bindery/.gitleaks.toml at main · totza2010/bindery

Repository navigation

# .gitleaks.toml — Bindery-tuned Gitleaks configuration

# Extends the default gitleaks ruleset with project-specific allowlists.

# Reference: https://github.com/gitleaks/gitleaks#configuration

# NOTE: gitleaks 8.24.x (used in CI via gitleaks-action) requires the global

# allowlist to use [allowlist] (singular table), not [[allowlists]] (array of

# tables). The [[allowlists]] form silently has no effect in this version.

# When combining multiple condition types (regexes + paths) within [allowlist],

# gitleaks applies AND semantics — all conditions must match. Use only one

# condition type per block, or accept the OR-via-one-type approach below.

title = "Bindery Gitleaks Configuration"

# Extend from the default built-in rules rather than replacing them.

[extend]

useDefault = true

# ── Global allowlist (gitleaks 8.24.x compatible) ─────────────────────────────

# Regexes are matched against both the full match string and the extracted

# secret. Any finding whose secret or match contains one of these strings is

# suppressed globally.

[allowlist]

description = "Bindery project false-positive suppressions"

regexes = [

# Known-safe URL hosts used in examples and config defaults

'''https?://(www\.)?example\.com''',

'''https?://localhost(:[0-9]+)?''',

'''https?://127\.0\.0\.1(:[0-9]+)?''',

'''https?://\[?::1\]?(:[0-9]+)?''',

# Test-fixture placeholder credential values (opds_test.go, auth_test.go)

'''abcdefghijklmnopqrstuvwxyz012345''',

'''test-secret-32-bytes-long-enough''',

'''test-api-key''',

'''admin123''',

'''SCREAMING_TEST_KEY_[A-Z0-9_]+''',

# URL path false-positive in docs/auth-proxy.md (authelia verify endpoint)

'''9091/api/verify''',

]