<!-- https://avertgate.com/docs/egress · Inspectors -->

# Egress (outbound scan)

The egress scanner checks the arguments the agent *sends* to a tool for secrets and personal data. It is fast, deterministic and local.

## Secret patterns

| Type | Example prefix |
| --- | --- |
| Generic API key | `sk-…` (16+ chars) |
| Stripe | `sk_live_`, `sk_test_`, `rk_live_` |
| AWS access key | `AKIA…` |
| GitHub | `ghp_`, `gho_`, `ghs_` |
| Slack | `xoxb-`, `xoxp-` |
| Assignment form | `api_key=…`, `secret: …`, `password=…` |

## Personal data (PII)

- US SSN (`123-45-6789` and the labelled form)
- Credit card numbers
- Bulk email addresses (5+ in a row)
- US phone numbers

## Evasion attempts

Secrets split by spacing letters apart (*"s k - 1 2 3 …"*) are also searched in a compacted copy. The credit-card check uses a ReDoS-resistant approach.

## Slow exfiltration (drip)

Each call may look small and innocent on its own. AvertGate counts egress hits per session; when the counter reaches **3** the session is ESCALATEd (`ruleId: drip-exfiltration`). In cluster mode the counter is shared across nodes.

## Turning it off

<!-- policy.yaml -->
```yaml
- name: "read_public_docs"
  allow: true
  egress_scan: false   # disable scanning for this tool only
```

> **Tip**: By default *all* allowed tools are scanned, so unlisted argument fields cannot become an exfiltration channel.