From 2532c0f743abd1d8ff971f7b65f3bcb6517de013 Mon Sep 17 00:00:00 2001 From: iamtoruk Date: Mon, 10 Aug 2026 04:19:56 -0700 Subject: [PATCH] Scope path-limited allowlists with condition AND; cover the example-JWT fixture Gitleaks ORs an allowlist entry's conditions by default, so pairing a fixture regex with a tests/ path allowlisted every finding under tests/, regex or not - a real secret committed to a test file would have been suppressed. condition = AND restores the intended semantics (verified: a planted AWS/Stripe-shaped canary in tests/ is flagged again), and the canonical example JWT header fixture that the path condition was silently covering gets its own scoped entry. Full-history scan stays green. --- .gitleaks.toml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.gitleaks.toml b/.gitleaks.toml index 3248978a..5c5a5255 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -11,6 +11,7 @@ useDefault = true description = "Test fixtures: obviously-fake API keys used as parser/validator input." # sk-live-0123456789abcdef... and sk-live-AKIA1234567890SECRETKEY live in # packages/core and root test suites purely as decode/redaction fixtures. +condition = "AND" regexes = [ '''sk-live-0123456789abcdef''', '''sk-live-AKIA1234567890SECRETKEY''', @@ -29,5 +30,12 @@ regexes = [ [[allowlists]] description = "Non-secret identifiers the generic-api-key rule mis-fires on." # e.g. dedup keys like 'synth-retain-89d' in parser fixtures. +condition = "AND" regexes = ['''synth-[a-z0-9-]+'''] paths = ['''(^|/)tests?/'''] + +[[allowlists]] +description = "Canonical example JWT header used as a redaction/parse fixture (decodes to {\"alg\":\"HS256\",\"typ\":\"JWT\"}, carries no claims or signature)." +condition = "AND" +regexes = ['''eyJhbGciOiJIUzI1NiIsIn'''] +paths = ['''(^|/)tests?/''']