`.gitleaks.toml`

32 lines
# gitleaks config for govarbitrage.
# Keep ALL default rules (extend), and add ONLY a narrow allowlist for the App
# Store Connect API *identifiers* that live in apps/mobile/eas.json. The ASC
# issuer id and key id are account IDENTIFIERS, not secret key material — the
# actual private key (AuthKey_*.p8) is referenced by a gitignored path
# (~/.appstoreconnect/private_keys/…) and is never committed. gitleaks' generic
# high-entropy rule false-positives on these UUID/key-id strings.
title = "govarbitrage gitleaks config"

[extend]
useDefault = true

[allowlist]
description = "ASC API key identifiers (issuer id + key id) in eas.json — non-secret account identifiers, not key material"
# .env.example is a pure documentation TEMPLATE — every value is a placeholder,
# empty, or a public demo id. Allowlist the file (all rules stay active elsewhere).
paths = [
  '''\.env\.example$''',
]
regexes = [
  '''cfbd63ed-301b-465c-aad7-49e94420ad70''',
  '''AuthKey_72Y2TZT54R''',
  '''72Y2TZT54R''',
  # Placeholder/dummy values in .env.example + dev docker-compose.yml — NOT live
  # secrets. The generic-api-key rule false-positives on the 64-hex SHAPE.
  '''0123456789abcdef''',
  '''dev-only-change-me''',
  '''GSA_API_KEY="DEMO_KEY"''',
  # Public Apify actor id (parseforge/govdeals-scraper) — an actor IDENTIFIER, not a token.
  '''SZdBCF9FpwOzvByvM''',
]