From e3b6120651ce0009c995d531f1bdd8e416186b81 Mon Sep 17 00:00:00 2001
From: ilia <idobkin@gmail.com>
Date: Sun, 12 Jul 2026 18:19:13 -0500
Subject: [PATCH] ci: restore repo-specific gitleaks allowlist, keep useDefault
 fix

---
 .gitleaks.toml | 25 ++++++-------------------
 1 file changed, 6 insertions(+), 19 deletions(-)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 8a35146..e2c2a5a 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -1,28 +1,15 @@
-# Homelab bootstrap — gitleaks allowlist (tests, examples, placeholders)
-#
-# IMPORTANT: `useDefault = true` is required — without it gitleaks loads ONLY
-# this file (title + allowlist) with ZERO detection rules, so it would never
-# flag a real secret. Fixed 2026-07 (security-hardening track); if you're
-# re-pushing this template to a repo that already had the old version, that
-# repo's secret scanning was a no-op until this lands.
-title = "homelab gitea bootstrap"
+# Slack export fixtures historically embedded expired xoxe URL tokens.
+# Working tree is redacted to xoxe-REDACTED; allowlist covers pre-redaction commits.
+title = "slack-sieve"
 
 [extend]
 useDefault = true
 
 [allowlist]
-description = "Test fixtures and example configs are not production secrets"
+description = "Test fixtures (tokens redacted going forward)"
 paths = [
-  '''(?i).*\.test\.(ts|tsx|js|jsx|py)$''',
-  '''(?i).*\.spec\.(ts|tsx|js|jsx)$''',
-  '''(?i).*/tests/.*''',
-  '''(?i).*/__tests__/.*''',
-  '''(?i).*\.example\.(yml|yaml|env|json|toml)$''',
-  '''(?i).*vault\.example\.(yml|yaml)$''',
-  '''(?i).*\.env\.example$''',
+  '''tests/fixtures/.*''',
 ]
 regexes = [
-  '''(?i)(invalid|fake|dummy|placeholder|example|changeme|change_me|not-a-real)''',
-  '''(?i)sk-or-invalid''',
-  '''(?i)msk-or-invalid''',
+  '''xoxe-REDACTED''',
 ]