mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André BombeckandClaude Opus 4.7
6e2f9185a8
Gitleaks 8.x flags the literal string "idempotency-key" (header name) and any quoted "token: …" inside test fixtures as generic-api-keys. Both are non-secrets — header name + opaque test-only UUIDs / placeholder "hlk_example_…" tokens used in route tests and the OpenAPI spec. Adds a `.gitleaks.toml` extending the default ruleset with: - path allowlist for `**/__tests__/**` and `*.test.ts` - path allowlist for `docs/api/openapi.yaml` - substring allowlist for `idempotency-key` and `hlk_example` No real secret bypass: the existing `hlk_<64-hex>` regex still triggers on any non-`hlk_example` prefix, so a real token leak would still fail the scan. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
31 lines
1.2 KiB
TOML
31 lines
1.2 KiB
TOML
# Gitleaks configuration. Extends the built-in default ruleset and adds
|
|
# a project-specific allowlist for false-positives that gitleaks 8.x flags
|
|
# as "generic-api-key" inside test fixtures.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Project-wide ignores for test fixtures and known non-secret tokens"
|
|
|
|
paths = [
|
|
# All test files contain hardcoded fake tokens / idempotency-keys.
|
|
'''(^|/)__tests__/''',
|
|
'''\.test\.ts$''',
|
|
# OpenAPI spec contains example tokens (`hlk_example…`) used to document the schema.
|
|
'''^docs/api/openapi\.yaml$''',
|
|
]
|
|
|
|
# Substring matches — anything matching is treated as non-secret regardless of file.
|
|
regexes = [
|
|
# Idempotency-Key request-header values are random UUIDs / opaque strings,
|
|
# not secrets. The header name itself just trips the generic-api-key rule.
|
|
'''idempotency-key''',
|
|
# Allow the placeholder prefix used in OpenAPI examples + docs.
|
|
'''hlk_example''',
|
|
]
|
|
|
|
# Specific commit fingerprints from prior false-positive findings (kept for reproducibility).
|
|
# Empty by default; populate via `gitleaks detect --report-path` if a future regression
|
|
# triggers the same false-positive on a stable commit hash.
|
|
stopwords = []
|