mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-12 06:06:10 +00:00
34 lines
1.4 KiB
TOML
34 lines
1.4 KiB
TOML
# Gitleaks configuration. Extends the built-in default ruleset and adds
|
|
# a project-specific allowlist for false-positives that gitleaks 8.x flags
|
|
# as "generic-api-key" inside test fixtures.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Project-wide ignores for test fixtures and known non-secret tokens"
|
|
|
|
paths = [
|
|
# All test files contain hardcoded fake tokens / idempotency-keys.
|
|
'''(^|/)__tests__/''',
|
|
'''\.test\.ts$''',
|
|
# OpenAPI spec contains example tokens (`hlk_example…`) used to document the schema.
|
|
'''^docs/api/openapi\.yaml$''',
|
|
]
|
|
|
|
# Substring matches — anything matching is treated as non-secret regardless of file.
|
|
regexes = [
|
|
# Idempotency-Key request-header values are random UUIDs / opaque strings,
|
|
# not secrets. The header name itself just trips the generic-api-key rule.
|
|
'''idempotency-key''',
|
|
# Allow the placeholder prefix used in OpenAPI examples + docs.
|
|
'''hlk_example''',
|
|
# i18n caption keys for the briefing-driven trend charts are dotted message
|
|
# keys, not secrets — one trips the generic-api-key entropy heuristic.
|
|
'''insights\.trendsRow\.caption''',
|
|
]
|
|
|
|
# Specific commit fingerprints from prior false-positive findings (kept for reproducibility).
|
|
# Empty by default; populate via `gitleaks detect --report-path` if a future regression
|
|
# triggers the same false-positive on a stable commit hash.
|
|
stopwords = []
|