diff options
Diffstat (limited to '.gitleaks.toml')
| -rw-r--r-- | .gitleaks.toml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..fe41acf --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,31 @@ +# Author: cirakg & claude ai +# Summary: Default secret detectors with narrowly scoped, reviewed test-value exceptions. +title = "OTP Wallet secret scanning" +minVersion = "v8.25.0" + +[extend] +useDefault = true + +[[allowlists]] +description = "Published OTP test keys in hand-written fixtures" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)source/app/Fixtures\.mc$''', '''(?:^|/)test/import/ImportSupport\.mc$''', '''(?:^|/)test/import/OtpAuthTest\.mc$''', '''(?:^|/)tools/gen_fuzz_corpus\.py$'''] +regexes = ['''^(?:GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|MFRGGZDFMZTWQ2LKNNWG23TPOBYXE43U)$'''] + +[[allowlists]] +description = "Deterministic generated test values in test/data/FuzzCorpus.mc" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)test/data/FuzzCorpus\.mc$'''] +regexes = ['''^(?:GEZDGDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGAZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGE|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJ|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGEZDGNBWaVGY3TQOJQ|GEZDGNBVGY3TQOJQGEnullZDGNBVGY3TQOJQ|GEZDGNBVOJQGEZDGNBVGY3TQOJ|GEZDGsNBVGY3TQOJQGEZDGNBVGY3TQOJQ)$'''] + +[[allowlists]] +description = "Deterministic generated test values in test/data/Vectors.mc" +targetRules = ["generic-api-key"] +condition = "AND" +regexTarget = "secret" +paths = ['''(?:^|/)test/data/Vectors\.mc$'''] +regexes = ['''^(?:60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54|80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598|aa4ae5e15272d00e95705637ce8a3b55ed402112)$'''] |