From 2f1592cc455e8b967248de16b66ed20d39dcb5d4 Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 05:27:54 -0400
Subject: [PATCH] chore(16-04): add gitleaks config with fixture + env
 allowlists

- Add .gitleaks.toml inheriting default ruleset via [extend] useDefault = true
- Allowlist apps/api/tests/fixtures/vapid.ts (test-only VAPID keypair)
- Allowlist .env.example (intentional placeholder template)
- Allowlist apps/api/.env.spike (dev/spike values)
---
 .gitleaks.toml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..ede3540
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,20 @@
+# .gitleaks.toml — gitleaks configuration
+# Repo: familysync
+
+title = "FamilySync gitleaks config"
+
+[extend]
+# Extend with the default ruleset (all standard secret patterns)
+useDefault = true
+
+[[allowlists]]
+description = "Test fixture VAPID keys — documented test-only values, not production keys"
+paths = ['''apps/api/tests/fixtures/vapid\.ts''']
+
+[[allowlists]]
+description = ".env.example — intentional placeholder/template values, not live secrets"
+paths = ['''\.env\.example$''']
+
+[[allowlists]]
+description = "apps/api/.env.spike — dev/spike values, not production secrets"
+paths = ['''apps/api/\.env\.spike$''']