Single source of truth for sensitive key definitions.

Every key that must be encrypted in credential storage, redacted from logs, or both is defined as a triple in the canonical registry. The credential and redaction modules derive their match lists from this module rather than maintaining separate, driftable lists.

Triple Fields

Each entry is {canonical_name, category, handling}:

• canonical_name -- Erlang atom in snake_case (e.g., :api_key).
• category -- Classification: :credential, :auth, :session, or :oauth.
• handling -- Protection level:
  • :encrypt_and_redact -- Encrypted at rest AND redacted from logs.
  • :redact_only -- Redacted from logs only (not stored in credentials).

Examples

# Get all 18 sensitive key definitions
BeamAgent.SensitiveKeys.all()

# Check if a key is sensitive (any format)
BeamAgent.SensitiveKeys.is_sensitive(:api_key)       # true
BeamAgent.SensitiveKeys.is_sensitive("apiKey")        # true
BeamAgent.SensitiveKeys.is_sensitive("username")      # false

Delegates to :beam_agent_redaction (Erlang).