From 81768cbf317e6d0bfdcb04b86dd858a1fa90abd7 Mon Sep 17 00:00:00 2001
From: ilia <idobkin@gmail.com>
Date: Sun, 12 Jul 2026 16:23:50 -0500
Subject: [PATCH] ci: sync gitleaks allowlist

---
 .gitleaks.toml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 3587bd4..8a35146 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -1,6 +1,15 @@
 # Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
+#
+# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
+# this file (title + allowlist) with ZERO detection rules, so it would never
+# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
+# re-pushing this template to a repo that already had the old version, that
+# repo's secret scanning was a no-op until this lands.
 title = "homelab gitea bootstrap"
 
+[extend]
+useDefault = true
+
 [allowlist]
 description = "Test fixtures and example configs are not production secrets"
 paths = [