2 Commits

Include renames

Author	SHA1	Message	Date
mathias	e1169e2c80	fix(scan): drop the paths clause that granted whole-file immunity ... infra#344. gitleaks ORs the clauses of a GLOBAL `[[allowlists]]` block and does not honour `condition = "AND"` there, so the `paths` entry suppressed EVERY finding in the named file — not only the false positive the `regexes` line describes. The regex alone is what was meant, and it works regardless of which file the value turns up in (infra#256). Verified rather than assumed, with a control for the probe itself: a live-shaped credential planted in the formerly-exempt file scans clean before this change and fires after it, and the same shape fires in a neutral path both ways (so "not detected" cannot be mistaken for "immune"). The intended false positive is still suppressed — the tree scans clean. Refs: mathias/infra#344, mathias/infra#256, mathias/infra#317	2026-08-31 07:23:55 +02:00
mathias	f136cdfc99	security: allowlist the known test fixture gitleaks flags (infra#317) ... The estate-wide secret scan (infra#316) flags a fixture value in this repo as a credential. Verified by reading the surrounding code that it is not one, then scoped an allowlist to it. Scoped by BOTH path and pattern (condition = "AND"), never path alone: a path-only allowlist would blind this file to a future REAL secret, which is how a live token hid inside a file whose name read as safe (infra#256). Allowlist by shape, not by filename. Adds .gitleaks.toml where there was none, so this repo is no longer scanned with bare defaults.	2026-08-29 11:42:27 +02:00