fix: match Anthropic tokens before generic sk pattern

CHANGELOG.md

@@ -8,6 +8,7 @@ This project has a published GitHub Release line, but no stable support or API g
 
 ### Fixed
 
+- Fixed secret redaction pattern order so Anthropic-style `sk-ant-` keys match the specific Anthropic pattern before the generic `sk-` pattern.
 - Tightened governance regex coverage for review/CI bypass, unsafe command guidance, and runtime network or LLM dependency findings.
 - Expanded secret-like token redaction coverage.
 - Added context-aware governance finding suppression so nearby negative guidance can avoid false positives.

src/agent_rules_kit/redaction.py

@@ -18,14 +18,14 @@ class RedactionPattern:
 
 
 SECRET_LIKE_PATTERNS: tuple[RedactionPattern, ...] = (
-    RedactionPattern(
-        name="openai_api_key",
-        pattern=re.compile(r"sk-[A-Za-z0-9_-]{12,}"),
-    ),
     RedactionPattern(
         name="anthropic_api_key",
         pattern=re.compile(r"sk-ant-[A-Za-z0-9_-]{12,}"),
     ),
+    RedactionPattern(
+        name="openai_api_key",
+        pattern=re.compile(r"sk-[A-Za-z0-9_-]{12,}"),
+    ),
     RedactionPattern(
         name="jwt_token",
         pattern=re.compile(r"eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}"),

tests/test_diagnostic_fixtures.py

@@ -33,6 +33,7 @@
 
 DISALLOWED_SECRET_MARKERS = (
     "sk-",
+    "sk-ant-",
     "ghp_",
     "AKIA",
     "-----BEGIN",

tests/test_redaction.py

@@ -2,7 +2,11 @@
 
 import unittest
 
-from agent_rules_kit.redaction import REDACTION_TEXT, redact_secret_like_values
+from agent_rules_kit.redaction import (
+    REDACTION_TEXT,
+    SECRET_LIKE_PATTERNS,
+    redact_secret_like_values,
+)
 
 
 class RedactionTests(unittest.TestCase):
@@ -27,6 +31,15 @@ def test_redacts_anthropic_like_key(self) -> None:
         self.assertEqual(redacted, f"anthropic={REDACTION_TEXT}")
         self.assertNotIn(secret, redacted)
 
+    def test_anthropic_like_key_matches_specific_pattern_before_generic_sk_pattern(self) -> None:
+        secret = "sk-ant-api03-" + ("I" * 36)
+
+        first_matching_pattern = next(
+            item for item in SECRET_LIKE_PATTERNS if item.pattern.search(secret)
+        )
+
+        self.assertEqual(first_matching_pattern.name, "anthropic_api_key")
+
     def test_redacts_jwt_like_token(self) -> None:
         secret = "eyJ" + ("A" * 20) + "." + ("B" * 20) + "." + ("C" * 20)