30 lines
1.0 KiB
TOML
30 lines
1.0 KiB
TOML
# Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
|
|
#
|
|
# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
|
|
# this file (title + allowlist) with ZERO detection rules, so it would never
|
|
# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
|
|
# re-pushing this template to a repo that already had the old version, that
|
|
# repo's secret scanning was a no-op until this lands.
|
|
title = "homelab gitea bootstrap"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Test fixtures and example configs are not production secrets"
|
|
paths = [
|
|
'''(?i).*\.test\.(ts|tsx|js|jsx|py)$''',
|
|
'''(?i).*\.spec\.(ts|tsx|js|jsx)$''',
|
|
'''(?i).*/tests/.*''',
|
|
'''(?i).*/__tests__/.*''',
|
|
'''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
|
|
'''(?i).*vault\.example\.(yml|yaml)$''',
|
|
'''(?i).*\.env\.example$''',
|
|
'''(?i)demo_photos/.*''',
|
|
]
|
|
regexes = [
|
|
'''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
|
|
'''(?i)sk-or-invalid''',
|
|
'''(?i)msk-or-invalid''',
|
|
]
|