0-9]" + "{20,}")
	_AWS_SHAPE = re.compile("AKIA" + "[0-9A-Z]" + "{16}")
	_OPENAI_SHAPE = re.compile("sk-" + "[A-Za-z0-9]" + "{20,}")
	_TELEGRAM_SHAPE = re.compile("[0-9]" + "{6,12}:" + "[A-Za-z0-9_-]" + "{30,}")
	_TOKEN_SHAPE = re.compile("[A-Za-z0-9_" + "+/=-]" + "{24,}")
tuple	_LABELS
	_NAMED_VALUE_SHAPE
tuple	THREE_OPTIONS_ESCALATION

Detailed Description

Plain-text outbound scanner derived from OCT's secret-scanner heuristics.

Provenance: the pattern vocabulary and Shannon-entropy formula are ported from
``oct/oct/tools/secret_scanner.py``. OCT's scanner itself is intentionally not
imported: it walks Python AST nodes and cannot certify ordinary message prose.
This module scans content tokens and well-known credential shapes instead.

Dependencies
------------
- oc_diagnostics (_dbg structured logging of text length and finding count per scan, and of each block by finding count only)

Function Documentation

require_safe()

None oc_connect.egress.require_safe

(

str

text

)

Return only for clean text; otherwise block with three operator options.

Definition at line 149 of file egress.py.

Here is the call graph for this function:

scan_text()

tuple[EgressFinding, ...] oc_connect.egress.scan_text

(

str

text

)

Return content-oriented findings without returning matched content.

Definition at line 91 of file egress.py.

Here is the call graph for this function:

Here is the caller graph for this function:

shannon_entropy()

float oc_connect.egress.shannon_entropy

(

str

value

)

Return Shannon entropy in bits per character.

Definition at line 79 of file egress.py.

Here is the caller graph for this function:

Variable Documentation

_AWS_SHAPE

oc_connect.egress._AWS_SHAPE = re.compile("AKIA" + "[0-9A-Z]" + "{16}")

protected

Definition at line 25 of file egress.py.

_ENTROPY_THRESHOLD

float oc_connect.egress._ENTROPY_THRESHOLD = 4.5

protected

Definition at line 22 of file egress.py.

_GITHUB_SHAPE

oc_connect.egress._GITHUB_SHAPE = re.compile("gh" + "[pousr]_" + "[A-Za-z0-9]" + "{20,}")

protected

Definition at line 24 of file egress.py.

_LABELS

tuple oc_connect.egress._LABELS

protected

Initial value:

=  (
    "api[ _-]?key",
    "access[ _-]?token",
    "auth[ _-]?token",
    "client[ _-]?secret",
    "password",
    "private[ _-]?key",
    "refresh[ _-]?token",
    "secret",
    "token",
)

Definition at line 30 of file egress.py.

_MIN_ENTROPY_LENGTH

int oc_connect.egress._MIN_ENTROPY_LENGTH = 24

protected

Definition at line 21 of file egress.py.

_NAMED_VALUE_SHAPE

oc_connect.egress._NAMED_VALUE_SHAPE

protected

Initial value:

=  re.compile(
    "\\b(?:"
    + "|".join(_LABELS)
    + ")\\b"
    + "\\s*[:=]\\s*"
    + "[\"']?"
    + "([A-Za-z0-9_"
    + "+/=.:-]{8,})",
    re.IGNORECASE,
)

Definition at line 41 of file egress.py.

_OPENAI_SHAPE

oc_connect.egress._OPENAI_SHAPE = re.compile("sk-" + "[A-Za-z0-9]" + "{20,}")

protected

Definition at line 26 of file egress.py.

_TELEGRAM_SHAPE

oc_connect.egress._TELEGRAM_SHAPE = re.compile("[0-9]" + "{6,12}:" + "[A-Za-z0-9_-]" + "{30,}")

protected

Definition at line 27 of file egress.py.

_TOKEN_SHAPE

oc_connect.egress._TOKEN_SHAPE = re.compile("[A-Za-z0-9_" + "+/=-]" + "{24,}")

protected

Definition at line 28 of file egress.py.

THREE_OPTIONS_ESCALATION

tuple oc_connect.egress.THREE_OPTIONS_ESCALATION

Initial value:

=  (
    "Outbound message blocked: a possible credential was detected and nothing was sent.\n"
    "1. Remove or redact the sensitive value, then retry.\n"
    "2. Ask the operator to review a possible false positive through the scoped waiver workflow.\n"
    "3. Cancel the send and keep the message local."
)

Definition at line 52 of file egress.py.