Sulkta-OSS/straw
3
0
Fork 0
Code Issues 1 Pull requests 11 Projects Releases Packages Wiki Activity Actions

ci: broaden gitleaks allowlist — catch all variable-name patterns. Refs #300

Browse source
This commit is contained in:
Sulkta 2026-05-28 12:19:24 -07:00
parent fef3b59a5c
commit 7cccc96d20
1 changed files with 5 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
.gitleaks.toml
View file

@ -1,12 +1,10 @@
# gitleaks config — straw # gitleaks config — straw
# #
# Straw is a YouTube Android client. Patterns flagged: # Straw is a YouTube Android client. Patterns flagged:
# - SharedPreferences key constants (KEY_SB_CATS, REQUEST_KEY) — identifier # - SharedPreferences key constants — identifier strings, not credentials
# strings, not credentials
# - GOOGLE_API_KEY in PoTokenWebView.kt — the InnerTube public API key # - GOOGLE_API_KEY in PoTokenWebView.kt — the InnerTube public API key
# every YouTube client (web, Android, iOS, NewPipe, all forks) ships # every YouTube client (web, Android, iOS, NewPipe, all forks) ships
# hardcoded. Public-by-design; YouTube enforces auth via other channels # hardcoded. Public-by-design; YouTube enforces auth via other channels.
# (visitor data, po_token).
[extend] [extend]
useDefault = true useDefault = true
@ -17,6 +15,7 @@ regexTarget = "line"
regexes = [ regexes = [
# InnerTube hardcoded key, public on every YouTube client # InnerTube hardcoded key, public on every YouTube client
'''GOOGLE_API_KEY\s*=\s*"AIza[A-Za-z0-9_-]{35}"''', '''GOOGLE_API_KEY\s*=\s*"AIza[A-Za-z0-9_-]{35}"''',
# SharedPreferences keys — identifier string, not a credential # Any const val whose name contains KEY — these are SharedPreferences
'''(private\s+)?(const\s+val|val|var|final\s+(static\s+)?String)\s+(KEY|REQUEST_KEY|PREF_KEY)_[A-Z_]+\s*=''', # / request-tag identifier strings, never credentials
'''(private\s+)?const\s+val\s+\w*KEY\w*\s*=\s*"''',
] ]