From fba22b445bf4c4e6f4930d46a4475e7a075f900b Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 08:14:26 -0400
Subject: [PATCH] chore(16-04): allowlist crypto.test.ts synthetic AES test key
 in gitleaks config

- Add 4th [[allowlists]] block for apps/api/tests/broker/crypto.test.ts
- Human-verified: TEST_KEY in Vitest beforeAll is a synthetic AES-256-GCM fixture, not a real credential
- Original 3 allowlists (VAPID fixture, .env.example, .env.spike) intact
---
 .gitleaks.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index ede3540..611add9 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -18,3 +18,7 @@ paths = ['''\.env\.example$''']
 [[allowlists]]
 description = "apps/api/.env.spike — dev/spike values, not production secrets"
 paths = ['''apps/api/\.env\.spike$''']
+
+[[allowlists]]
+description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
+paths = ['''apps/api/tests/broker/crypto\.test\.ts''']