Admin guide

Admin guide

Everything in Settings (the gear icon) decides what Exposift looks for in the text of a document and how it is weighed. This guide explains each screen and how the pieces fit together.

Inspect a file →

01How the pieces fit

When Exposift reads the text of a document it works in two layers:

1. Built-in checks (email, phone, checksummed ID numbers, IBAN, cards, IP addresses, secrets). They run first and win when they find the same text as a rule.
2. Masking rules. Each rule recognizes one kind of value and belongs to a category. The scan mapping then turns a category (or a single rule) into a scan type, and the scan type sets the exposure class and severity you see on a finding.

Rule: "Internal host name"
Category: Hostname
Scan type: Host or domain name

Finding: Host or domain name
Class: Contextual Oversharing
Severity: Medium

02Rules

Each rule defines how one kind of data is recognized. You can edit, disable or reset built-in rules and add your own.

• Search and filters: by name, description, pattern or key; by category, type and state (enabled, disabled, custom, built-in, broken).
• Priority: when two rules match the same text the one with the higher priority wins.
• Mode: some rules apply only to logs or only to scripts; "auto" guesses from the line structure.
• Scan type (in the rule editor): what a match of this rule becomes in a document scan. "Follow the category" uses the category setting.
• Live test: type a sample in the editor and see what the rule matches before saving.
• Bulk actions: tick several rules and enable or disable them together.

03Custom dictionary

Some things cannot be recognized by a pattern: your server names, project code names, customer names. Add them here, one per line. They are matched as whole words and without regard to case, in every document.

04Categories and tokens

Categories group rules (Password, Key / Token, Hostname, Person, E-mail, Phone and so on). For each category you can set:

• Token prefix and colour, used when text is masked for Ask AI.
• Propagation: a value found through context (for example user=john) is also masked elsewhere in the text without context.
• Placeholder template: the shape of the masked value. Variables: {CAT} prefix, {cat} lowercase prefix, {n} sequence number, {hash}, {len}, {stars}.

john.doe@example.com  →  john.doe@example.com

<EMAIL_1>  ←  john.doe@example.com

05Scan mapping

This table decides what each match becomes when a document is scanned.

• Use in document scans: switch a whole category off if you do not want it to produce findings.
• Scan type: the type a category becomes. The right-hand column shows the resulting class and severity.
• Rules with their own scan type: a single rule can override its category. Remove the override to follow the category again.
• Field labels: documents often print a label next to a value ("Full name", "Mailing address", "API token"). One line per scan type: the type, a colon, then the labels separated by commas. The value after the label, or in the next table cell, becomes that scan type.
• Try it: paste a few lines and see what would be found and how it would be classed.

06Lists and exceptions

Lists that control how the engine recognizes and excludes values. They apply to all rules as soon as they are saved. One entry per line; leave a list empty to use the built-in defaults. Use reset to default on a single list to undo your edits.

07General settings

08AI connections

Ask AI uses OpenAI-compatible endpoints. Add a connection with its address, key and models; the models of enabled connections appear in the Ask AI model list.

• Connections and keys are stored on the server, in data/settings.json, and can be changed only from this computer.
• After saving, a key is never sent back to the browser; only its last four characters are shown as a hint. Leave the key field empty when editing to keep the current key.
• Only the masked text is ever sent to a model. You see exactly what it will receive before you send.
• Use Test on a connection to check the address and key before relying on it.

09Backup and restore

• Export downloads all rules, categories and settings as one JSON file.
• Import reads such a file. Built-in rules are matched by their key and updated; custom rules are added. You can delete the existing custom rules first.
• Add missing defaults adds built-in rules introduced in a newer version. Reset built-ins returns every built-in rule and category to its original state; your own rules are kept.
• Change log lists rule, category and settings changes.

10Password and security

The settings are protected by an admin password.

• First use: the first time you open Settings you are asked to set a password (at least 8 characters). Until then nobody can use the settings.
• Sign in with that password; Sign out is under the settings menu. The session ends by itself after the timeout you choose in Security (default 60 minutes).
• Five wrong attempts lock sign-in for five minutes.
• Change the password in Security: enter the current one and the new one twice.
• Settings can be opened only from this computer; from another device the page just says so.

11Good practice

• Change one thing at a time, then test with a real sample from the Try it box.
• Prefer the custom dictionary for names and the rule editor for patterns.
• Switch off noisy categories in the scan mapping before deleting rules; it is easy to undo.
• Keep a recent export. It is the only copy of your custom rules.
• Detections are indications, not verdicts: tune the rules to reduce noise, and still review what Exposift lists.