From e1169e2c80f38e554168011de1f4d6dfde5aba4d Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 31 Aug 2026 07:23:55 +0200 Subject: [PATCH] fix(scan): drop the `paths` clause that granted whole-file immunity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit infra#344. gitleaks ORs the clauses of a GLOBAL `[[allowlists]]` block and does not honour `condition = "AND"` there, so the `paths` entry suppressed EVERY finding in the named file — not only the false positive the `regexes` line describes. The regex alone is what was meant, and it works regardless of which file the value turns up in (infra#256). Verified rather than assumed, with a control for the probe itself: a live-shaped credential planted in the formerly-exempt file scans clean before this change and fires after it, and the same shape fires in a neutral path both ways (so "not detected" cannot be mistaken for "immune"). The intended false positive is still suppressed — the tree scans clean. Refs: mathias/infra#344, mathias/infra#256, mathias/infra#317 --- .gitleaks.toml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 7666d76..1f076e1 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -17,10 +17,11 @@ useDefault = true # credential and has no secret analogue. [[allowlists]] description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential" -condition = "AND" +# infra#344: `paths` removed. gitleaks ORs the clauses of a GLOBAL allowlist and +# does not honour `condition = "AND"` there, so the path matched on its own and +# granted the whole file immunity — every finding in it, not just this one. +# Verified: a live-shaped credential planted in that file scanned clean before +# this change and fires after it. The regex below is what was meant and works +# regardless of which file the value appears in (infra#256). regexTarget = "line" -paths = [ - '''(^|/)scripts/var_breach\.py$''', - '''(^|/)tests/test_var_metric\.py$''', -] regexes = ['''METRIC_KEY''']