1- # Gitleaks configuration for stellabill-backend
2- #
3- # This file uses gitleaks' built-in default rules and only overrides the
4- # allowlist. No [rules] section is defined, so gitleaks will automatically
5- # load the comprehensive set of built-in secret detection patterns.
6- #
7- # When adding entries to the allowlist, prefer path-based matches over
8- # regex-based matches — they are more precise and easier to maintain.
9- #
10- # For every allowlist entry, include a comment explaining WHY the match is
11- # a false positive so that reviewers can verify it remains valid.
12-
13- title = " stellabill-backend gitleaks config"
14-
15- [extend ]
16- # Use the official gitleaks default rules as our base.
17- useDefault = true
18-
191[allowlist ]
20-
21- # ── Path-based exclusions ─────────────────────────────────────────────
22- # These paths are known to contain test fixtures, placeholder values, or
23- # fuzz corpora that intentionally include secret-like strings.
24-
25- paths = [
26- # Test files that use static HMAC/JWT signing keys for deterministic tests.
27- # These values are never used outside of test functions.
28- ''' internal/middleware/auth_test\.go'''
29- ''' internal/middleware/webhook_verification_test\.go'''
30- ''' internal/middleware/request_signing_test\.go'''
31- ''' internal/middleware/logger_test\.go'''
32- ''' internal/middleware/recovery_hardening_test\.go'''
33-
34- # Storage test fixtures — "AKIATEST" and "testsecret" are deliberately
35- # non-functional and match the AWS test prefix "AKIA" only by coincidence.
36- ''' internal/storage/s3/client_test\.go'''
37-
38- # Audit test files — contain HMAC keys and bearer tokens used to verify
39- # redaction and log output formatting.
40- ''' internal/audit/logger_test\.go'''
41- ''' internal/audit/middleware_test\.go'''
42-
43- # Auth/RBAC test fixtures — include JWK material and admin tokens that
44- # exist solely to exercise the permission matrix parser.
45- ''' internal/auth/rbac_matrix_test\.go'''
46- ''' internal/auth/rbac_matrix\.yaml'''
47-
48- # Config test files — exercise environment variable parsing with
49- # placeholder values that match the production validation rules.
50- ''' internal/config/config_test\.go'''
51- ''' internal/config/pool_config_test\.go'''
52- ''' internal/config/pgbouncer_config_test\.go'''
53- ''' internal/config/coverage_test\.go'''
54-
55- # Route and handler tests — use bearer tokens to exercise auth middleware.
56- ''' internal/routes/routes_audit_test\.go'''
57- ''' internal/handlers/subscriptions_integration_test\.go'''
58- ''' internal/pagination/scoped_cursor_test\.go'''
59-
60- # Worker tests — contain test database credentials for integration tests.
61- ''' internal/worker/fee_revenue_refresh_integration_test\.go'''
62-
63- # Pact contract tests — use a static webhook secret for HMAC signing.
64- ''' tests/pact/provider_test\.go'''
65-
66- # Redactor tests — intentionally include "password", "token", etc.
67- # to verify that the security redactor masks them in output.
68- ''' internal/security/redactor_test\.go'''
69-
70- # Test database helper — contains a well-known test password.
71- ''' internal/testutil/db\.go'''
72-
73- # Fuzz corpora and testdata directories — contain base64-encoded
74- # cursors and event payloads that resemble JWT tokens but are not.
75- ''' internal/handlers/testdata/.*\.corpus'''
76- ''' internal/reconciliation/event_decoder_test\.go'''
77-
78- # CI workflow files — contain test credentials for Postgres services.
79- ''' \.github/workflows/ci\.yml'''
80- ''' \.github/workflows/pact\.yml'''
81-
82- # Env reference file — all secrets use the "CHANGE_ME_" prefix.
83- ''' \.env\.example'''
84-
85- # Deploy manifests — use explicit placeholder values (e.g. "testpass",
86- # "preview_pass", base64("placeholder")) that are never deployed.
