- Add 4th [[allowlists]] block for apps/api/tests/broker/crypto.test.ts - Human-verified: TEST_KEY in Vitest beforeAll is a synthetic AES-256-GCM fixture, not a real credential - Original 3 allowlists (VAPID fixture, .env.example, .env.spike) intact
- Add .gitleaks.toml inheriting default ruleset via [extend] useDefault = true - Allowlist apps/api/tests/fixtures/vapid.ts (test-only VAPID keypair) - Allowlist .env.example (intentional placeholder template) - Allowlist apps/api/.env.spike (dev/spike values)