.gitleaks.toml

main 1.2 KB · 30 lines · ini

1	# gitleaks configuration, used by the shared security workflow
2	# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
3	# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
4	[extend]
5	useDefault = true
6
7	[[allowlists]]
8	description = "A made-up Stripe secret in the site-config test that proves a secret never leaves the admin API (real keys are longer and mixed-case)"
9	condition = "AND"
10	paths = ['''^test/site-config\.test\.js$''']
11	regexes = ['''^sk_live_[a-z]{10}$''']
12
13	[[allowlists]]
14	description = "Placeholder JWT and API tokens in the API documentation"
15	condition = "AND"
16	paths = ['''^docs/api-tokens\.md$''']
17	regexes = ['''^YOUR_JWT$''', '''^hbt_YOUR_TOKEN_HERE$''', '''^hbt_a1b2c3d4e5f6\.\.\.$''']
18
19	[[allowlists]]
20	description = "Stream key in the initial Cozmo bridge example, rotated on 2026-09-23; the current file has a placeholder"
21	condition = "AND"
22	paths = ['''^control-bridge-example-cozmo\.py$''']
23	commits = ["ac0d6a47f8d4e7f86bb2a9323bd7d3047da9c821"]
24
25	[[allowlists]]
26	description = "RFC 6455 sample WebSocket key in the drill-mode test"
27	condition = "AND"
28	paths = ['''^test/drill-mode\.test\.js$''']
29	regexes = ['''^dGhlIHNhbXBsZSBub25jZQ==$''']
30