uatp/.gitleaks.toml at main · KayronCalloway/uatp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# GitLeaks configuration for UATP Capsule Engine
title = "UATP Capsule Engine GitLeaks Config"

[extend]
useDefault = true

[allowlist]
description = "Allowlist for known safe patterns"
paths = [
    # Test and example files
    '''.*test.*''',
    '''.*example.*''',
    '''.*\.md$''',
    '''docs/.*''',
    # Minified JS libraries - false positives
    '''.*\.min\.js$''',
    '''.*vis-network.*''',
    '''.*node_modules.*''',
    '''frontend/public/lib/.*''',
    '''public/lib/.*''',
    '''visualizer/lib/.*''',
    '''src/lib/.*''',
    # Lock files
    '''package-lock\.json$''',
    '''poetry\.lock$''',
    # Infrastructure config (placeholder values)
    '''infra/.*''',
    '''\.github/workflows/.*''',
    '''docker-compose.*''',
    '''.*\.env\.example$''',
    '''.*\.env\.sample$''',
    # Files with mock/test data that trigger false positives
    '''frontend/src/components/platform/platform-dashboard\.tsx''',
    '''src/security/secrets_manager\.py''',
    '''src/config/secrets\.py''',
]

regexes = [
    # Placeholder connection strings
    '''localhost''',
    '''127\.0\.0\.1''',
    '''example\.com''',
    '''your-.*-here''',
    '''changeme''',
    '''password''',
    '''uatp_password''',
    '''uatp_user''',
    # Test keys and mock data
    '''sk-[0]+''',
    '''sk-proj-\.\.\.''',
    '''sk-test\d*''',
    '''test.*key''',
    '''demo.*key''',
    '''placeholder''',
    '''mypassword\d*''',
    '''abcdef\d*''',
    # Environment variable names (not values)
    '''ENV_\w+_KEY''',
    '''OPENAI_API_KEY''',
]

# Stopwords - common false positive strings
stopwords = [
    "sk-proj-",
    "sk-test",
    "mypassword",
    "abcdef123456",
    "xyz123",
    "key_preview",
]