.gitleaks.toml

title = "obol-stack gitleaks config"

[[rules]]
id = "http-basic-auth-in-log"
description = "HTTP Basic Auth credential in log output or config"
regex = '''Basic\s+[A-Za-z0-9+/=]{8,}'''
tags = ["auth", "credential"]

[[rules]]
id = "authorization-header-value"
description = "Authorization header key=value pair with credential"
regex = '''Authorization\s*[=:]\s*(?:Basic|Bearer)\s+\S+'''
tags = ["auth", "credential"]

[[rules]]
id = "ethereum-private-key"
description = "Ethereum/secp256k1 hex private key"
regex = '''(?i)(?:private.?key|secret.?key|PRIVATE_KEY)\s*[=:]\s*(?:0x)?[0-9a-fA-F]{64}'''
tags = ["key", "ethereum"]

[[rules]]
id = "charon-enr-private-key"
description = "Charon ENR private key file content"
regex = '''(?i)enr.?private.?key.*[0-9a-fA-F]{64}'''
tags = ["key", "charon"]

[[rules]]
id = "jwt-hex-secret"
description = "JWT hex secret (EL/CL auth)"
regex = '''(?i)(?:jwt|engine).{0,20}(?:secret|hex|token)\s*[=:]\s*(?:0x)?[0-9a-fA-F]{64}'''
tags = ["key", "jwt"]

[[rules]]
id = "bls-keystore-password"
description = "BLS keystore password in plaintext"
regex = '''(?i)(?:keystore|keystores|bls).{0,20}(?:password|pass|secret)\s*[=:]\s*\S{8,}'''
tags = ["key", "validator"]

[allowlist]
description = "Global allowlist"
regexTarget = "line"
regexes = [
    # The well-known Hardhat test mnemonic is intentionally public
    '''test test test test test test test test test test test junk''',
    # USDC storage slot values (uint256 padded, not secrets)
    '''0x0{50,}[0-9a-fA-F]{1,14}''',
    # Shell variable expansion in HTTP Auth headers — the actual secret
    # comes from $BOB_TOKEN / $LITELLM_KEY / etc. at runtime, not from
    # the literal source text. Matches `Authorization: Bearer $VAR` and
    # `Authorization: Basic ${VAR}` forms only; a hardcoded literal still
    # trips the rule because the allowlist regex requires a literal `$`.
    '''Authorization:\s+(?:Basic|Bearer)\s+\$\{?[A-Za-z_][A-Za-z0-9_]*''',
]
paths = [
    # Gitleaks own config
    '''\.gitleaks\.toml''',
]