.gitleaks.toml

# SPDX-License-Identifier: MPL-2.0
#
# Gitleaks configuration — hyperpolymath/gitbot-fleet
#
# EXTENDS THE ESTATE BASELINE, it does not replace it.
# `.gitleaks-estate.toml` is staged into the workspace root by
# hyperpolymath/standards `.github/workflows/secret-scanner-reusable.yml`
# before the scan runs. gitleaks resolves `[extend] path` against the process
# CWD (verified — NOT relative to this file), which is the repository root.
#
# WHY THIS FILE IS LOCAL RATHER THAN IN THE ESTATE BASELINE.
# Every entry below is a blind spot. Held here, it blinds this repository only,
# and the justification sits beside the code it describes. Promoted to the
# estate baseline it would blind all 400+ repositories — so the baseline keeps
# only entries that are true everywhere (lockfiles, vendored bundles, published
# protocol constants).
#
# Each entry names WHAT THE VALUE IS. "This file is noisy" is not a reason; if
# an entry cannot say what the matched value actually is, the secret should be
# removed from the tree instead.
#
# Every finding suppressed here was triaged on 2026-08-06 by reading the
# matched line with the value redacted. Before adding an entry, plant a
# realistic secret in the same path and confirm it is STILL detected.

[extend]
path = ".gitleaks-estate.toml"

[allowlist]
description = "hyperpolymath/gitbot-fleet: locally justified exemptions, extending the estate baseline"


paths = [
  # Unit tests for cipherbot's hardcoded-secret DETECTOR. The fixtures must
  # look like secrets or the tests cannot assert that the detector rejects
  # them.
  '''(^|/)bots/cipherbot/src/analyzers/config\.rs$''',

]