mirror of
https://github.com/openswarm-ai/openswarm.git
synced 2026-08-17 18:25:42 +02:00
38 lines
1.5 KiB
TOML
38 lines
1.5 KiB
TOML
# gitleaks config — see .github/workflows/gitleaks.yml
|
|
# Extend the default rule set rather than overriding it; allowlists below
|
|
# cover known-safe placeholders and historical paths still in git history
|
|
# that are slated for redaction in a separate filter-repo pass.
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Project allowlist for gitleaks"
|
|
|
|
# Frontend Settings.tsx documents the Anthropic API key prefix in onboarding
|
|
# copy ("It will start with sk-ant-api03-…") — that's instructional text, not
|
|
# a real key. Path-scoped so an actual leak elsewhere in the same file would
|
|
# still trip.
|
|
paths = [
|
|
'''frontend/src/app/pages/Settings/Settings\.tsx''',
|
|
# CDP-redaction test: its fixtures are deliberately fake `token=...` URLs it
|
|
# then asserts get redacted, so a full-history rescan keeps "finding" them.
|
|
'''electron/cdp-routes\.test\.js''',
|
|
# Vendored Python venv — never our code.
|
|
'''backend/\.venv/.*''',
|
|
# Vendored MCP server bundles (esbuild output of upstream npm packages).
|
|
'''backend/mcp-bundles/.*''',
|
|
# Bundled npm 9router (fetched from npm at build time; if a leak shows up
|
|
# here, the fix is to bump ROUTER_VERSION in scripts/fetch-router.sh, not
|
|
# to allowlist it — but until then, don't block our own PRs on it).
|
|
'''electron/build-staging/router/.*''',
|
|
# Local-only operator scratch dir, never tracked but defensive.
|
|
'''\.account-factory/.*''',
|
|
]
|
|
|
|
regexes = [
|
|
# Documentation/onboarding copy that talks about secret formats.
|
|
'''sk-ant-api03-…''',
|
|
'''sk-ant-\.\.\.''',
|
|
]
|