Detectors

Detectors are connectors in the sensitive-data inspection category, listed beside the datasource, memory and scanner connectors.

Built-in detector

The Built-in detector runs inside your Shield360 deployment. No content is sent anywhere. It’s deliberately a small, high-confidence set of checkable patterns: card numbers that pass a Luhn check, national ID numbers in issued ranges, and keys with a known prefix. A detector that cries wolf is one nobody reads.

Rule	Entity	How it’s confirmed
Private key block	private_key	PEM BEGIN … PRIVATE KEY header (RSA, EC, OpenSSH, PGP, DSA)
AWS access key	api_key	AKIA / ASIA prefix and length
GitHub token	api_key	ghp_, gho_, ghu_, ghs_, ghr_ prefix
Slack token	api_key	xox[baprs]- prefix
Google API key	api_key	AIza prefix and length
OpenAI / Anthropic key	api_key	sk-, sk-proj-, sk-ant- prefix
JWT	jwt	Three base64url segments beginning eyJ
Assigned secret	credential	password=, secret:, api_key= and similar followed by a value. Placeholders such as ***, <token>, ${VAR} and changeme are ignored.
Payment card	payment_card	13–19 digits that pass a Luhn check
US Social Security number	national_id	###-##-#### in an issuable range
IBAN	bank_account	Country code, check digits and account format
Email address	email	Address format, excluding file names such as logo@2x.png
Phone number	phone	International (E.164) format
IPv4 address (opt-in)	ip_address	Routable addresses only

IPv4 detection is off by default. A version string like 1.24.3.7 is indistinguishable from an address, and an address counts as personal data only in some jurisdictions. Enable it in the detector’s settings when you need it.

Patterns are written to scan in linear time, because the input is arbitrary text from an agent and a pattern that backtracks could stall a scan.

Severity

Severity is set by the kind of entity found:

Severity	Entities
Critical	private_key, credential, api_key, payment_card, national_id
High	bank_account, jwt, health_term, date_of_birth
Medium	postal_address, phone, email
Low	person_name, ip_address, other

The built-in detector doesn’t produce health_term, date_of_birth, postal_address or person_name. Those kinds exist for detector connectors that do.

Other detectors

Every detector connector declares whether it sends content off the premises. The built-in detector doesn’t. A cloud detector would, and Shield360 tells an administrator so before it’s enabled, not after. This follows Shield360’s local-first default: content stays in your deployment unless you choose otherwise.