generated from mathias/template-go-web
mathias
f136cdfc99
CD / Lint / Test / Vet (push) Successful in 6s
The estate-wide secret scan (infra#316) flags a fixture value in this repo as a credential. Verified by reading the surrounding code that it is not one, then scoped an allowlist to it. Scoped by BOTH path and pattern (condition = "AND"), never path alone: a path-only allowlist would blind this file to a future REAL secret, which is how a live token hid inside a file whose name read as safe (infra#256). Allowlist by shape, not by filename. Adds .gitleaks.toml where there was none, so this repo is no longer scanned with bare defaults.
27 lines
1009 B
TOML
27 lines
1009 B
TOML
# gitleaks config for the jepa-fx-risk repo (infra#317).
|
|
#
|
|
# Runs gitleaks' full default ruleset and allowlists one non-credential
|
|
# constant, scoped by BOTH path and pattern (condition = "AND") so a different
|
|
# secret in the same files still fires. Allowlist by shape, not by filename.
|
|
|
|
title = "jepa-fx-risk gitleaks config"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# METRIC_KEY is the metrics-pipeline identifier
|
|
# ("VaR_breach_rate_99_oos_regime_cond") that train.py's VaR eval block writes
|
|
# into metrics.json -- documented in var_breach.py's own comment. It trips
|
|
# generic-api-key purely because the variable name ends in _KEY and the value
|
|
# is long and mixed-case enough to pass the entropy heuristic. It is not a
|
|
# credential and has no secret analogue.
|
|
[[allowlists]]
|
|
description = "infra#317 — METRIC_KEY is a metrics identifier, not a credential"
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = [
|
|
'''(^|/)scripts/var_breach\.py$''',
|
|
'''(^|/)tests/test_var_metric\.py$''',
|
|
]
|
|
regexes = ['''METRIC_KEY''']
|