.gitleaks.toml

main 1.2 KB · 24 lines · ini

1	# gitleaks configuration, used by the shared security workflow
2	# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
3	# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
4	[extend]
5	useDefault = true
6
7	[[allowlists]]
8	description = "The public web-push test vector (subscription auth secret from the web-push examples) used by the SSRF suite"
9	condition = "AND"
10	paths = ['''^test/security-ssrf\.test\.js$''']
11	regexes = ['''^tBHItJI5svbpez7KI4CCXg$''']
12
13	[[allowlists]]
14	description = "Plan E7 test fixture: the TLS key of the stand-in app server the Connect tests call on loopback (test/helpers/connect-app.js); it protects nothing outside the test process"
15	condition = "AND"
16	paths = ['''^test/fixtures/connect-key\.pem$''']
17	regexes = ['''(?s)^-----BEGIN PRIVATE KEY-----.*$''']
18
19	[[allowlists]]
20	description = "Plan E5 test fixture: a fake public subject id (usr_…), not a key; the generic-api-key rule matched a constant named USER_PASSKEY in an earlier commit of this branch"
21	condition = "AND"
22	paths = ['''^test/identity-trust\.test\.js$''']
23	regexes = ['''^usr_01JAB2C3D4E5F6G7H8J9K0MNP4$''']
24