Defame1297
25a6a454b9
- scripts/setup-gitleaks.sh — installs gitleaks v8.24.2, seeds .gitleaks.toml on first run, writes managed pre-commit hook block; re-run replaces block in place without disturbing other hook content - scripts/gitleaks.toml — base config template extending default ruleset - .gitleaks.toml — repo config with docs/research/ path allowlist (high-entropy terminal captures; v8.24.2 [allowlist] syntax) - tests/test-setup-gitleaks.sh — 6 behavior tests including stale-block replacement and idempotency - .agents/skills/gitleaks/ — cross-cutting skill covering install, update, allowlist tuning, scan modes, and real-finding remediation - .agents/evals/cross-cutting/gitleaks/eval.yaml — 7 trigger + 3 output tests including version-aware allowlist guidance case - docs/spec/overview.md — updated to reflect new tooling and skill Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
28 lines
978 B
TOML
28 lines
978 B
TOML
title = "gitleaks config"
|
|
|
|
[extend]
|
|
# Extends the default ruleset built into gitleaks.
|
|
# Remove useDefault and define [[rules]] from scratch if you want full control.
|
|
useDefault = true
|
|
|
|
# Rules to disable from the default set — uncomment and add IDs for known false positives.
|
|
# Run `gitleaks git -v` on your repo first to discover which rules fire.
|
|
# disabledRules = ["generic-api-key"]
|
|
|
|
# Project-specific allowlists — entries here apply to all rules.
|
|
# Add fingerprints from .gitleaksignore, or path/regex patterns to suppress noise.
|
|
#
|
|
# Example: ignore test fixtures
|
|
# [[allowlists]]
|
|
# description = "test fixtures"
|
|
# paths = ['''tests/fixtures/.*''']
|
|
#
|
|
# Example: ignore a known false-positive secret value
|
|
# [[allowlists]]
|
|
# description = "placeholder values used in docs"
|
|
# stopwords = ["example", "placeholder", "changeme"]
|
|
|
|
[allowlist]
|
|
description = "research session notes — no secrets, high-entropy text from terminal captures"
|
|
paths = ['''docs/research/.*''']
|