.gitleaks.toml

# Gitleaks configuration for Aframp backend secrets detection.
# Scans all committed code and git history for accidentally committed secrets.

title = "Aframp Backend Gitleaks Config"

[extend]
# Extend the default gitleaks ruleset
useDefault = true

[[rules]]
id = "aframp-database-url"
description = "Aframp database connection string with credentials"
regex = '''postgres://[^:]+:[^@]+@'''
tags = ["database", "credentials"]
severity = "CRITICAL"

[[rules]]
id = "aframp-redis-url"
description = "Redis connection string with credentials"
regex = '''redis://:[^@]+@'''
tags = ["cache", "credentials"]
severity = "HIGH"

[[rules]]
id = "aframp-stellar-secret"
description = "Stellar account secret key (starts with S)"
regex = '''S[A-Z2-7]{55}'''
tags = ["blockchain", "private-key"]
severity = "CRITICAL"

[[rules]]
id = "aframp-jwt-secret"
description = "JWT signing secret"
regex = '''(?i)(jwt[_-]?secret|jwt[_-]?key)\s*[=:]\s*["\']?[A-Za-z0-9+/]{32,}'''
tags = ["auth", "secret"]
severity = "CRITICAL"

[[rules]]
id = "aframp-api-key"
description = "Aframp API key pattern"
regex = '''afr_[a-zA-Z0-9]{32,}'''
tags = ["api-key"]
severity = "HIGH"

[allowlist]
description = "Allowlisted patterns that are not real secrets"
regexes = [
    # Test/example values
    '''postgres://postgres:postgres@localhost''',
    '''redis://127\.0\.0\.1''',
    # Placeholder values in documentation
    '''your[_-]?secret[_-]?here''',
    '''<your[_-]?api[_-]?key>''',
]
paths = [
    ".env.example",
    "docs/",
    "examples/",
]