Lucas Berger
fba22b445b
- Add 4th [[allowlists]] block for apps/api/tests/broker/crypto.test.ts - Human-verified: TEST_KEY in Vitest beforeAll is a synthetic AES-256-GCM fixture, not a real credential - Original 3 allowlists (VAPID fixture, .env.example, .env.spike) intact
25 lines
884 B
TOML
25 lines
884 B
TOML
# .gitleaks.toml — gitleaks configuration
|
|
# Repo: familysync
|
|
|
|
title = "FamilySync gitleaks config"
|
|
|
|
[extend]
|
|
# Extend with the default ruleset (all standard secret patterns)
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
description = "Test fixture VAPID keys — documented test-only values, not production keys"
|
|
paths = ['''apps/api/tests/fixtures/vapid\.ts''']
|
|
|
|
[[allowlists]]
|
|
description = ".env.example — intentional placeholder/template values, not live secrets"
|
|
paths = ['''\.env\.example$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/.env.spike — dev/spike values, not production secrets"
|
|
paths = ['''apps/api/\.env\.spike$''']
|
|
|
|
[[allowlists]]
|
|
description = "apps/api/tests/broker/crypto.test.ts — synthetic AES-256-GCM test key assigned to process.env.APP_PASSWORD_ENCRYPTION_KEY in a Vitest beforeAll; not a real credential"
|
|
paths = ['''apps/api/tests/broker/crypto\.test\.ts''']
|