export interface SensitivePathResult {
    blocked: boolean;
    pattern?: string;
}
export declare const DEFAULT_SENSITIVE_PATTERNS: string[];
/**
 * Check whether a file path points to a sensitive credential file.
 *
 * Resolves the input to an absolute, normalized path (expanding `~`),
 * then checks against built-in and optional extra patterns.
 *
 * SSH public keys (`*.pub`) are explicitly allowlisted even though
 * they match the `~/.ssh/id_*` pattern.
 */
export declare function isSensitivePath(filepath: string, extraPatterns?: string[]): SensitivePathResult;
//# sourceMappingURL=sensitive-paths.d.ts.map