8000 fix(security): scope the scheduled secret sweep to a real finding by shroominic · Pull Request #150 · shroominic/OpenGlucose · GitHub
[go: up one dir, main page]
Skip to content

fix(security): scope the scheduled secret sweep to a real finding #150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shroominic wants to merge 2 commits into from
Closed

fix(security): scope the scheduled secret sweep to a real finding #150

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
46da0cc
fix(security): scope the scheduled secret sweep to a real finding
shroominic Sep 18, 2026
6c8c6f8
fix(security): make the scheduled sweep green for the right reasons
shroominic Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions .gitleaks.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
# Secret scanning policy for the repository sweep.
#
# The default rule set is extended, never replaced, and no path is exempt: a
# secret introduced anywhere in the tree still fails the sweep. Every entry
# below either names a value that is already in this repository's history and is
# not a credential, records the single historical binding that holds a
# key-derived test vector, or scopes one obsolete commit that a release
# aggregate still reaches through a merge it later reverted.

title = "OpenGlucose secret scanning policy"

[extend]
useDefault = true

[allowlist]
description = "Known non-secret values, one recorded key-derived fixture binding, and one superseded commit."
regexTarget = "line"
regexes = [
# macOS self-test storage entry name: a local keychain label, not a credential.
'''^\s*const testKey = 'ct5[.]macos[.]selftest[.]v1';$''',
# App Store Connect issuer identifier: an identifier, not a credential. The
# credential for that API is a private key file that is not in this repository.
'''API_ISSUER_ID="[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}"''',
# Test-only fixture defaults in a Dart test helper, bounded to that shape.
'''^\s*String token = '[A-Za-z0-9_-]{24}',$''',
# RECORDED, NOT DISMISSED: this binding held a published synthetic masking
# vector, which is a function of the vendor stream key and therefore material
# rather than a false positive. It is already public and no scanner setting can
# un-publish it; the binding is removed from every tip and the tree guard in
# `security/gitleaks-vendor-material.toml` rejects it or any successor at the
# tip. Purging the history and rotating the material are decision requests, not
# something this policy can settle. Bounded to this one binding name.
'''const _authMasked = ''',
]
# The sensor lane's first redaction commit carried a synthetic, key-shaped test
# fixture. That commit has been rewritten and is no longer a tip, but
# `release/v0.4.0-lane-append` merged it and then reverted the merge, so it is
# still reachable. Bounded to that one commit; the tip guard covers every tip.
commits = ["3be16fc212b699d7e9be1852dcbbac8bec6e3ec0"]
Loading
0