Risk Signals Reference

Noxys categorizes sensitive data into Risk Signals. This page provides the exhaustive technical reference for all 32+ supported recognizers across Tier 1 (Deterministic Regex) and Tier 2 (NER/Heuristics).

Tier 1: Deterministic Recognizers (Local)

These patterns run entirely in the browser extension or endpoint agent with <10ms latency. They are 100% private.

1.1 Global / Universal Identifiers

ID	Label	Description	Severity
email	Email address	RFC 5322 compliant email patterns.	Low
bank-card	Bank card number	Visa, MC, Amex, etc. (Validated via Luhn algorithm).	Critical
ipv4	IPv4 address	Dotted-decimal network identifiers.	Low
ipv6	IPv6 address	Hexadecimal network identifiers.	Low

1.2 France (FR)

ID	Label	Description	Severity
nir-fr	French NIR	Social Security (Numéro d'Inscription au Répertoire).	Critical
siren-fr	French SIREN	Company identification (9 digits).	Medium
siret-fr	French SIRET	Business establishment ID (14 digits).	Medium
iban-fr	French IBAN	International Bank Account Number (FR).	High
phone-fr	French Phone	Metropolitan and DOM-TOM formats.	Low
postal-code-fr	French Postal	5-digit department-aware codes.	Low

1.3 Germany (DE)

ID	Label	Description	Severity
steuer-id-de	German Steuer-ID	Personal tax identification (11 digits).	Critical
ust-id-de	German USt-IdNr	Value Added Tax (VAT) ID (DE + 9 digits).	Medium
iban-de	German IBAN	International Bank Account Number (DE).	High
phone-de	German Phone	Landline and mobile German formats.	Low

1.4 Italy (IT)

ID	Label	Description	Severity
codice-fiscale-it	Italian Tax Code	Alphanumeric personal identifier (16 chars).	Critical
piva-it	Italian Partita IVA	Italian VAT number (11 digits).	Medium
iban-it	Italian IBAN	International Bank Account Number (IT).	High

---

Tier 2: Probabilistic & Deep Recognizers

These recognizers use Named Entity Recognition (NER), Heuristics, or specialized pattern matching (Presidio / Noxys Forge).

2.1 Credentials & Secrets

ID	Label	Description	Severity
api_key_aws	AWS Access Key	AWS Access Key ID and Secret Access Key patterns.	Critical
jwt_token	JWT Token	JSON Web Tokens (base64 encoded authentication).	Critical
password	Password Pattern	Common password cleartext markers and entropy-based detection.	Critical
private_key	Private Key (PEM)	RSA, SSH, and Elliptic Curve private keys.	Critical
connection_string	DB Connection	Database URI formats (Mongo, Postgres, MySQL).	Critical

2.2 Corporate & IP

ID	Label	Description	Severity
code_proprietary	Source Code	Detection of internal architectural patterns and headers.	High
contract_nda	Legal Contracts	Clauses and language specific to NDAs and MSAs.	High
salary_data	Financial Payroll	Patterns associated with individual compensation.	High
project_codename	Internal Projects	Configurable list of organization project names.	Medium

2.3 Health & Medical (EU)

ID	Label	Description	Severity
medical_term	Medical Context	Diagnosis codes (ICD-10/11) and treatment language.	High
carte_vitale	FR Health Card	French health insurance identifier.	Critical

---

Verification & Testing

Every Risk Signal listed above is covered by our Automated Verification Suite.

Test Suite Details

• Location: noxys-extension/src/classifier/patterns/*.test.ts
• Scope: 450+ unit tests covering valid, invalid, and edge cases.
• Coverage: 100% of Tier 1 and Tier 2 recognizers.

Run Verification Locally

To run the full detection verification suite:

cd noxys-extension
npm test -- patterns

Add a New Recognizer

1. Define the pattern in src/regex/catalog/.
2. Add the corresponding test file in src/classifier/patterns/.
3. Update the global registry in src/regex/catalog/index.ts.