From f136cdfc99f3080563323210724e9e987f6dbadd Mon Sep 17 00:00:00 2001 From: Mathias Date: Sat, 29 Aug 2026 11:42:20 +0200 Subject: [PATCH] security: allowlist the known test fixture gitleaks flags (infra#317) The estate-wide secret scan (infra#316) flags a fixture value in this repo as a credential. Verified by reading the surrounding code that it is not one, then scoped an allowlist to it. Scoped by BOTH path and pattern (condition = "AND"), never path alone: a path-only allowlist would blind this file to a future REAL secret, which is how a live token hid inside a file whose name read as safe (infra#256). Allowlist by shape, not by filename. Adds .gitleaks.toml where there was none, so this repo is no longer scanned with bare defaults. --- .gitleaks.toml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .gitleaks.toml diff --git a/.gitleaks.toml b/.gitleaks.toml new file mode 100644 index 0000000..7666d76 --- /dev/null +++ b/.gitleaks.toml @@ -0,0 +1,26 @@ +# gitleaks config for the jepa-fx-risk repo (infra#317). +# +# Runs gitleaks' full default ruleset and allowlists one non-credential +# constant, scoped by BOTH path and pattern (condition = "AND") so a different +# secret in the same files still fires. Allowlist by shape, not by filename. + +title = "jepa-fx-risk gitleaks config" + +[extend] +useDefault = true + +# METRIC_KEY is the metrics-pipeline identifier +# ("VaR_breach_rate_99_oos_regime_cond") that train.py's VaR eval block writes +# into metrics.json -- documented in var_breach.py's own comment. It trips +# generic-api-key purely because the variable name ends in _KEY and the value +# is long and mixed-case enough to pass the entropy heuristic. It is not a +# credential and has no secret analogue. +[[allowlists]] +description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential" +condition = "AND" +regexTarget = "line" +paths = [ + '''(^|/)scripts/var_breach\.py$''', + '''(^|/)tests/test_var_metric\.py$''', +] +regexes = ['''METRIC_KEY''']