[Sensitive Information] US Passport Number

docs/supported_inventory_types.md

@@ -216,10 +216,11 @@ See the docs on [how to add a new Extractor](/docs/new_extractor.md).
 | HTTP CSRF Token                             | `secrets/csrftoken`                    |
 
 ### Sensitive information
-| Type                                        | Extractor Plugin                     |
-| ------------------------------------------- | ------------------------------------ |
-| International Bank Account Number           | `sensitiveinformation/iban`            |
-| US Social Security Number                   | `sensitiveinformation/ssn`             |
+| Type                                        | Extractor Plugin                         |
+| ------------------------------------------- | ---------------------------------------- |
+| International Bank Account Number           | `sensitiveinformation/iban`              |
+| US Passport Numbers                         | `sensitiveinformation/uspassportnumber`  |
+| US Social Security Number                   | `sensitiveinformation/ssn`               |
 
 ### Container inventory
 

extractor/filesystem/list/list.go

@@ -186,6 +186,7 @@ import (
 	"github.com/google/osv-scalibr/veles/secrets/vapid"
 	"github.com/google/osv-scalibr/veles/sensitiveinformation/iban"
 	"github.com/google/osv-scalibr/veles/sensitiveinformation/ssn"
+	"github.com/google/osv-scalibr/veles/sensitiveinformation/uspassportnumber"
 
 	cpb "github.com/google/osv-scalibr/binary/proto/config_go_proto"
 )
@@ -459,6 +460,7 @@ var (
 	SensitiveInformationDetectors = initMapFromVelesPlugins([]velesPlugin{
 		{iban.NewDetector(), "sensitiveinformation/iban", 0},
 		{ssn.NewDetector(), "sensitiveinformation/ssn", 0},
+		{uspassportnumber.NewDetector(), "sensitiveinformation/uspassportnumber", 0},
 	})
 
 	// Secrets contains both secret extractors and detectors.

veles/sensitiveinformation/uspassportnumber/detector.go

@@ -0,0 +1,68 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package uspassportnumber implements logic for detecting US passport numbers
+package uspassportnumber
+
+import (
+	"bytes"
+	"regexp"
+
+	"github.com/google/osv-scalibr/veles"
+	"github.com/google/osv-scalibr/veles/sensitiveinformation"
+	"github.com/google/osv-scalibr/veles/sensitiveinformation/common/simpleregex"
+)
+
+const (
+	maxPassportNumberLen = 9
+	maxKeywordLen        = 20
+	contextWindowSize    = 32
+)
+
+var (
+	keywordsRe = simpleregex.KeywordsRe([]string{
+		`pass`,
+		`passport`,
+		`travel`,
+		`doc`,
+		`document`,
+	})
+	passportNumberRe = regexp.MustCompile(`\b[A-Za-z][0-9]{8}\b`)
+)
+
+// NewDetector returns a Detector, that finds US Passport Numbers
+func NewDetector() veles.Detector {
+	return simpleregex.Detector{
+		MaxLen:              max(maxKeywordLen, maxPassportNumberLen),
+		Re:                  passportNumberRe,
+		KeywordsRe:          keywordsRe,
+		ContextWindowBefore: contextWindowSize,
+		ContextWindowAfter:  contextWindowSize,
+		FromMatch: func(blob []byte, keywordMatch bool) (sensitiveinformation.SensitiveInformation, bool) {
+			likelihood := sensitiveinformation.LikelihoodUnlikely
+			if keywordMatch {
+				likelihood = sensitiveinformation.LikelihoodLikely
+			}
+
+			return sensitiveinformation.SensitiveInformation{
+				InfoType: sensitiveinformation.InfoType{
+					Name:        "US_PASSPORT_NUMBER",
+					Sensitivity: sensitiveinformation.SensitivityLevelHigh,
+				},
+				Likelihood: likelihood,
+				Raw:        bytes.Clone(blob),
+			}, true
+		},
+	}
+}