diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..4c3e487
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,19 @@
+# Sulkta gitleaks allowlist for this repo (a fork of ThetaDev/rustypipe).
+# These paths hold UPSTREAM YouTube API response fixtures, insta snapshot tests,
+# and the InnerTube client (which embeds the PUBLIC Google/NewPipe TV OAuth
+# secret present in every public clone). High-entropy IDs/tokens in this test
+# data false-positive as API keys. NOT Sulkta secrets.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Upstream rustypipe YouTube fixtures + InnerTube client (public, not secrets)"
+paths = [
+  '''testfiles/''',
+  '''snapshots/''',
+  '''notes/''',
+  '''codegen/''',
+  '''src/client/mod\.rs$''',
+  '''src/client2/mod\.rs$''',
+  '''gen_locales\.rs$''',
+]