gitleaks allowlist for the SSRF suite's web-push test vector (roadmap WS-R task 5). test/security-ssrf.test.js subscribes with the public example subscription from the web-push documentation; its auth value matches the generic-api-key rule. .gitleaks.toml keeps the default rules and allowlists that one value in that one file (path AND value), as the other OpenVibers repos do.

ddiff --git a/.gitleaks.toml b/.gitleaks.toml
nnew file mode 100644
iindex 00000000..be2eb2a5
---- /dev/null
++++ b/.gitleaks.toml
@@@ -0,0 +1,11 @@
++# gitleaks configuration, used by the shared security workflow
++# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
++# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
++[extend]
++useDefault = true
++
++[[allowlists]]
++description = "The public web-push test vector (subscription auth secret from the web-push examples) used by the SSRF suite"
++condition = "AND"
++paths = ['''^test/security-ssrf\.test\.js$''']
++regexes = ['''^tBHItJI5svbpez7KI4CCXg$''']