# gitleaks ignore list
#
# The secret scan is a BLOCKING gate. A finding that is not in this file reds
# the pull request, which is the point: a leaked credential must not be
# something a reviewer can scroll past.
#
# Each entry is a triaged false positive and MUST carry a comment explaining
# why the match is benign. If a finding cannot be justified, do not add it
# here — rotate the secret and remove it from the source.
#
# Format: <repo-relative-path>:<rule-id>:<start-line>
#
# Two things about that format, learned the hard way:
#
#   * It is an exact fingerprint. A path on its own matches nothing — gitleaks
#     compares the whole `path:rule:line` string — so there is no way to
#     exempt a file wholesale from this file.
#   * Because the line number is part of it, an edit that shifts a line in one
#     of these files invalidates its entry and the scan goes red on a finding
#     that was already triaged. Four of the six entries this list held before
#     the gate became blocking had rotted exactly that way and were silently
#     suppressing nothing. When that happens the fix is to correct the line
#     number, never to drop the entry or relax the job.

# ── Detection content ─────────────────────────────────────────────────────

# detections/rule-ids.lock.json pins (category, slug) -> rule id so that
# regenerating the corpus cannot renumber an existing rule. The *keys* are
# rule slugs, and the detections that hunt for credential abuse are named
# after what they detect — "ai-prompt-contained-credential",
# "api-key-leak-in-request", "slack-token-exposed". The values are rule ids
# of the form det-application-085. Nothing in this file is a secret; the
# heuristic is firing on the slug, not on the value.
detections/rule-ids.lock.json:generic-api-key:4
detections/rule-ids.lock.json:generic-api-key:10
detections/rule-ids.lock.json:generic-api-key:15
detections/rule-ids.lock.json:generic-api-key:19
detections/rule-ids.lock.json:generic-api-key:22
detections/rule-ids.lock.json:generic-api-key:39
detections/rule-ids.lock.json:generic-api-key:53
detections/rule-ids.lock.json:generic-api-key:54
detections/rule-ids.lock.json:generic-api-key:65
detections/rule-ids.lock.json:generic-api-key:67
detections/rule-ids.lock.json:generic-api-key:82

# Positive test fixture for the `jwt-none-alg` detection rule. This file is
# *expected* to contain a JWT with `alg: none` because the detection engine
# runs against it as ground truth.
detections/fixtures/positive/jwt-none-alg.json:jwt:2

# osquery FIM fixtures. `node_key` is osquery's enrollment identifier and
# these carry the literal "abc123def456" — the field name is what matches.
# Each rule ships a positive and a negative fixture, hence four entries.
detections/fixtures/negative/fim-binary-dropped-writable-dir.json:generic-api-key:5
detections/fixtures/negative/fim-sensitive-file-modified.json:generic-api-key:5
detections/fixtures/positive/fim-binary-dropped-writable-dir.json:generic-api-key:5
detections/fixtures/positive/fim-sensitive-file-modified.json:generic-api-key:5

# Detection rule positive sample: an `alg: none` JWT used to validate the
# matching detection rule. Same fixture pattern as jwt-none-alg.json.
scripts/detection_specs_part2.py:jwt:1111

# ── Infrastructure and CI ─────────────────────────────────────────────────


# The disaster-recovery job's BACKUP_ENCRYPTION_KEY used to be a committed
# 64-hex constant and needed an entry here. It is generated per run now, so
# there is nothing to exempt — which is the better outcome whenever it is
# available. The entry was invalidated twice in one pull request by
# unrelated edits shifting its line, which is what prompted the change.

