/**
 * Benign security conventions — the ONE source of truth for "this looks like a
 * secret / a committed env file, but it is a near-universal INTENTIONAL
 * convention, not a finding." Every secret / env-in-git detector consults these
 * predicates so the false-positive floor is fixed in one place, not
 * re-litigated per scanner or per language pack.
 *
 * Why this exists (round-3 dogfood, template repos): a `.env.example` is not a
 * leaked `.env`; `password: 'password'` in a seed script and `apiKey =
 * 'your-api-key'` in demo content are not credentials. Left unmodeled, every
 * template-based repo starts its baseline with the same handful of false
 * positives, and every new secret pattern a language pack adds re-introduces
 * them. Centralizing the conventions means a new pack's patterns inherit the
 * exemptions automatically.
 *
 * Design bias: minimize FALSE NEGATIVES. A predicate only returns true for a
 * value/path that is UNAMBIGUOUSLY a placeholder or example convention — never
 * a broad substring match that could swallow a real credential.
 */
/**
 * Is this an EXAMPLE / template env file (a committed convention), as opposed to
 * a real `.env` / `.env.production` that leaks secrets? Matches a basename that
 * is `env` / `.env` followed by an example marker segment
 * (`.env.example`, `.env.local.sample`, …). A bare `.env` or `.env.production`
 * returns false — those genuinely should count.
 */
export declare function isExampleEnvFile(path: string): boolean;
/**
 * Does a captured secret VALUE look like an obvious placeholder / demo literal
 * rather than a real credential? True only for values that are unambiguously
 * fake: an exact placeholder token, a bracketed placeholder (`<your-key>`,
 * `${VAR}`, `{{VAR}}`, `%VAR%`), a `your-…` / `…-here` template, or a run of one
 * repeated character (`xxxxx`, `*****`, `00000`). Deliberately narrow to avoid
 * suppressing a real secret that merely contains a common word.
 */
export declare function isPlaceholderSecret(value: string): boolean;
//# sourceMappingURL=benign.d.ts.map