# gitleaks configuration, used by the shared security workflow
# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
[extend]
useDefault = true

[[allowlists]]
description = "Sentinel provider key in the auth test that asserts secrets are never returned"
condition = "AND"
paths = ['''^test/auth\.test\.js$''']
regexes = ['''^sk-test-THIS-MUST-NEVER-BE-RETURNED-0123456789$''']

[[allowlists]]
description = "Made-up provider key in test/credentials.test.js (a person's own key is stored and used; the value is a placeholder, not a secret)"
condition = "AND"
paths = ['''^test/credentials\.test\.js$''']
regexes = ['''sk-test-dana-0123456789WXYZ''']

[[allowlists]]
description = "Made-up provider key in test/provider-responses.test.js (asserts the key never reaches a thrown error; a placeholder, not a secret)"
condition = "AND"
paths = ['''^test/provider-responses\.test\.js$''']
regexes = ['''^sk-resp-secret-0123456789$''']

[[allowlists]]
description = "Made-up provider keys in test/credentials.test.js (Codes C3: one key per provider, the AAD, the upgrade of an old row and the 'a key is never in a log line' test; placeholders, not secrets)"
condition = "AND"
paths = ['''^test/credentials\.test\.js$''']
regexes = ['''^sk-test-deepseek-0123456789$''', '''^sk-ant-test-0123456789FGHI$''', '''^sk-test-gus-0123456789ABCD$''', '''^sk-test-helen-0123456789JKLM$''', '''^sk-test-ivan-LEAKME-0123456789$''']

[[allowlists]]
description = "Made-up provider key in test/messages-api.test.js (the person's own Anthropic key on POST /v1/messages; a placeholder, not a secret)"
condition = "AND"
paths = ['''^test/messages-api\.test\.js$''']
regexes = ['''^sk-ant-test-person-0123456789$''']

[[allowlists]]
description = "Made-up provider keys in test/me-credentials.test.js (L36: the self vault, test-on-save, the AAD, and the 'a key is never in an answer' test; placeholders, not secrets)"
condition = "AND"
paths = ['''^test/me-credentials\.test\.js$''']
regexes = ['''sk-test-dana-0123456789WXYZ''', '''sk-ant-test-0123456789ABCD''', '''sk-test-custom-0123456789''', '''sk-test-gemini-0123456789''', '''sk-test-ivan-LEAKME-0123456789''']

[[allowlists]]
description = "Made-up provider key in test/account-data.test.js (L36: the account export must never carry the key; a placeholder, not a secret)"
condition = "AND"
paths = ['''^test/account-data\.test\.js$''']
regexes = ['''sk-self-ada-0123456789LEAK''']

[[allowlists]]
description = "Model id in the 2026-11-10 price-book proposal data, flagged as a generic API key by entropy (a public model name, not a secret)"
condition = "AND"
paths = ['''^scripts/pricebook-proposals-2026-11-10\.json$''']
regexes = ['''^llama-3\.3-70b-instruct$''']