87- ''' deploy/preview/postgres\.yaml'''
88- ''' deploy/kustomize/base/secret-pgbouncer\.yaml'''
89- ''' deploy/helm/stellabill/templates/secret-pgbouncer\.yaml'''
90-
91- # OpenAPI validate command uses test credentials in its config.
92- ''' cmd/openapi-validate/main\.go'''
93-
94- # Network policy test deployments use test credentials.
95- ''' tests/networkpolicy/test-deployments\.yaml'''
96-
97- # Documentation — idempotency.md contains example HTTP snippets with
98- # example UUIDs that trigger the generic-api-key rule.
99- ''' docs/idempotency\.md'''
100-
101- # Secrets audit tool has its own test data.
102- ''' tools/secrets-audit/testdata/.*'''
103- ]
104-
105- # ── Regex-based exclusions ────────────────────────────────────────────
106- # Only add regex entries when a path-based exclusion is impractical
107- # (e.g. the pattern legitimately appears across many unrelated files).
108-
109- regexes = [
110- # Generic test / placeholder values
111- ''' (?i)(test|placeholder|example|dummy|fake).*(secret|token|key|pass|pwd|jwt|hmac|bearer)'''
112- ''' (?i)(secret|token|key|pass|pwd|jwt|hmac|bearer).*(test|placeholder|example|dummy|fake)'''
113-
114- # Specific well-known test credentials that appear across multiple files
115- ''' sk-ABC123XYZ'''
116- ''' AKIATEST'''
117- ''' test-webhook-secret-for-pact'''
118- ''' CHANGE_ME_'''
119-
120- # Known test passwords documented in CI and deploy configs
121- ''' testpass'''
122- ''' preview_pass'''
123-
124- # Base64 "placeholder" used in K8s Secret manifests
125- ''' cGxhY2Vob2xkZXI='''
126- ]
127-
128- # ── Stopwords ─────────────────────────────────────────────────────────
129- # These commit-message words frequently trigger false positives when a
130- # scan includes the git log. Gitleaks v8.18+ supports this natively.
1312 stopwords = [
1323 " secret"
1334 " password"
@@ -141,6 +12,11 @@ useDefault = true
14112 " testpass"
14213 " preview_pass"
14314 ]
15+ paths = [
16+ ''' .*_test\.go$'''
17+ ''' internal/testutil/.*'''
18+ ''' docs/outbox-jwe\.md'''
19+ ]
14420
14521# ── Custom deny rules (beyond gitleaks defaults) ───────────────────────
14622# These rules catch patterns specific to this codebase that the built-in
@@ -150,21 +26,18 @@ useDefault = true
15026# The allowlist above handles false positives from test/example files.
15127# These custom rules catch real credential patterns that may slip past
15228# the default ruleset.
153-
15429[[rules ]]
15530 id = " stellabill-jwt-secret-assignment"
15631 description = " JWT_SECRET assigned a non-placeholder value"
15732 regex = ''' (?i)JWT_SECRET\s*[:=]\s*['"][A-Za-z0-9!@#$%^&*()_+\-={}]{8,}['"]'''
15833 tags = [" stellabill" " jwt" " secret"
159-
16034[[rules ]]
16135 id = " stellabill-admin-token-assignment"
16236 description = " ADMIN_TOKEN assigned a non-placeholder value"
16337 regex = ''' (?i)ADMIN_TOKEN\s*[:=]\s*['"][A-Za-z0-9!@#$%^&*()_+\-={}]{8,}['"]'''
16438 tags = [" stellabill" " admin" " token"
165-
16639[[rules ]]
16740 id = " stellabill-audit-hmac-assignment"
16841 description = " AUDIT_HMAC_SECRET assigned a non-placeholder value"
16942 regex = ''' (?i)AUDIT_HMAC_SECRET\s*[:=]\s*['"][A-Za-z0-9!@#$%^&*()_+\-={}]{8,}['"]'''
170- tags = [" stellabill" " audit" " hmac"
43+ tags = [" stellabill" " audit" " hmac"
0 commit comments