# gitleaks config — straw
#
# Straw is a YouTube Android client. Patterns flagged:
#  - SharedPreferences key constants — identifier strings, not credentials
#  - GOOGLE_API_KEY in PoTokenWebView.kt — the InnerTube public API key
#    every YouTube client (web, Android, iOS, NewPipe, all forks) ships
#    hardcoded. Public-by-design; YouTube enforces auth via other channels.

[extend]
useDefault = true

[allowlist]
description = "Public InnerTube API key + SharedPreferences key-name constants"
regexTarget = "line"
regexes = [
    # InnerTube hardcoded key, public on every YouTube client
    '''GOOGLE_API_KEY\s*=\s*"AIza[A-Za-z0-9_-]{35}"''',
    # Any const val whose name contains KEY — these are SharedPreferences
    # / request-tag identifier strings, never credentials
    '''(private\s+)?const\s+val\s+\w*KEY\w*\s*=\s*"''',
]