vrr/codeburn
2
0
Fork 0
mirror of https://github.com/AgentSeal/codeburn.git synced 2026-08-21 06:24:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Scope path-limited allowlists with condition AND; cover the example-JWT fixture

Browse source 
Gitleaks ORs an allowlist entry's conditions by default, so pairing a
fixture regex with a tests/ path allowlisted every finding under tests/,
regex or not - a real secret committed to a test file would have been
suppressed. condition = AND restores the intended semantics (verified: a
planted AWS/Stripe-shaped canary in tests/ is flagged again), and the
canonical example JWT header fixture that the path condition was silently
covering gets its own scoped entry. Full-history scan stays green.
This commit is contained in:
iamtoruk 2026-08-10 04:19:56 -07:00
parent 5cbb0002b6
commit 2532c0f743
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
.gitleaks.toml
View file

@ -11,6 +11,7 @@ useDefault = true
description = "Test fixtures: obviously-fake API keys used as parser/validator input."
# sk-live-0123456789abcdef... and sk-live-AKIA1234567890SECRETKEY live in
# packages/core and root test suites purely as decode/redaction fixtures.
condition = "AND"
regexes = [
'''sk-live-0123456789abcdef''',
'''sk-live-AKIA1234567890SECRETKEY''',
@ -29,5 +30,12 @@ regexes = [
[[allowlists]]
description = "Non-secret identifiers the generic-api-key rule mis-fires on."
# e.g. dedup keys like 'synth-retain-89d' in parser fixtures.
condition = "AND"
regexes = ['''synth-[a-z0-9-]+''']
paths = ['''(^|/)tests?/''']
[[allowlists]]
description = "Canonical example JWT header used as a redaction/parse fixture (decodes to {\"alg\":\"HS256\",\"typ\":\"JWT\"}, carries no claims or signature)."
condition = "AND"
regexes = ['''eyJhbGciOiJIUzI1NiIsIn''']
paths = ['''(^|/)tests?/''']