# Gitleaks Ignore File
# ─────────────────────────────────────────────────────────────────
# Add fingerprints here to suppress known false positives.
# Each entry must be justified with a comment explaining why.
#
# To get a fingerprint, run: gitleaks detect --report-format json
# and copy the "Fingerprint" field from the finding.
#
# Format: one fingerprint per line, comments on separate lines.
#
# Review this file periodically to ensure suppressions are still valid.
# ─────────────────────────────────────────────────────────────────

# Unit test dummy values — not real secrets
# AuditLedgerServiceTest: Map.of("apiKey", "REDACTED")
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/engine/audit/AuditLedgerServiceTest.java:generic-api-key:155
# AuditLedgerServiceExtendedTest: innerMap.put("apiKey", "REDACTED")
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/engine/audit/AuditLedgerServiceExtendedTest.java:generic-api-key:68
# RestSecretStoreTest: KekRotationRequest with dummy test keys
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:404
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:413
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:423
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:427
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:445
# RestSecretStoreTest rotateKek tests — from vault-reset-and-passthrough PR
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:404
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:413
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:423
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:427
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:445

# OpenAI-compatible adapter docs — placeholder credentials in examples, never real.
# Gitleaks scans the PR's commit history, so fixing the working tree in a later
# commit cannot clear a finding from an earlier one; these entries cover the
# commits that introduced them. The examples themselves have since been changed
# to use $EDDI_API_KEY / os.environ so no future commit re-triggers the rule.
#
# docs/open-webui-integration.md: two curl examples that passed a placeholder
# bearer token inline. (Not quoted here -- the rule matches this file too.)
3b384d99d6c6a5ef652a4294618fa9df16b753df:docs/open-webui-integration.md:curl-auth-header:56
3b384d99d6c6a5ef652a4294618fa9df16b753df:docs/open-webui-integration.md:curl-auth-header:60
# planning/openai-api-adapter-plan.md: the same two curl examples, plus a
# generic-api-key hit on the literal "<api-key>" placeholder in an ASCII
# request diagram.
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:generic-api-key:138
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:curl-auth-header:791
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:curl-auth-header:795
# The justification comment above originally quoted the offending example
# verbatim, so the rule matched this file too. The quote is gone now, but the
# commit that carried it stays in history and still needs an entry.
36e741846f2fcf3e25aa3bcb6efca0feeba69dd0:.gitleaksignore:curl-auth-header:38

# SecretScrubberTest: a dummy OpenAI-shaped literal used to prove that a
# credential in a secret-named field is still redacted. It was replaced in a
# follow-up commit with a low-entropy value (a better test — a key-shaped value
# could be redacted by the entropy heuristic instead, passing for the wrong
# reason), but gitleaks scans a PR's whole commit range, so the commit that
# introduced the line stays in history and still needs an entry. Not a real key:
# it never authenticated against anything.
eebfe898b34858918d5cbbe11e60336d1b6a916e:src/test/java/ai/labs/eddi/secrets/sanitize/SecretScrubberTest.java:generic-api-key:238

# ResolvedRequestTest: the same mistake as the SecretScrubberTest entry above,
# made again. Tests proving that a credential in a request BODY is redacted need
# a literal carrying SecretRedactionFilter's `sk-` + 20-char shape, and the first
# version used a realistic-looking one. Replaced in a follow-up commit with a
# zero-entropy value (repeated characters — same shape, nothing for the scanner
# to flag), but gitleaks scans a PR's whole commit range, so the commit that
# introduced it stays in history and still needs an entry. Never a real key: it
# never authenticated against anything.
96df3c83fa449e02250c08c1aa420a11617f2ebb:src/test/java/ai/labs/eddi/modules/apicalls/impl/ResolvedRequestTest.java:generic-api-key:193

# AgentSetupVaultKeyReuseTest: the same mistake as the two entries above, made
# a third time. The fixture standing in for a provider API key was written as a
# realistic "sk-live-" + hex literal, which is precisely the shape a real leaked
# key takes. Renamed in a follow-up commit to a value that reads as a fixture,
# but gitleaks scans a PR's whole commit range, so the commit that introduced it
# stays in history and still needs an entry. Never a real key: nothing in these
# tests authenticates against anything — the value is compared for equality and
# hashed for a checksum, and any string would do.
30ff68d1d2eaa568e7399fa24dc6acf7315b30f6:src/test/java/ai/labs/eddi/engine/setup/AgentSetupVaultKeyReuseTest.java:generic-api-key:50

# ConnectionStoreFindByNameTest: not a credential at all, and not even a
# credential-shaped literal — a 24-character MongoDB ObjectId standing in for a
# stored connection's document id. What tripped the atlassian-api-token rule was
# the CONSTANT NAME: a provider name sitting next to a hex blob is the shape the
# rule looks for, whatever the blob actually is. Renamed in a follow-up commit to
# one that says what the value is and leaves the provider out of it, but gitleaks
# scans a pull request's whole commit range, so the introducing commit still needs
# an entry. Carried by PR #711 (SaaS connectors).
# Never a key: the value is a document id used to look a row up.
#
# Note this comment deliberately does NOT quote the old declaration. The first
# version of it did, and the allowlist promptly became a finding of its own —
# see the entry below for the commit that carried it.
2c8c512a84cc1b3e60cd8bac18b4437728bc282b:src/test/java/ai/labs/eddi/configs/connections/mongo/ConnectionStoreFindByNameTest.java:atlassian-api-token:50

