.gitleaks.toml

# Secret scanning configuration for LibreDB Studio (security programme control 2.1).
#
# The full-history sweep found 24 matches across 753 commits and classified
# every one of them as a fabricated value: no credential has ever been
# committed to this repository and no rotation was required. Each is
# suppressed by exact fingerprint in `.gitleaksignore`, not here - see that
# file for the classification and the reasoning.
#
# Why fingerprints instead of a `[[allowlists]]` entry in this file: an
# allowlist scoped by `paths` exempts an entire file or directory from a rule
# forever, and one scoped by `regexes` still exempts every future occurrence
# of that literal value anywhere. A fingerprint names the one already-seen
# `commit:file:rule:startline`, so a real secret added later - even the exact
# same fabricated literal, in a new commit - produces a different fingerprint
# and is still reported. Verified 2026-08-09: a `paths = ['^tests/']`
# allowlist for the generic-api-key/jwt/private-key rules silently swallowed a
# freshly planted, real-shaped secret added to a brand-new file under tests/;
# replacing it with fingerprints in `.gitleaksignore` closed that gap while
# the full 774-commit history still scans clean.
#
# `[[allowlists]]` in this file remains available for the different problem it
# actually solves well: a rule that is unconditionally noisy for a known,
# reviewable reason (see tests/unit/gitleaks-config.test.ts for the shape
# every entry here must have - targetRules is mandatory, and `paths` is
# rejected outright in favour of `regexes` + `regexTarget` or a
# `.gitleaksignore` fingerprint). There are none of those today.

title = "LibreDB Studio secret scanning"

[extend]
# Start from gitleaks' own rule set rather than an in-repo copy: the rules move
# with the pinned scanner digest, which is what makes the verdict a pure function
# of the commit plus that digest.
useDefault = true