diff --git a/scripts/check-secrets.sh b/scripts/check-secrets.sh
index 90299d2..8256a57 100755
--- a/scripts/check-secrets.sh
+++ b/scripts/check-secrets.sh
@@ -15,7 +15,9 @@ set -u
 mode="${1:---all}"
 
 # 允许清单：行内出现任一形态即放行（${} 注入、占位值、明显示例值）
-ALLOW='\$\{[^}]*\}|\{\{[^}]*\}\}|changeme|change[-_]me|your[-_][a-zA-Z0-9_-]+|<[a-zA-Z0-9 ,_.-]+>|placeholder|example|sample|dummy|fake|redacted|\*\*\*'
+# 注：x{3,}（xxx / xxxx…）是本项目文档描述凭证形态时的既有占位约定，
+# 放行它使「讲解规则的文档」不会被规则自身拦下（如 iteration-4/08 §漏检清单）。
+ALLOW='\$\{[^}]*\}|\{\{[^}]*\}\}|changeme|change[-_]me|your[-_][a-zA-Z0-9_-]+|<[a-zA-Z0-9 ,_.-]+>|placeholder|example|sample|dummy|fake|redacted|\*\*\*|x{3,}'
 
 # 内容扫描跳过：本脚本与 hook 自身（含规则文本，非凭证）
 SKIP_PATHS='(^|/)scripts/(check-secrets\.sh|hooks/pre-commit)$'
@@ -29,9 +31,11 @@ RULES=$(cat <<'EOF'
 AK-AWS	-	-	AKIA[0-9A-Z]{16}
 AK-QCLOUD	-	-	AKID[0-9A-Za-z]{16,}
 AK-ALIYUN	-	-	LTAI[0-9A-Za-z]{12,}
+AK-ANTHROPIC	-	-	sk-ant-[A-Za-z0-9_-]{16,}
+AK-OPENAI	-	-	sk-(proj-|svcacct-)?[A-Za-z0-9]{20,}
 MINIO-DEFAULT	i	-	minio[-_.]?admin
 PRIVATE-KEY	-	-	^[[:space:]]*-----BEGIN [A-Z ]*PRIVATE KEY-----[[:space:]]*$
-KEY-ASSIGN	i	-	(access[-_]?key(_?id)?|secret[-_]?(access[-_]?)?key)["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,}
+KEY-ASSIGN	i	-	(access[-_]?key(_?id)?|secret[-_]?(access[-_]?)?key|api[-_]?(key|secret|token)|auth[-_]?token)["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,}
 JWT-SECRET	i	-	(jwt[-_.]?secret|signing[-_]?key|token[-_]?secret|hmac[-_]?(key|secret))["']?[[:space:]]*[:=][[:space:]]*["']?[A-Za-z0-9+/=_-]{8,}
 DB-PASSWORD	i	\.(ya?ml|properties|toml|conf|ini)(\.sample|\.example)?$	(password|passwd|pwd)["']?[[:space:]]*[:=][[:space:]]*["']?[^[:space:]"'$]{6,}
 EOF