debpalashandClaude Fable 5
e3ed952371
.gitleaks.toml allowlists the exact phc_ literal (write-only client key, public by PostHog's design; #1193) — regex-based so history scans pass too — plus gitleaks:allow inline markers. phx_ personal keys stay banned; the guard test still pins the literal to the two canonical files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
19 lines
779 B
TOML
19 lines
779 B
TOML
# Gitleaks config — extends the default ruleset.
|
|
#
|
|
# The ONLY sanctioned allowlist entry is PostHog's publishable project token
|
|
# (owner decision 2026-07-20, #1193). Per PostHog's docs the `phc_` project
|
|
# token is a write-only client key with "no access to your private data" —
|
|
# it ships in every release binary and every official PostHog SDK snippet.
|
|
# It is NOT a credential. Personal keys (`phx_`) remain fully banned.
|
|
# `tests/test_no_committed_analytics_token.py` separately pins the literal to
|
|
# exactly two canonical files and requires both to carry the same value.
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "PostHog publishable write-only project token (public by design; #1193)"
|
|
regexes = [
|
|
'''phc_v5wMjnYMPMaEcRNLRKQsTYCzPaYWh7wcHPhXNkNajVf9''',
|
|
]
|