.gitleaks.toml

main 2.8 KB · 54 lines · ini

1	# gitleaks configuration, used by the shared security workflow
2	# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
3	# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
4	[extend]
5	useDefault = true
6
7	[[allowlists]]
8	description = "Sentinel provider key in the auth test that asserts secrets are never returned"
9	condition = "AND"
10	paths = ['''^test/auth\.test\.js$''']
11	regexes = ['''^sk-test-THIS-MUST-NEVER-BE-RETURNED-0123456789$''']
12
13	[[allowlists]]
14	description = "Made-up provider key in test/credentials.test.js (a person's own key is stored and used; the value is a placeholder, not a secret)"
15	condition = "AND"
16	paths = ['''^test/credentials\.test\.js$''']
17	regexes = ['''sk-test-dana-0123456789WXYZ''']
18
19	[[allowlists]]
20	description = "Made-up provider key in test/provider-responses.test.js (asserts the key never reaches a thrown error; a placeholder, not a secret)"
21	condition = "AND"
22	paths = ['''^test/provider-responses\.test\.js$''']
23	regexes = ['''^sk-resp-secret-0123456789$''']
24
25	[[allowlists]]
26	description = "Made-up provider keys in test/credentials.test.js (Codes C3: one key per provider, the AAD, the upgrade of an old row and the 'a key is never in a log line' test; placeholders, not secrets)"
27	condition = "AND"
28	paths = ['''^test/credentials\.test\.js$''']
29	regexes = ['''^sk-test-deepseek-0123456789$''', '''^sk-ant-test-0123456789FGHI$''', '''^sk-test-gus-0123456789ABCD$''', '''^sk-test-helen-0123456789JKLM$''', '''^sk-test-ivan-LEAKME-0123456789$''']
30
31	[[allowlists]]
32	description = "Made-up provider key in test/messages-api.test.js (the person's own Anthropic key on POST /v1/messages; a placeholder, not a secret)"
33	condition = "AND"
34	paths = ['''^test/messages-api\.test\.js$''']
35	regexes = ['''^sk-ant-test-person-0123456789$''']
36
37	[[allowlists]]
38	description = "Made-up provider keys in test/me-credentials.test.js (L36: the self vault, test-on-save, the AAD, and the 'a key is never in an answer' test; placeholders, not secrets)"
39	condition = "AND"
40	paths = ['''^test/me-credentials\.test\.js$''']
41	regexes = ['''sk-test-dana-0123456789WXYZ''', '''sk-ant-test-0123456789ABCD''', '''sk-test-custom-0123456789''', '''sk-test-gemini-0123456789''', '''sk-test-ivan-LEAKME-0123456789''']
42
43	[[allowlists]]
44	description = "Made-up provider key in test/account-data.test.js (L36: the account export must never carry the key; a placeholder, not a secret)"
45	condition = "AND"
46	paths = ['''^test/account-data\.test\.js$''']
47	regexes = ['''sk-self-ada-0123456789LEAK''']
48
49	[[allowlists]]
50	description = "Model id in the 2026-11-10 price-book proposal data, flagged as a generic API key by entropy (a public model name, not a secret)"
51	condition = "AND"
52	paths = ['''^scripts/pricebook-proposals-2026-11-10\.json$''']
53	regexes = ['''^llama-3\.3-70b-instruct$''']
54