.gitleaks.toml

# .gitleaks.toml — SZL Holdings secret-scanning allowlist.
#
# Doctrine v11 LOCKED 749/14/163 · SLSA L1 honest
# Signed-off-by: Yachay <yachay@szlholdings.ai>
# Co-Authored-By: Perplexity Computer Agent <agent@perplexity.ai>
#
# HONESTY OVER CHECKLIST: this file does NOT weaken secret detection. It uses
# the full upstream gitleaks default ruleset and only exempts demonstrable
# NON-secrets that the `generic-api-key` heuristic flags because they contain
# the substring "key":
#
#   • did:key public DID identifiers (z6Mk… multibase) — public by definition
#   • `keyid` labels (e.g. "szl-pepr-mldsa65-v1", "szlholdings-ec-p256") —
#     these name a key, they are not key material
#   • PLACEHOLDER / test signature stubs (sig bytes are 0xAB fill / "PLACEHOLDER")
#   • `receiptKeySecret: <name>` — the NAME of a Kubernetes Secret resource (the
#     real key material lives in the cluster Secret / Vault, never in git)
#   • a single DOCUMENTED demo HMAC key in AGENTS.md (base64 decodes to the
#     literal string "szl-dev-demo-key-2026-warhacker" — a throwaway demo value)
#   • problem-catalog slugs in serve.py ("key": "mesh-k1-failure" etc.) — these
#     are short kebab-case identifiers in a static problem list, not credentials
#   • test-fixture private keys under testdata/ (*.test.key) — mock keys
#   • Python TYPE ANNOTATIONS naming a key class (e.g. `private_key:
#     "Ed25519PrivateKey"`) — these are forward-ref type hints, NOT key material
#   • SHA-256 fingerprints of PUBLIC cosign keys (the a11oy verifiable-corpus
#     key-rotation trust set + documented ephemeral-orphan key). A sha256 digest
#     of a public PEM is public by definition — not key material. Only exempted
#     when the value is exactly 64 lowercase-hex chars (a sha256 digest) AND the
#     surrounding name says sha256 / fingerprint / orphan_key. See
#     docs/KEY_ROTATION.md and .github/hf-corpus-guards.json.
#
# Real credentials (tokens, private keys, cloud secrets) remain fully detected.

[extend]
useDefault = true

[allowlist]
description = "SZL non-secret identifiers and test/placeholder stubs"
regexTarget = "line"

regexes = [
  # Public DID key identifiers (did:key multibase, public by definition).
  '''did:key:z6Mk[1-9A-HJ-NP-Za-km-z]+''',
  # `keyid` / key-id LABELS — these NAME a key, they are not key material.
  '''(?i)(keyid|key[_-]?id|signing_key_id|listingkey)["']?\s*[:=]\s*["'`]?[A-Za-z0-9._-]+["'`]?''',
  # `receiptKeySecret: <name>` names a Kubernetes Secret resource, not a secret.
  '''(?i)receiptKeySecret["']?\s*:\s*["'`]?[A-Za-z0-9._-]+["'`]?''',
  # Static problem-catalog slugs in serve.py (kebab-case ids, not credentials).
  '''"id":\s*"P\d+",\s*"key":\s*"[a-z0-9][a-z0-9-]*"''',
  # Single DOCUMENTED demo HMAC key (decodes to "szl-dev-demo-key-2026-warhacker").
  '''SZL_HMAC_KEY=c3psLWRldi1kZW1vLWtleS0yMDI2LXdhcmhhY2tlcg==''',
  # Explicit placeholder / unsigned stub markers.
  '''PLACEHOLDER-NOT-SIGNED''',
  # Python type ANNOTATION naming a key class (forward-ref string hint), NOT a
  # secret: e.g. `private_key: "Ed25519PrivateKey"` in a function signature.
  '''(?i)private_key\s*:\s*["']Ed25519PrivateKey["']''',
  # SHA-256 fingerprints of PUBLIC cosign keys (corpus key-rotation trust set +
  # documented ephemeral-orphan key). Exempted ONLY when the value is exactly a
  # 64-hex sha256 digest AND the name says sha256 / fingerprint / orphan_key —
  # a public-key digest is not a credential. Real 64-hex tokens are not named so.
  '''(?i)(sha256|fingerprint|orphan_key)["']?\s*[:=]\s*["'][0-9a-f]{64}["']''',
]

# Stopwords — exempt specific DOCUMENTED non-secret literals by their value,
# independent of the finding's line context. gitleaks' line-target allowlist
# regexes above rely on a populated `Line` field; for a few problem-catalog slugs
# that field can come back empty (a known gitleaks quirk that surfaces when
# unrelated additive edits shift byte offsets), so the regex exemption silently
# misses. These kebab-case slugs are static identifiers in the serve.py problem
# catalog (NOT credentials), already documented in the header above; listing the
# exact value here is a content-based exemption that does NOT weaken detection of
# any real token. (Wave-O Dev3: additive, honest.)
stopwords = [
  "mesh-k1-failure",
]

# Test fixtures legitimately carry mock key identifiers and stub signatures.
paths = [
  '''.*\.test\.ts$''',
  '''.*__tests__/.*''',
  '''.*_test\.py$''',
  '''.*/test/.*''',
  '''.*/tests/.*''',
  '''.*/testdata/.*''',
  '''.*\.test\.key$''',
]