.gitleaksignore

# Fingerprints of known-false-positive gitleaks findings, pinned to the exact
# commit + file + line. Same philosophy as .gitleaks.toml: narrow, documented
# exceptions only — anything new must still trip the scanner.
#
# Fictional audit-log example in the gated-write transcript: the illustrative
# `token_ref` value ("a1b2c3d4e5f60718") is a made-up 16-hex SHA-256 prefix,
# not a credential. The live file now truncates the value so the pattern can't
# recur; this entry only clears the historical commit, which gitleaks re-scans
# on every PR containing it.
c63fb2b6d3c1de0ab5ee62b5ce60051889282021:examples/transcripts/gated-run-test.md:generic-api-key:105

# Synthetic secret-shaped fixture in the report redaction test: a token built to
# match our own client-secret pattern (32+ alnum, dot, 6+ alnum) so the test can
# prove emit.py redacts a metric headline BEFORE splitting it into number and
# qualifier — split-first leaves two halves that neither match the pattern. Never
# a credential. The live fixture is now deliberately low-entropy ("1"*32 +
# ".aaaaaa") so the pattern cannot recur; this entry only clears the historical
# commit, which gitleaks re-scans on every PR containing it.
99a23dde3863fba96479fb6e1d5cd59c5ac08e56:core/tests/test_reports_emit.py:generic-api-key:314