# RTExit JavaScript analysis patterns.
# Treat matches as leads. Validate context before reporting.

# Cloud access key indicators
AKIA[0-9A-Z]{16}
ASIA[0-9A-Z]{16}
AIza[0-9A-Za-z_-]{35}

# Tokens and auth headers
Bearer\s+[A-Za-z0-9._=-]{20,}
basic\s+[A-Za-z0-9+/=]{20,}
authorization["']?\s*[:=]\s*["'][^"']{10,}

# Private key material
-----BEGIN\s+(RSA\s+|EC\s+|OPENSSH\s+)?PRIVATE KEY-----

# URLs and API endpoints
https?://[A-Za-z0-9._~:/?#@!$&'()*+,;=%-]+
["'`](\/api\/[A-Za-z0-9._~:/?#@!$&'()*+,;=%-]+)["'`]

# Firebase and cloud project hints
firebaseapp\.com
firebasedatabase\.app
storage\.googleapis\.com
amazonaws\.com
azurewebsites\.net

