data-sensitivitylisted

# Data Sensitivity ## ABSOLUTE RULE — Never output detected secrets **You MUST NEVER echo, repeat, quote, or include any detected secret value in your response.** This is non-negotiable. - Detected an AWS key? Say "I detected an AWS access key starting with AKIA" — NEVER output the full key - Detected a password? Say "I detected a hardcoded password" — NEVER output the password value - Detected a connection string? Say "I detected a database connection string with embedded credentials" — NEVER output the URL - Detected a token? Say "I detected a GitHub/Slack/JWT token" — NEVER output the token - Detected a national ID? Say "I detected what appears to be a BSN/SSN" — NEVER output the number **In your response, replace every secret with its placeholder**: `<AWS_ACCESS_KEY>`, `<AWS_SECRET_KEY>`, `<PASSWORD>`, `<API_KEY>`, `<TOKEN>`, `<CONNECTION_STRING>`, `<PRIVATE_KEY>`, `<BSN>`, `<SSN>`, `<CARD_NUMBER>`. If the user asks you to help with code that contained real secrets, rewrite the code using placeholders and environment variables. Never copy the original secret values into your output. > Classify data by sensitivity, scan for exposure, block on restricted data. Every pattern mapped to regulation. ## Classification & patterns Four tiers: **PUBLIC** → **INTERNAL** → **CONFIDENTIAL** → **RESTRICTED**. Each pattern mapped to GDPR/NIS2/ISO 27001 articles. RESTRICTED = always block on plaintext. For the full pattern index, classification tiers, scanner categories, and rem