.gitleaks.toml allowlists the exact phc_ literal (write-only client key,
public by PostHog's design; #1193) — regex-based so history scans pass
too — plus gitleaks:allow inline markers. phx_ personal keys stay banned;
the guard test still pins the literal to the two canonical files.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>