# Author:  cirakg & claude ai
# Summary: Default secret detectors with narrowly scoped, reviewed test-value exceptions.
title = "OTP Wallet secret scanning"
minVersion = "v8.25.0"

[extend]
useDefault = true

[[allowlists]]
description = "Published OTP test keys in hand-written fixtures"
targetRules = ["generic-api-key"]
condition = "AND"
regexTarget = "secret"
paths = ['''(?:^|/)source/app/Fixtures\.mc$''', '''(?:^|/)test/import/ImportSupport\.mc$''', '''(?:^|/)test/import/OtpAuthTest\.mc$''', '''(?:^|/)tools/gen_fuzz_corpus\.py$''']
regexes = ['''^(?:GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|MFRGGZDFMZTWQ2LKNNWG23TPOBYXE43U)$''']

[[allowlists]]
description = "Deterministic generated test values in test/data/FuzzCorpus.mc"
targetRules = ["generic-api-key"]
condition = "AND"
regexTarget = "secret"
paths = ['''(?:^|/)test/data/FuzzCorpus\.mc$''']
regexes = ['''^(?:GEZDGDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGAZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGE|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJ|GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ|GEZDGNBVGY3TQOJQGEZDGNBWaVGY3TQOJQ|GEZDGNBVGY3TQOJQGEnullZDGNBVGY3TQOJQ|GEZDGNBVOJQGEZDGNBVGY3TQOJ|GEZDGsNBVGY3TQOJQGEZDGNBVGY3TQOJQ)$''']

[[allowlists]]
description = "Deterministic generated test values in test/data/Vectors.mc"
targetRules = ["generic-api-key"]
condition = "AND"
regexTarget = "secret"
paths = ['''(?:^|/)test/data/Vectors\.mc$''']
regexes = ['''^(?:60e431591ee0b67f0d8a26aacbf5b77f8e0bc6213728c5140546040f0ee37f54|80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598|aa4ae5e15272d00e95705637ce8a3b55ed402112)$''']