# Gitleaks configuration. Extends the built-in default ruleset and adds
# a project-specific allowlist for false-positives that gitleaks 8.x flags
# as "generic-api-key" inside test fixtures.
[extend]
useDefault = true

[allowlist]
description = "Project-wide ignores for test fixtures and known non-secret tokens"

paths = [
  # All test files contain hardcoded fake tokens / idempotency-keys.
  '''(^|/)__tests__/''',
  '''\.test\.ts$''',
  # Golden copies of the backup file written by the parity test: synthetic
  # fixture values, and every `…Encrypted` value already opened to its text.
  '''^tests/integration/__golden__/''',
  # OpenAPI spec contains example tokens (`hlk_example…`) used to document the schema.
  '''^docs/api/openapi\.yaml$''',
]

# Substring matches — anything matching is treated as non-secret regardless of file.
regexes = [
  # Idempotency-Key request-header values are random UUIDs / opaque strings,
  # not secrets. The header name itself just trips the generic-api-key rule.
  '''idempotency-key''',
  # Allow the placeholder prefix used in OpenAPI examples + docs.
  '''hlk_example''',
  # i18n caption keys for the briefing-driven trend charts are dotted message
  # keys, not secrets — one trips the generic-api-key entropy heuristic.
  '''insights\.trendsRow\.caption''',
  # Coach cadence-suggestion label keys are dotted message keys, not secrets;
  # one trips the generic-api-key entropy heuristic.
  '''coach\.reminderSuggestion\.cadence''',
  # Level-A mood dimension label and anchor keys are dotted message keys, not
  # secrets; they sit on fields named `labelKey` / `lowAnchorKey`, and the
  # generic-api-key rule reads any `*Key: "<high-entropy string>"` as a token.
  '''mood\.dimension\.''',
]

# Specific commit fingerprints from prior false-positive findings (kept for reproducibility).
# Empty by default; populate via `gitleaks detect --report-path` if a future regression
# triggers the same false-positive on a stable commit hash.
stopwords = []