# Connector setup doc showing the curl an operator runs to check their Orca
# credential. The value is the literal placeholder "YOUR_TOKEN".
apps/docs/docs/connectors/orca.md:curl-auth-header:121

# ── Test fixtures ─────────────────────────────────────────────────────────

# The support-bundle redaction tests assert that credential shapes are
# stripped from a bundle before it leaves the host. Their corpus therefore
# has to contain things that look like credentials — a sample JWT, a PEM
# header, and AWS's own published example key AKIAIOSFODNN7EXAMPLE. A scanner
# matching them is the test data doing its job.
#
# The same body, `IOSFODNN7EXAMPLE`, is published by AWS under both prefixes:
# AKIA for a permanent key and ASIA for a temporary STS one. The session
# fixtures use the ASIA form because the code under test reads an access key
# id out of a CloudTrail `userIdentity` to key a session, so the value has to
# be key-shaped or the assertion proves nothing. AWS rejects it —
# `sts:GetCallerIdentity` answers InvalidClientTokenId — and GitHub secret
# scanning alert #1 is resolved as a false positive on that evidence.
tests/test_support_bundle.py:jwt:44
tests/test_support_bundle.py:private-key:62
tests/test_support_bundle.py:generic-api-key:112

# The session fixtures named by the paragraph above. Each is the literal
# `ASIAIOSFODNN7EXAMPLE` standing in for the `accessKeyId` a CloudTrail
# `userIdentity` carries, because that field is the session key and a
# fixture that holds something other than a key-shaped value would assert
# the deriver works on input it will never see.
services/fusion/tests/test_sessions.py:aws-access-token:162
services/fusion/tests/test_sessions.py:aws-access-token:166
services/fusion/tests/test_sessions.py:aws-access-token:178
services/fusion/tests/test_sessions.py:aws-access-token:179
services/ingest/internal/graph/session_test.go:aws-access-token:97
services/ingest/internal/graph/session_test.go:aws-access-token:100
services/ingest/internal/graph/session_test.go:aws-access-token:118
services/ingest/internal/graph/session_test.go:aws-access-token:121
services/ingest/internal/graph/session_test.go:aws-access-token:132
services/ingest/internal/activity/session_test.go:aws-access-token:203
services/ingest/internal/activity/session_test.go:aws-access-token:207
services/ingest/internal/activity/session_test.go:aws-access-token:285

# Asserts that `api_key = '...'` in an LLM response is classified as a leak.
# The string is "sk-AbCdEf0123456789xyz", invented for the assertion.
services/agents/tests/test_llm_contract_extra.py:generic-api-key:185

# Pre-generated Fernet keys used as deterministic test defaults. Real
# deployments inject AISOC_CREDENTIAL_KEY as a secret at runtime; these values
# are never used outside tests.
services/api/tests/test_dev_mode_unification.py:generic-api-key:57
services/api/tests/test_dev_mode_unification.py:generic-api-key:283
services/api/tests/test_dev_mode_unification.py:generic-api-key:297
services/api/tests/test_dev_mode_unification.py:generic-api-key:348
services/api/tests/test_dev_mode_unification.py:generic-api-key:362
services/api/tests/test_security_defaults.py:generic-api-key:36

# Placeholder PEMs. Each is a PEM header and footer wrapped around the
# literal "XYZ" or "stub" — the vault test only checks that a nested field
# named private_key is encrypted, and the connector tests mock the signer.
services/api/tests/test_credential_vault.py:private-key:47
services/connectors/tests/connectors/test_oci.py:private-key:39
services/connectors/tests/connectors/test_snowflake.py:private-key:17

# Kubernetes audit connector config fixture; "tok-abcdef-1234567890" is an
# invented inbox token for a schema assertion.
services/connectors/tests/test_kubernetes_audit.py:generic-api-key:218

# Evidence-bundle test fixture. "test-signing-key-at-least-32-characters-long" is a
# literal the suite signs with so it can then prove a *different* key fails to verify;
# it authenticates nothing and exists in no deployment.
services/api/tests/test_evidence_bundle.py:generic-api-key:26

# Depth 4.2 (#1322): the TAXII live job's signing secret is a CI-only literal
# that names itself as one; the workflow's Postgres and app both live and die
# inside the job. Not a credential for anything reachable.
.github/workflows/taxii-live.yml:generic-api-key:51

# Rule-id lock entries: `"<slug>": "det-threat-anomaly-NNN"` pins a detection
# rule's id so regeneration cannot renumber it. The scanner's key/value
# heuristic reads the pair as an api key; it is a rule identifier in a
# generated lock file.
detections/rule-ids.lock.json:generic-api-key:841
detections/rule-ids.lock.json:generic-api-key:854
