openvibers/openvibe.contracts .gitleaks.toml
.gitleaks.toml
| 1 | # gitleaks configuration, used by the shared security workflow |
| 2 | # (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every |
| 3 | # allowlist below is one proven false positive, matched on path AND value so nothing else is hidden. |
| 4 | [extend] |
| 5 | useDefault = true |
| 6 | |
| 7 | [[allowlists]] |
| 8 | description = "Sample Idempotency-Key value in a tools.run-request@1 fixture; an idempotency key is a caller-chosen dedupe token, not a secret" |
| 9 | condition = "AND" |
| 10 | paths = ['''^fixtures/tools\.run-request/valid/chained-job-file\.json$'''] |
| 11 | regexes = ['''^resize-01JAB2C3$'''] |
| 12 | |
| 13 | [[allowlists]] |
| 14 | description = "Sample credential in a capability-schema fixture (network.github-token-result): a made-up placeholder that shows the shape, not a real secret" |
| 15 | condition = "AND" |
| 16 | paths = ['''^fixtures/network\.github\-token\-result/invalid/unknown\-source\.json$'''] |
| 17 | regexes = ['''^(ghp_0123456789abcdefghijABCDEFGHIJ0123456789)$'''] |
| 18 | |
| 19 | [[allowlists]] |
| 20 | description = "Sample credential in a capability-schema fixture (network.github-token-result): a made-up placeholder that shows the shape, not a real secret" |
| 21 | condition = "AND" |
| 22 | paths = ['''^fixtures/network\.github\-token\-result/valid/env\.json$'''] |
| 23 | regexes = ['''^(ghp_0123456789abcdefghijABCDEFGHIJ0123456789)$'''] |
| 24 | |
| 25 | [[allowlists]] |
| 26 | description = "Sample credential in a capability-schema fixture (tips.overlay-token-result): a made-up placeholder that shows the shape, not a real secret" |
| 27 | condition = "AND" |
| 28 | paths = ['''^fixtures/tips\.overlay\-token\-result/valid/minted\.json$'''] |
| 29 | regexes = ['''^(tovl_Qm9vdHN0cmFwLXRva2VuLWZvci1kb2NzLW9ubHkxMjM)$'''] |
| 30 | |
| 31 | [[allowlists]] |
| 32 | description = "Sample credential in a capability-schema fixture (openre.stream-write-result): a made-up placeholder that shows the shape, not a real secret" |
| 33 | condition = "AND" |
| 34 | paths = ['''^fixtures/openre\.stream\-write\-result/valid/created\.json$'''] |
| 35 | regexes = ['''^(ovk_live_7fQ2x9Q2)$'''] |
| 36 | |
| 37 | [[allowlists]] |
| 38 | description = "Sample credential in a capability-schema fixture (openre.key-rotate-result): a made-up placeholder that shows the shape, not a real secret" |
| 39 | condition = "AND" |
| 40 | paths = ['''^fixtures/openre\.key\-rotate\-result/valid/grace\.json$'''] |
| 41 | regexes = ['''^(ovk_live_Zp41mm80)$'''] |
| 42 | |
| 43 | [[allowlists]] |
| 44 | description = "Sample credential in a capability-schema fixture (events.subscription-result): a made-up placeholder that shows the shape, not a real secret" |
| 45 | condition = "AND" |
| 46 | paths = ['''^fixtures/events\.subscription\-result/valid/created\.json$'''] |
| 47 | regexes = ['''^(whsec_4f1c0b8e2a9d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b)$'''] |
| 48 | |
| 49 | [[allowlists]] |
| 50 | description = "The made-up GitHub token in the network.github-token-result fixtures: ghp_ followed by the digits 0-9 in order (the github-pat rule matches part of it)" |
| 51 | condition = "AND" |
| 52 | paths = ['''^fixtures/network\.github-token-result/(valid/env|invalid/unknown-source)\.json$'''] |
| 53 | regexes = ['''^ghp_0123456789[A-Za-z0-9]*$'''] |
| 54 | |
| 55 | [[allowlists]] |
| 56 | description = "Sample realtime tickets in network.realtime-ticket-result fixtures: an empty payload and the literal signature \"signature\" (base64 c2lnbmF0dXJl), a shape example, not a token" |
| 57 | condition = "AND" |
| 58 | paths = ['''^fixtures/network\.realtime\-ticket\-result/(valid|invalid)/[a-z-]+\.json$'''] |
| 59 | regexes = ['''^eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9\.eyJ0eXAiOiJyZWFsdGltZSJ9\.c2lnbmF0dXJl$'''] |
| 60 | |
| 61 | [[allowlists]] |
| 62 | description = "Sample model_key in ai.model-list@1 fixture: a model name placeholder, not an API key" |
| 63 | condition = "AND" |
| 64 | paths = ['''^fixtures/ai\.model-list/valid/two-models\.json$'''] |
| 65 | regexes = ['''^llama_3\.1_8b_instruct$'''] |
| 66 | |
| 67 | [[allowlists]] |
| 68 | description = "Sample recipient key thumbprint in the locker fixtures: the base64url SHA-256 of made-up bytes, showing the shape of the field, not a secret" |
| 69 | condition = "AND" |
| 70 | paths = ['''^fixtures/locker\..*\.json$''', '''^fixtures/share/valid/locked\.json$'''] |
| 71 | regexes = ['''^AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8$'''] |
| 72 |