The pattern corpus — Don't paste that.

What it is

A single JSON file describing how to recognise things that should not be pasted into a public AI tool: API keys and tokens, private key blocks, database connection strings, payment card numbers, bank details, and the national tax, health and identity numbers of several countries.

It is data, not code. There is no runtime here — no dependency to audit, no build step, nothing to run. A rule is a pattern, a severity, a boundary strategy, an optional checksum, and a set of example strings that must and must not match.

What it isn't

It is not a guarantee, and treating it as one would be a mistake. Pattern matching finds things shaped like identifiers. It does not find a customer list with no numbers in it, an unreleased strategy document, or a paragraph that is confidential because of what it says rather than what it contains. The checker is a seatbelt, not a chauffeur — and the same is true of anything you build on this file.

Get it

Endpoint	Notes
/patterndb.json	The file, served from this site. Same bytes as the API.
api.dontpastethat.com/v1/rules	Current version. Carries X-Rules-Version and X-Rules-Signature headers, and honours If-None-Match.
api.dontpastethat.com/v1/rules/2026.08.04	Pin to an exact version. Immutable, cached for a year.
/rules-signing.pub.pem	The Ed25519 public key, for verifying the signature yourself.

The API sends the corpus file's original bytes rather than re-serialising the parsed object. That is deliberate: re-serialising would change whitespace and key order, and the signature is over the bytes.

curl -s https://api.dontpastethat.com/v1/rules

The shape of a rule

Example

{
  "id": "key.aws.access",
  "label": "AWS access key ID",
  "jurisdiction": "ALL",
  "category": "secret",
  "severity": "critical",
  "tier": 1,
  "pattern": "AKIA[0-9A-Z]{16}",
  "boundary": "word",
  "redactAs": "[AWS KEY REDACTED]",
  "explains": "credentials",
  "examples": {
    "valid": [
      "AKIAIOSFODNN7EXAMPLE"
    ],
    "invalid": [
      "AKIA123",
      "BKIAIOSFODNN7EXAMPLE"
    ]
  }
}

Field	Meaning
id	Stable identifier. Never reused, never renamed — downstream tooling keys off it.
label	Human-readable name, shown in findings.
jurisdiction	ALL for universal patterns, otherwise a country code.
category	contact, financial, health-id, national-id, network, secret, tax-id
severity	critical › high › medium › low. Drives overlap resolution when two rules match the same span.
pattern	A regular expression using \p{Nd} for digits, so it matches Arabic-Indic, Devanagari, Thai and fullwidth numerals as well as ASCII.
boundary	word, digit or none. Numeric identifiers use digit lookarounds, which behave correctly in scripts with no word boundaries — CJK in particular.
checksum	Optional. Names the validation algorithm a candidate must pass before it counts as a finding.
contextWords	Optional, keyed by language. For identifiers with no checksum, a nearby keyword is what separates a tax file number from any nine-digit string.
redactAs	The replacement string used when redacting.
explains	Which answer page this finding links to, so every result has somewhere to send the reader.
examples	Mandatory. Strings that must match and strings that must not. The schema test refuses a rule without them.

Checksums, and why the false positives matter more than the misses

A tool that flags every nine-digit number gets ignored within a day, and an ignored tool protects nobody. Most national identifiers carry a check digit, so where one exists the corpus requires it to validate before anything is reported.

10 algorithms are implemented: Luhn for payment cards, mod-97 for IBAN, mod-11 variants for the Australian TFN and the UK NHS, Irish-style mod-11 for the New Zealand IRD and NHI, mod-89 for the Australian ABN, plus the ACN, Medicare and ABA routing schemes.

Where an identifier has no checksum, the rule falls back to context proximity — a nearby keyword in the right language. It is weaker, and rules that rely on it carry lower severity for exactly that reason.

Document signals

Separately from the 36 patterns, 6 signals detect what a piece of text is rather than what it contains — a contract, a medical record, source code. Each carries a term list and a threshold, so a single stray word doesn't trip it.

Signal	Fires on	Threshold
doc.contract	Looks like a contract	3 terms
doc.health	Looks like a medical record	3 terms
doc.legal-privilege	Looks legally privileged	2 terms
doc.source-code	Looks like source code	4 terms
doc.financial	Looks like financial statements	3 terms
doc.hr-payroll	Looks like HR or payroll data	3 terms

This is how a pasted contract with no numbers in it still gets caught. Term lists are keyed by language, so adding a locale is data rather than code.

Coverage

India, Mexico, the Gulf states, Taiwan, China, Greece, Japan, Korea, Brazil and the rest of Europe are specified and queued. The mechanisms they need — digit normalisation with offset mapping, CJK-safe boundaries, per-language context words — are already built, so each is a data addition rather than an engine change.

Signed, and worth verifying

Every published version is signed with Ed25519 over the file's exact bytes, and the public key is served from this site. Any edit at all — a new rule, a version bump, a metadata field nobody reads — invalidates the signature and requires re-signing before release.

The step-by-step version, along with what the signature does and does not prove, is on the verification page.

Licence and use

MIT — the full text is the URL the corpus's own licenseUrl field points at, so the licence a machine reads and the licence a person reads are the same file.

Use it in your own DLP tooling, your CI secret scanner, your onboarding material, or a product you sell. No attribution is required. If you find a pattern that misfires, or you have a national scheme with a published checksum and reserved test vectors, tell Golonex — a corpus is only as good as the corrections it receives.

One request, not a condition: pin a version. Rules get tightened when they misfire, and a client tracking the moving endpoint will inherit those changes without warning. The versioned endpoint exists for exactly this.

Rule	Category	Severity	Checksum
Universal — not tied to a country · 18 rules
key.aws.access	AWS access key ID	critical	—
key.aws.secret	AWS secret access key	critical	context
key.anthropic	Anthropic API key	critical	—
key.openai	OpenAI API key	critical	—
key.github	GitHub token	critical	—
key.stripe	Stripe secret key	critical	—
key.slack	Slack token	critical	—
key.google	Google API key	critical	—
key.azure.storage	Azure storage account key	critical	—
key.private-key	Private key block	critical	—
key.jwt	JSON Web Token	high	—
key.connection-string	Database connection string with password	critical	—
key.env-assignment	Secret assignment (.env style)	high	—
fin.card	Payment card number	high	card
fin.iban	IBAN	high	mod97_iban
net.email	Email address	low	—
net.phone	Phone number (international format)	low	—
net.ipv4	IPv4 address	low	—
Australia · 5 rules
au.tfn	Australian Tax File Number	high	mod11_tfn
au.abn	Australian Business Number	medium	mod89_abn
au.acn	Australian Company Number	medium	acn
au.medicare	Australian Medicare number	high	medicare_au
au.bsb-account	BSB and account number	high	context
United States · 5 rules
us.ssn	US Social Security number	high	context
us.ein	US Employer Identification Number	medium	context
us.aba	US bank routing number	high	aba
us.npi	US National Provider Identifier	high	context
us.mbi	US Medicare Beneficiary Identifier	high	context
United Kingdom · 4 rules
uk.nino	UK National Insurance number	high	context
uk.nhs	UK NHS number	high	mod11_nhs
uk.utr	UK Unique Taxpayer Reference	medium	context
uk.sort-account	UK sort code and account number	high	context
European Union · 1 rule
eu.vat	EU VAT number	medium	context
New Zealand · 3 rules
nz.ird	NZ IRD number	high	mod11_ird
nz.nhi	NZ National Health Index number	high	nhi_nz
nz.bank-account	NZ bank account number	high	context

The pattern corpus.

At a glance