.gitleaks.toml

# gitleaks config for fortigate-mcp-server (REL-06)
#
# Extends gitleaks' default ruleset with one custom rule targeting FortiGate
# REST API tokens placed near an `api_token`/`api-token` key. The key anchor
# is deliberately kept (see the disabled bare-string variant below for why),
# but the value/separator shape is broad on purpose: it covers the JSON form
# from config/config.json plus YAML (`api_token: <tok>`), Python kwargs
# (`api_token="<tok>"`), env-style (`FORTIGATE_API_TOKEN=<tok>`), and
# single-quoted serializations -- all demonstrated bypasses of the earlier
# exact-JSON-only regex.
#
# Source: gitleaks config schema, github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml

[extend]
useDefault = true

[[rules]]
id = "fortigate-api-token"
description = "FortiGate REST API token near an api_token key"
regex = '''(?i)api[_-]?token['"]?\s*[:=]\s*['"]?[A-Za-z0-9]{20,64}['"]?'''
keywords = ["api_token", "api-token"]
tags = ["fortigate", "api-key"]

# NOT enabled as an active rule (documented false-positive risk against unrelated
# 30-char alphanumeric strings such as hashes/identifiers with no JSON context).
# Kept here only as an optional stricter variant for future consideration:
#
# [[rules]]
# id = "fortigate-api-token-bare"
# description = "Bare FortiGate-shaped token string, no JSON context"
# regex = '''\b[A-Za-z0-9]{30}\b'''
# tags = ["fortigate", "high-entropy"]