# gitleaks configuration, used by the shared security workflow
# (OpenVibers/OpenVibe.Shared/.github/workflows/security.yml). The default rules stay on; every
# allowlist below is one proven false positive, matched on path AND value so nothing else is hidden.
[extend]
useDefault = true

[[allowlists]]
description = "The public web-push test vector (subscription auth secret from the web-push examples) used by the SSRF suite"
condition = "AND"
paths = ['''^test/security-ssrf\.test\.js$''']
regexes = ['''^tBHItJI5svbpez7KI4CCXg$''']

[[allowlists]]
description = "Plan E7 test fixture: the TLS key of the stand-in app server the Connect tests call on loopback (test/helpers/connect-app.js); it protects nothing outside the test process"
condition = "AND"
paths = ['''^test/fixtures/connect-key\.pem$''']
regexes = ['''(?s)^-----BEGIN PRIVATE KEY-----.*$''']

[[allowlists]]
description = "Plan E5 test fixture: a fake public subject id (usr_…), not a key; the generic-api-key rule matched a constant named USER_PASSKEY in an earlier commit of this branch"
condition = "AND"
paths = ['''^test/identity-trust\.test\.js$''']
regexes = ['''^usr_01JAB2C3D4E5F6G7H8J9K0MNP4$''']