.gitleaks.toml

title = "taiko-mono gitleaks config"

[extend]
useDefault = true

# Deliberately conservative. Every pattern and path below was verified against
# the full-history scan: none contained a real credential — only public
# on-chain contract addresses, well-known local-devnet/foundry test keys (public
# by design, hold no real funds), the public GoldenTouch protocol key, and
# ABI-encoded calldata blobs that merely look like high-entropy hex. Anything
# not matched here stays flagged rather than risk silencing a real finding.

[allowlist]
description = "Public blockchain data and known test keys — not real secrets"
regexTarget = "line"
regexes = [
  # Ethereum addresses (0x + exactly 40 hex): public contract/account addresses
  # in Solidity address libs, Go/Rust bindings, docs, READMEs and .env examples.
  # A real leaked private key is 64 hex chars, so this never matches one.
  '''0x[a-fA-F0-9]{40}([^a-fA-F0-9]|$)''',

  # Standard Hardhat/Anvil/Foundry devnet keys (accounts #0-#9 from the
  # "test test ... junk" mnemonic). Universally public, funded only on local devnets.
  '''(0x)?ac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80''',
  '''(0x)?59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d''',
  '''(0x)?5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a''',
  '''(0x)?7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6''',
  '''(0x)?47e179ec197488593b187f80a00eb0da91f1b9d0b13f8733639f19c30a34926a''',
  '''(0x)?8b3a350cf5c34c9194ca85829a2df0ec3153be0318b5e2d3348e872092edffba''',
  '''(0x)?92db14e403b83dfe3df233f83dfa3a0d7096f21ca9b0d6d6b8d88b2b4ec1564e''',
  '''(0x)?4bbbf85ce3377467afe5d46f804f221813b2bb87f24d81f60f1fcdbf7cbf4356''',
  '''(0x)?dbda1821b80551c9d65939329250298aa3472ba22feea921c0cf5d620ea67b97''',
  '''(0x)?2a871d0798f97d79848a013d4936a73bf4cc922c825d33c1cf7073dff6d409c6''',

  # GoldenTouch key: the public, protocol-fixed anchor-transaction signer.
  # Committed to contracts/bindings by design (see struct.go GoldenTouchPrivKey).
  '''(0x)?92954368afd3caa1f3ce3ead0069c1af414054aefe1ef9aeacc1bf426222ce38''',

  # Unit-test fixture key in whitelist-preconfirmation-driver: exists only to
  # assert the key is redacted from Debug output (network_config_debug_does_not_include_raw_key).
  '''(0x)?1875af8dad47674dd6897fb7bcdc1ba872144914082e02dace98dcf2ba16aa8d''',

  # Go type reference, not a value — the default generic-api-key rule matches the identifier.
  '''ecdsa\.PrivateKey''',
]

paths = [
  # Test fixtures and mocks
  '''(^|.*/)__mocks__/.*''',
  '''(^|.*/)__fixtures__/.*''',
  '''(^|.*/)tests?/mocks?/.*''',
  '''.*\.test\.(ts|tsx|js)$''',
  '''.*_test\.go$''',
  '''.*\.t\.sol$''',
  # .env templates (placeholders only; a committed real .env is NOT allowlisted)
  '''.*\.env\.(example|sample)$''',
  # OpenZeppelin Defender monitor autotasks — read secrets from event.secrets at
  # runtime; findings are on the taikoL1ApiKey/taikoL1ApiSecret variable names.
  '''packages/protocol/monitors/.*''',
  # Foundry / integration test suites and deploy scripts (public devnet keys only)
  '''packages/taiko-client/integration_test/.*''',
  '''packages/taiko-client-rs/tests/.*''',
  '''packages/taiko-client-rs/crates/test-harness/.*''',
  '''packages/taiko-client-rs/crates/.*/examples/.*''',
  '''packages/protocol/script/.*''',
  '''packages/protocol/deployments/.*''',
  '''packages/protocol/test/.*''',
  '''packages/nfts/(script|deployments|out)/.*''',
  '''packages/supplementary-contracts/script/.*''',
  '''packages/relayer/(integration_test|watchdog|processor)/.*''',
  # AI coding-assistant prompt/config docs that embed example devnet keys
  '''(^|.*/)\.codex/.*''',
  '''(^|.*/)\.claude/.*''',
  '''.*\.claude\.md$''',
]