gitleaks.toml

# Gitleaks configuration for stellar-stream
# Prevents accidental commits of Stellar private keys, JWT secrets, and other sensitive data

title = "Stellar Stream Gitleaks Config"

[extend]
# Use default gitleaks rules as base
useDefault = true

[[rules]]
id = "stellar-private-key"
description = "Stellar private key (S...)"
regex = '''S[A-Z2-7]{55}'''
keywords = ["stellar", "private", "key", "secret"]

[[rules]]
id = "stellar-public-key"
description = "Stellar public key (G...)"
regex = '''G[A-Z2-7]{55}'''
keywords = ["stellar", "public", "key"]

[[rules]]
id = "jwt-secret"
description = "JWT secret"
regex = '''(?i)(jwt[_-]?secret|jwt[_-]?key)["\s]*[:=]["\s]*[a-zA-Z0-9+/=]{32,}'''
keywords = ["jwt", "secret", "token"]

[[rules]]
id = "webhook-signing-secret"
description = "Webhook signing secret"
regex = '''(?i)(webhook[_-]?signing[_-]?secret|webhook[_-]?secret)["\s]*[:=]["\s]*[a-zA-Z0-9+/=]{32,}'''
keywords = ["webhook", "signing", "secret"]

[[rules]]
id = "soroban-rpc-key"
description = "Soroban RPC API key"
regex = '''(?i)(rpc[_-]?key|soroban[_-]?key)["\s]*[:=]["\s]*[a-zA-Z0-9+/=]{32,}'''
keywords = ["rpc", "soroban", "key"]

# Allowlist for known false positives
[allowlist]
description = "Known false positives"
paths = [
    "gitleaks.toml",
    "**/*.md",
    "**/*.test.ts",
    "**/*.test.js",
    "**/test/**",
    "**/tests/**",
    "**/.env.example",
    "**/snapshots/**",
    "**/test_snapshots/**"
]

# Specific allowlisted strings (example keys, test data, etc.)
regexes = [
    # Example Stellar keys in documentation
    '''GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF''',
    '''SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWHF''',
    # Test contract IDs
    '''C[A-Z2-7]{55}''',
    # Example JWT tokens in tests
    '''eyJ[a-zA-Z0-9+/=]+\.[a-zA-Z0-9+/=]+\.[a-zA-Z0-9+/=]+'''
]

# Stop scanning at certain file sizes (in bytes)
[allowlist.files]
max-target-megabytes = 10