Palash Debnath
b37466b2e5
Restore weekly full-history gitleaks scans by allowlisting only the exact cryptography type name Ed25519PrivateKey, with an exact-value regression guard and changelog entry.
31 lines
1.4 KiB
TOML
31 lines
1.4 KiB
TOML
# Gitleaks config — extends the default ruleset.
|
|
#
|
|
# Every entry below is an exact, anchored non-secret value. PostHog's
|
|
# publishable project token is public by design (owner decision 2026-07-20,
|
|
# #1193). Per PostHog's docs the `phc_` project
|
|
# token is a write-only client key with "no access to your private data" —
|
|
# it ships in every release binary and every official PostHog SDK snippet.
|
|
# It is NOT a credential. Personal keys (`phx_`) remain fully banned.
|
|
# `tests/test_no_committed_analytics_token.py` separately pins the literal to
|
|
# exactly two canonical files and requires both to carry the same value.
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Exact public/test literals misclassified as generic API keys"
|
|
regexes = [
|
|
# Public PostHog project token; personal `phx_` keys remain banned.
|
|
'''^phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9$''',
|
|
# Reviewed immutable Hugging Face commit for the Higgs tokenizer.
|
|
'''^528e871c2a26c4f0f7773b9754e2e1acae20899d$''',
|
|
# Deliberately synthetic fixtures that exercise HF-token redaction/storage.
|
|
'''^hf_abcdefghijklmnopqrstuvwxyz01234567890abcd$''',
|
|
'''^hf_abcdefghijklmnopqrstuvwxyz0123456789ABCDEF$''',
|
|
'''^hf_QWERTYUIOPasdfghjklZXCVBNM0123456789xyzAB$''',
|
|
# NLLB generation length argument, not the value of a credential.
|
|
'''^max_length=400$''',
|
|
# cryptography's Ed25519 private-key type name, not key material.
|
|
'''^Ed25519PrivateKey$''',
|
|
]
|