.gitleaks.toml

title = "Gitleaks config for stellarGive"

[allowlist]
  description = "Global allowlist"
  # Baseline reviewed 2026-07-25 — every path below is a false-positive
  # source, not a place real secrets are expected to live. Re-justify (or
  # remove) an entry here whenever it's touched.
  paths = [
    # Documented example env file — values are placeholders, never real credentials.
    '''frontend/.env\.example$''',
    # This config's own regexes resemble secret patterns to a scanner.
    '''\.gitleaks\.toml$''',
    # Lockfile can contain resolved tarball URLs with auth-looking substrings; no real secrets are ever committed here.
    '''package-lock\.json$''',
    # Rust lockfile; same false-positive shape as package-lock.json.
    '''Cargo\.lock$''',
    # Auto-generated release notes; may reference commit hashes/PR links that superficially match secret regexes.
    '''CHANGELOG\.md$''',
  ]

[[rules]]
  id = "stellar-secret-key"
  description = "Stellar secret key (starts with S)"
  regex = '''S[0-9A-Z]{55}'''
  tags = ["key", "stellar"]

[[rules]]
  id = "generic-api-key"
  description = "Generic API key"
  regex = '''(?i)(api[_-]?key|apikey)\s*[:=]\s*['\"]?([A-Za-z0-9\-_]{20,})['\"]?'''
  tags = ["key", "generic"]

[[rules]]
  id = "generic-secret"
  description = "Generic secret value"
  regex = '''(?i)(secret|private[_-]?key|token)\s*[:=]\s*['\"]?([A-Za-z0-9\-_\.]{20,})['\"]?'''
  tags = ["secret", "generic"]
  [rules.allowlist]
    # Values matching these words are documentation/placeholder text
    # (e.g. `.env.example`, code comments), not real secrets.
    description = "Allow example/placeholder values"
    regexes = [
      '''(?i)example''',
      '''(?i)test''',
      '''(?i)placeholder''',
      '''(?i)xxx''',
      '''(?i)your[-_]?key''',
      '''(?i)fill[-_]?in''',
    ]

[[rules]]
  id = "aws-access-key"
  description = "AWS Access Key"
  regex = '''AKIA[0-9A-Z]{16}'''
  tags = ["key", "aws"]

[[rules]]
  id = "private-key"
  description = "Private key block"
  regex = '''-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----'''
  tags = ["key", "private"]