22 lines
865 B
TOML
22 lines
865 B
TOML
# gitleaks config — aldabra
|
|
#
|
|
# Why: the gitleaks `generic-api-key` rule flags high-entropy hex strings.
|
|
# Cardano governance / policy / asset / script identifiers are 28-byte
|
|
# blake2b hashes (56 hex chars), which trip the rule even though they are
|
|
# public on-chain values — script hashes are derivable from validator
|
|
# bytecode that ships in the repo. They are NOT secrets.
|
|
#
|
|
# Add new allowlist entries here when CI catches more false-positive
|
|
# patterns. Real secrets (signing keys, mnemonics, API tokens) still
|
|
# trip the rule because their syntactic context (Bech32 prefixes,
|
|
# private_key fields, env-var names) doesn't match these regexes.
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[allowlist]
|
|
description = "Cardano gov_token_policy / policy_id IDs are public blake2b script hashes"
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''gov_token_policy:\s*"[a-f0-9]{56}"''',
|
|
]
|