diff options
| author | cirakg <cirakg@cirakg.xyz> | 2026-10-28 11:45:11 +0100 |
|---|---|---|
| committer | cirakg <cirakg@cirakg.xyz> | 2026-10-28 11:45:11 +0100 |
| commit | 09ef21af399a60ceb2e45526fe1a7dd94c53819c (patch) | |
| tree | 7992abb501f75dfe393b2bfd424227d1fc06b5b6 /.gitleaks.toml | |
| parent | 3096eb7d366683caec24ed5d0a70ac5dae6f624d (diff) | |
chore: prepare repository for open-source release
Diffstat (limited to '.gitleaks.toml')
| -rw-r--r-- | .gitleaks.toml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..fe41acf --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,31 @@ +# Author: cirakg & claude ai +# Summary: Default secret detectors with narrowly scoped, reviewed test-value exceptions. +title = "OTP Wallet secret scanning" +minVersion = "v8.25.0" + +[extend] +useDefault = true + +[[allowlists]] +description = "Published OTP test keys in hand-written fixtures" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)source/app/Fixtures\.mc$''', '''(?:^|/)test/import/ImportSupport\.mc$''', '''(?:^|/)test/import/OtpAuthTest\.mc$''', '''(?:^|/)tools/gen_fuzz_corpus\.py$'''] +regexes = ['''^(?:GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|MFRGGZDFMZTWQ2LKNNWG23TPOBYXE43U)$'''] + +[[allowlists]] +description = "Deterministic generated test values in test/data/FuzzCorpus.mc" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)test/data/FuzzCorpus\.mc$'''] +regexes = ['''^(?:GEZDGDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGAZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGE|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJ|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGEZDGNBWaVGY3TQOJQ|GEZDGNBVGY3TQOJQGEnullZDGNBVGY3TQOJQ|GEZDGNBVOJQGEZDGNBVGY3TQOJ|GEZDGsNBVGY3TQOJQGEZDGNBVGY3TQOJQ)$'''] + +[[allowlists]] +description = "Deterministic generated test values in test/data/Vectors.mc" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)test/data/Vectors\.mc$'''] +regexes = ['''^(?:60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54|80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598|aa4ae5e15272d00e95705637ce8a3b55ed402112)$'''] |