# gitleaks configuration, used by the shared security workflow
# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
[extend]
useDefault = true

[[allowlists]]
description = "Made-up player/session tokens in unit tests (sqlite/sqliteStore.test.ts: the same token in the first commit, before the PostgreSQL move)"
condition = "AND"
paths = ['''^packages/(persistence/src/pg/pgStore|persistence/src/sqlite/sqliteStore|protocol/src/codec)\.test\.ts$''']
regexes = ['''^(tok_12345678|abcdefgh12345678)$''']

[[allowlists]]
description = "A made-up canonical subject id (usr_ + a ULID-shaped alphabet run) as a test default and as the identity field hello must ignore"
condition = "AND"
paths = ['''^(apps/server/src/game/flusher|packages/protocol/src/codec)\.test\.ts$''']
regexes = ['''^usr_01JABCDEFGHJKMNPQRSTVWXYZ0$''']