One useful idea
A leakage-shape scanner observes patterns, not whether a credential is real or whether text is safe to share. Use only invented text. The kit fixes three rules: ASCII-case api_key/token/password/secret assignment with an unquoted 8–128-character ASCII value; case-sensitive dvp_test_ plus 16–32 ASCII letters/digits; and a bounded ASCII email shape. Spaces/tabs around the assignment separator are limited to 16. This is not every token format or RFC-complete email validation.
pattern.finditer(text) yields match objects in source order. match.span(group) returns start and exclusive end; text[start:end] selects that range. For an assignment, capture and mask the value only. The regex uses negative lookaround at boundaries: (?<!\w) requires no immediately preceding word character without consuming one. Local ASCII-case flags restrict English rule names while outer Unicode boundaries prevent accidental word suffixes. Do not normalize the original text first: composition or whitespace changes would move offsets.
Collect each (start,end) once. If two rules find exactly the same span, the first declared rule supplies its reason. Different overlapping spans remain separate observations, while masking covers their union. Sort spans and return scanner_version=1, boolean flagged, integer count, matches with only start/end/reason, and redacted text. Replace each matched position with * instead of deleting it. Python offsets count Unicode code points, not UTF-8 bytes or JavaScript UTF-16 units.
Input is at most 12,000 code points; empty text is valid. Refuse non-string input, surrogates and C0 controls except newline/CR/tab. Preserve all unmatched text. password=notsecret123 is a deliberate benign positive. Quoted assignments, unsupported token shapes, Unicode emails, obfuscation and other private information can be missed. No flags is not a privacy certificate; even masked reports need human sharing review. Reports contain no raw matched values or original field, but unknown private shapes can remain.
Refresh first: Regex shape versus policy, Dictionaries and returned data.
Trace a finished example
from text_tools.core import scan_leakage
source = "海 password=abcdefgh contact editor@example.test"
report = scan_leakage(source)
print(report["count"])
print(report["redacted"])
print(len(report["redacted"]) == len(source))
print(report["matches"][0]["start"], report["matches"][0]["end"])The Unicode prefix occupies one Python code point. The assignment value starts at 11 and ends before 19; the email is a second shape. Masking keeps total code-point length and untouched separators, without printing either matched value from the report. Two observations do not prove two secrets.
The finished implementation is in text_tools/core.py. Reading it is guided practice, not independent evidence.
Predict a false positive
Does password=notsecret123 prove an actual credential leaked?
Compare your answer · self-reviewed
No. It matches a declared shape even if invented or benign. Keep the controlled reason and review context; count is observations, not verified secrets.
Find the offset bug
Why is deleting a matched email a poor replacement here?
Compare your answer · self-reviewed
Deletion shifts later offsets and destroys the declared original-string basis. Mask its positions with the same number of code points so other spans stay meaningful.
Recall input evidence
Should NFC normalization run before this original-offset scanner?
Compare your answer · self-reviewed
No. NFC can change the number of code points. Scan original text here; the corpus workflow later declares a different normalized offset basis.
Try the idea in this browser
Runs in this browser · optional preparation · local project checks remain separate
Try a small function before opening your local files. Python downloads when you choose Run; if it cannot load, your code stays here and the local kit still works. The worker executes on your device, not on a DVP server. Only run code you trust: this is not a hostile-code security sandbox.
JavaScript loads the practice controls. Python starts only after Run.
The tutor button only prepares a question locally. Review it and choose Send yourself; no code is sent merely by running or opening a lesson.
Output
Errors and check feedback
Read the browser task briefs without running Python
Guided flag leakage shapes without overclaiming
Use invented in-memory text only. Reviewed bounded-input policies, fixed patterns and vocabulary are supplied and disclosed. Write your own scan_leakage; the finished task function is not supplied. No file/export/provider operation runs and these checks are not local project or Portfolio II evidence. Implement scan_leakage in practice.py. Reviewed bounded_text and LEAK_RULES may be reused with disclosure; implement your own observation collection, equal-span priority, ordered report and union masking. Do not import the finished scanner. Return no original/raw-match field, do not delete unmatched text, and do not claim complete leakage prevention.
Independent flag leakage shapes without overclaiming
Use invented in-memory text only. Reviewed bounded-input policies, fixed patterns and vocabulary are supplied and disclosed. Write your own scan_leakage; the finished task function is not supplied. No file/export/provider operation runs and these checks are not local project or Portfolio II evidence. Implement scan_leakage in practice.py. Reviewed bounded_text and LEAK_RULES may be reused with disclosure; implement your own observation collection, equal-span priority, ordered report and union masking. Do not import the finished scanner. Return no original/raw-match field, do not delete unmatched text, and do not claim complete leakage prevention.
Change it, then build your own
One controlled change
Move the invented value after an emoji, make two rules find the same fixture-token span, then use a quoted unsupported assignment. Predict offsets/counts and explain why the missed case is not safe-to-share evidence.
Your independent task
Implement scan_leakage in practice.py. Reviewed bounded_text and LEAK_RULES may be reused with disclosure; implement your own observation collection, equal-span priority, ordered report and union masking. Do not import the finished scanner. Return no original/raw-match field, do not delete unmatched text, and do not claim complete leakage prevention.
What success looks like
The build2 tests inspect actual changed spans, original Unicode offsets, overlap/equal-span priority, inclusive text/value limits, controlled reasons and fresh ownership. Positive and negative cases are shape tests, not security certification. The supplied fixture reports count 2, 1 and 0.
Hint 1 · a question
Draw the original text with start/exclusive-end positions. Which group is the sensitive assignment value rather than its label?
Hint 2 · a concept cue
Collect controlled span/reason observations first, then mask the union in a separate pass. Equal ranges and overlapping ranges are different cases.
Hint 3 · a localized example
A list of original characters lets you replace masked slices with exactly end-start stars. Return metadata, not the captured raw value.
Need the complete worked solution?
Open text_tools/core.py from the kit. Trace it, close it, then try fresh inputs in your own files. Treat the attempt as guided; seeing the solution does not award a practical pass.
Course help is guidance, not independent evidence. With JavaScript, opening help records guidance locally; otherwise note it in your README. Reset does not erase that history.
Repair a failed check
If Unicode offsets drift, count Python characters and avoid encoding/normalizing first. If equal spans count twice, deduplicate by the span tuple with first-rule priority. If overlaps erase separators or shift length, mask positions. If raw values survive in reports, inspect both redacted text and added fields.
NotImplementedError means a practice stub is still unfinished. Read the failing test name and the last error line. Change one behavior, rerun that build, then rerun all implemented builds.
Show it works on new inputs
Create four invented changed examples: a recognized token/email, overlapping shapes, benign positive and unsupported missed shape. Show actual spans/masked output, explain the original code-point basis and remaining privacy risk, and disclose reviewed regex assistance.
Self-review: name the input, result, refused case and reason. Your local test output and explanation are separate from a quiz score; this page does not certify a pass.
Keep the idea
Explainable observations are useful only when their limits are visible. “No recognized shape” does not mean “safe to share.”