Repository navigation
Expand file tree
/
Copy path.gitleaks.toml
More file actions
59 lines (57 loc) · 2.46 KB
/
Copy path.gitleaks.toml
File metadata and controls
59 lines (57 loc) · 2.46 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
title = "zeph gitleaks config"
# Extend gitleaks' built-in ruleset instead of replacing it, so all default
# detectors (generic-api-key, jwt, curl-auth-user, curl-auth-header,
# stripe-access-token, etc.) keep running; only the allowlist below is added.
[extend]
useDefault = true
# Known-benign dummy secrets used in test fixtures, doctests, and
# documentation examples across the codebase (issues #6056, #6081).
# Every entry here was verified via a real `gitleaks detect` run to
# resolve to a fake/example value, never a live credential. Matching on
# the literal dummy string (not just file path) also suppresses future
# test fixtures that reuse the same established dummy pattern — see the
# convention note in SECURITY.md.
[[allowlists]]
description = "Test-fixture and documentation dummy secrets"
regexTarget = "match"
regexes = [
'''sk-abc123secret''',
'''sk-abc123def456''',
'''sk-abc123def''',
'''sk-abc123xyz''',
'''sk-test-abc123def456''',
'''AKIA1234567890ABCDEF''',
'''AIzaSyA1234567890abcdefghijklmnop''',
'''sk_live_abcdef123456''',
'''sk-REDACTMEAKIA1234567890abcdef''',
'''tg-injected-789''',
'''mysecret12345678''',
'''supersecretvalue1''',
'''admin:secret''',
'''eyJhbGciOiJub25lIn0\.eyJzdWIiOiJ1c2VyIn0\.''',
'''eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9\.eyJzdWIiOiJ1c2VyMTIzIn0\.SflKxwRJSMeKKF2''',
'''eyJhbGciOi\.\.\.''',
'''ZEPH_A2A_IBCT_KEY''',
'''VAULT_A2A_IBCT_KEY_1''',
# #6865: dummy glued-prefix redaction fixtures in zeph-common secrets tests.
'''glpat-[aA][bB]_cd-efghijklmnopqr''',
# #6592 follow-up: fake PEM private-key bodies used across the new PEM-detector unit
# tests in zeph-common, zeph-sanitizer, zeph-subagent, zeph-core, and zeph-memory. Every
# value below is a truncated, non-functional fixture (verified via `gitleaks detect`), not
# a real key — matched on the fake body content itself, never the bare marker text alone,
# so a genuine future PEM key sharing the same header/footer line is still caught.
'''MIIBVQIBADANBgkqhkiG9w0B''',
'''AQEFAASCAT8wggE7AgEAAkEA''',
'''firstbody''',
'''body-material''',
'''\{key_body\}''',
'''\{cjk_body\}''',
'''\{huge_body\}''',
'''base64body''',
'''with no matching end marker''',
'''EC PRIVATE KEY-----\\nsecond''',
# #6891/#6892: dummy token fixtures in secret-scrub tests (zeph-common, zeph-context, zeph-agent-context).
'''xapp-1-A0123456789-1234567890123-abcdef''',
'''rk_(live|test)_51H8abcDEFghiJKLmnoPQRstu''',
'''sk-proj-abc123def456''',
]