.gitleaks.toml

# gitleaks configuration for stellar-raven-codemode.
#
# `scripts/scan-secrets.mjs` runs two scanners: its own layered heuristics and,
# when available, gitleaks. The custom layers exclude the generated consistency
# register via IGNORE_GLOBS; gitleaks needs the equivalent carve-out or it
# blocks commits on the register's public content hashes (first hit 2026-07-28:
# case ids ending in "auth"/"token"/"xray" put a rule keyword immediately
# before a 64-hex digest, tripping generic-api-key and jfrog-identity-token).
#
# This file EXTENDS the upstream default ruleset unmodified and attaches ONE
# config-level allowlist. The 2026-07-28 adversarial review rejected this
# file's first version, which redeclared generic-api-key by id: a same-id rule
# REPLACES the upstream rule (regex and keywords frozen at an 8.30.1 copy, the
# `credential`/`creds` keywords lost — a proven detection gap), and its
# per-rule allowlist left the same file's jfrog-identity-token matches
# unhandled, so the next register re-stamp would block the hook again. The
# config-level form below keeps every upstream rule fully intact.

[extend]
useDefault = true

# eval/qa/consistency-register.json is generated by `npm run eval:qa:register`.
# Its memberContentSha256 values are SHA-256 digests of PUBLIC eval case files
# already in this repository — they grant no access to anything. The AND
# condition means a finding is suppressed only when its detected secret is a
# bare 64-hex digest AND it sits in that one file; a real credential pasted
# into the register (AKIA…, ghp_…, and other non-64-hex shapes) still fails
# the scan, and every rule stays fully live everywhere else.
[[allowlists]]
description = "generated content-hash digests in the consistency register"
condition = "AND"
paths = ['''^eval/qa/consistency-register\.json$''']
regexes = ['''^[0-9a-f]{64}$''']
regexTarget = "secret"