# DLP Detection Test Fixtures

Synthetic HTML pages for testing DLP (Data Loss Prevention) detection coverage.
**All names, addresses, phone numbers, emails, ID numbers, card numbers, and
API keys/secrets are randomly generated and fake.** They are not associated
with real people, businesses, or active credentials. Card numbers, SSNs, and
NPIs pass their real checksum/format algorithms (Luhn, etc.) so format-aware
detectors can be exercised properly; API keys match each vendor's real prefix
and length conventions but are random strings, not live keys.

## Structure

### batch1_context/ (17 pages)
One realistic, in-context page per data category, each modeled as a real
internal tool or customer-facing screen rather than a bare label/value div:

| File | Category |
|---|---|
| 01_pii_customer_profile.html | PII — CRM customer 360 view |
| 02_phi_hospital_discharge.html | PHI — hospital discharge summary |
| 03_pci_checkout.html | PCI — e-commerce checkout/order confirmation |
| 04_ssn_tax_onboarding.html | SSN — HR/payroll tax withholding form |
| 05_secret_aws_devops_wiki.html | AWS access key/secret — internal runbook |
| 06_secret_gcp_config.html | GCP API key — service setup docs |
| 07_secret_azure_portal.html | Azure storage account key — portal screen |
| 08_secret_github_repo_settings.html | GitHub PAT — pull request comment |
| 09_secret_gitlab_ci.html | GitLab PAT + Twilio/SendGrid/Mailgun — CI/CD variables |
| 10_secret_stripe_dashboard.html | Stripe secret/publishable key — dashboard |
| 11_secret_twilio_console.html | Twilio SID/Auth Token — console screenshot |
| 12_secret_sendgrid_settings.html | SendGrid API key — settings page |
| 13_secret_npm_publish.html | npm token — internal publish guide |
| 14_secret_mailgun_dashboard.html | Mailgun API key — support ticket log |
| 15_custom_dict_internal_wiki.html | Custom dictionary — project codenames/customers/internal URLs |
| 16_shadowai_personal_chat.html | Shadow AI — personal GenAI account, corporate data pasted in |
| 17_source_code_repo_viewer.html | Source code — proprietary pricing engine snippet |

### batch2_messy_dom/ (24 pages)
PII / PHI / ID-focused pages, each deliberately using a **different**
real-world "messy DOM" pattern so label→value association can't be solved
by simple parent/child or sibling proximity. Techniques used:

| File | DOM-messiness technique |
|---|---|
| 01_dmv_license_renewal.html | Nested tables, rowspan/colspan splitting label from value |
| 02_voter_registration_lookup.html | CSS Grid `order` scrambles visual vs. DOM order |
| 03_background_check_report.html | PDF-to-HTML export style: absolutely positioned spans, no semantic nesting |
| 04_bank_kyc_review.html | Data lives in a `<script type="application/json">` blob, rendered into unrelated containers by JS |
| 05_ats_job_application.html | Deeply nested React/styled-components-style wrapper divs with hashed class names |
| 06_hotel_checkin_registration.html | Word/Excel-exported HTML (MSO junk, `<font>` tags) |
| 07_airline_pnr_confirmation.html | Flexbox `row-reverse`/`column-reverse` reorders DOM vs. visual reading order |
| 08_utility_bill_statement.html | Table header and data row separated by several unrelated decorative rows |
| 09_phi_radiology_report.html | Values live only in `title`/`aria-label`/`data-*` attributes, not text nodes |
| 10_phi_lab_results.html | Patient identity in a `position:fixed` sidebar with no common DOM ancestor but `<body>` |
| 11_phi_pharmacy_label.html | Absolute-positioned print/label-printer style layout |
| 12_phi_insurance_eob.html | CSS multi-column (`column-count`) reflow — visual order ≠ source order |
| 13_phi_patient_intake_form.html | Custom elements + `<template>` cloned into shadow roots by JS |
| 14_phi_dental_chart.html | Data as SVG `<text>` nodes and `<title>` tooltips inside an odontogram |
| 15_phi_telehealth_visit_summary.html | PHI embedded unlabeled inside chat-transcript bubbles |
| 16_passport_application_status.html | Real values sit in `data-*` attributes of a stepper; visible text is generic |
| 17_hr_employee_directory_profile.html | Values rendered via CSS `content: attr()` — absent from `textContent` |
| 18_county_property_deed_record.html | Legacy 4-level nested tables, `<font>`/`<center>`, label/value split |
| 19_court_records_case_lookup.html | `<dl>` with multiple `<dt>`s then multiple `<dd>`s (non 1:1 pairing) |
| 20_immigration_visa_status.html | Content declared in a hidden pool, re-parented into visible mount via JS (portal pattern) |
| 21_credit_report_snippet.html | Transposed table (bureaus as columns, attributes as rows) with section-spanning header |
| 22_apartment_lease_application.html | Accordion sections — PII sits in a `max-height:0` collapsed panel |
| 23_gym_membership_signup.html | Framework hydration JSON (`__APP_DATA__`) rendered into placeholders client-side |
| 24_school_enrollment_form.html | Multi-step wizard; `label[for]` references fields in a different, hidden step |

## Notes for test setup
- Static-HTML-only scanners will miss the values in files 04, 09 (partially), 13,
  16, 17, 20, and 23 from batch2 unless they also evaluate rendered/hydrated DOM
  or computed CSS content — these are intentionally the "hard mode" cases.
- Files reuse a shared pool of synthetic identities across pages (by design),
  so the same fake person may appear in more than one document, similar to how
  real customer/employee data recurs across systems.