# The allowlist entry above, in the commit where its explanation still quoted the
# `JIRA_ID = "<hex>"` declaration it was explaining. The comment no longer does,
# but that commit is still in the scan range of PR #711.
0c228141ecfcaf0270190b557dafa2aea0d09eab:.gitleaksignore:atlassian-api-token:85

# MongoOAuthStateStoreTest / PostgresOAuthStateStoreUnitTest: the fixture standing
# in for a single-use OAuth `state` was written as a short random-looking string
# next to a constant named STATE_TOKEN — a value shape and a name that together
# are exactly what generic-api-key is built to match. Replaced in a follow-up
# commit with a zero-entropy value (repeated characters: same shape, nothing for
# the scanner to weigh), but the introducing commit stays in #711's scan range.
# Never a credential: an OAuth state is a correlation nonce, compared for equality
# and then discarded, and any string does the job.
0c228141ecfcaf0270190b557dafa2aea0d09eab:src/test/java/ai/labs/eddi/connections/oauth/MongoOAuthStateStoreTest.java:generic-api-key:62
0c228141ecfcaf0270190b557dafa2aea0d09eab:src/test/java/ai/labs/eddi/connections/oauth/PostgresOAuthStateStoreUnitTest.java:generic-api-key:57

# The entries from here to the PR #750 block were added on main ahead of the PRs
# that need them: the Secret Scanning job restores .gitleaksignore from the base
# branch, so a PR cannot allowlist its own false positives. (The PR #840 block at
# the end of the file is byte-identical to the one that PR carries, so the two
# merge cleanly.)
#
# PR #835 (fix/outbound-http-hardening): WeatherToolExtendedTest proves that the
# operator's OpenWeatherMap key never reaches the model or the log, so it needs a
# stand-in key, held in a constant whose name matches generic-api-key. Not a
# credential: it is injected by reflection and only ever compared as a string.
83925a9d79578ba48035d498809a9170cce6bc9c:src/test/java/ai/labs/eddi/modules/llm/tools/impl/WeatherToolExtendedTest.java:generic-api-key:349

# PR #838 (fix/secret-scope-vault): the same fixture token in two secret-scope
# tests, standing in for a value a user enters under scope "secret" so the tests
# can assert it is vaulted and scrubbed, never stored in plaintext. Not a
# credential: the vault in these tests is a mock and nothing authenticates.
17dc35a03839d54d53899cbcd45b0f531d2dacd9:src/test/java/ai/labs/eddi/modules/apicalls/impl/PrePostUtilsSecretScopeTest.java:generic-api-key:46
17dc35a03839d54d53899cbcd45b0f531d2dacd9:src/test/java/ai/labs/eddi/modules/properties/impl/PropertySetterTaskSecretScopePathsTest.java:generic-api-key:57

# PR #847 (fix/deployment-defaults): install.sh probes a running Grafana with the
# factory-default admin/admin login and, if it still answers, rotates it to the
# generated GRAFANA_ADMIN_PASSWORD. curl-auth-user matches the basic-auth flag on
# those two requests (the probe and the password change), in the two installer
# paths that do this (already-running and fresh install). Not a secret: it is
# Grafana's published default, and the code exists to retire it.
d3314417def3ce358c67a97523f222dcd043c0ae:install.sh:curl-auth-user:1391
d3314417def3ce358c67a97523f222dcd043c0ae:install.sh:curl-auth-user:1398
a7bd541e7e9c66569db78909a0afad3c64b730f7:install.sh:curl-auth-user:1798
a7bd541e7e9c66569db78909a0afad3c64b730f7:install.sh:curl-auth-user:1805

# PR #750 (fix/e2e-test-findings): fake keys in two audit-redaction test fixtures,
# assigned to a constant whose name matches generic-api-key. Not credentials. The
# values were rewritten to low-entropy strings in a later commit of the same PR;
# these entries cover the commit that introduced them, which stays in the scan
# range (not quoted here -- the rule would match this file too).
22c380c2878ab9c2227b39b17fb34ce20991b758:src/test/java/ai/labs/eddi/engine/audit/TurnAuditBufferTest.java:generic-api-key:25
22c380c2878ab9c2227b39b17fb34ce20991b758:src/test/java/ai/labs/eddi/engine/runtime/internal/ConversationHitlCoverageTest.java:generic-api-key:211

# PR #840 (fix/workspace-authz-scoping): a 32-character hex stand-in for the random
# part of an export archive key, in RestExportServiceTest, assigned to a local whose
# name matches generic-api-key. Not a credential. A later commit of the same PR
# replaced it with a low-entropy value under another name; this entry covers the
# commit that introduced it, which stays in the scan range.
8f0cf257a751dbfad5e5795dce125a8eef2d521e:src/test/java/ai/labs/eddi/backup/impl/RestExportServiceTest.java:generic-api-key:546

# PR #956 (feat/nats-cluster, squash-merged as 775edae28): three rows of the MSW
# cluster mock's lease table in ui/manager/src/test/mocks/cluster-handlers.ts. The
# "key" field is a NATS KV lease key -- "c." plus a made-up conversation id in
# Mongo ObjectId form -- and generic-api-key matches it by field name. Not a
# credential: it is mock data for the Manager's cluster page, and the same ids
# appear in the rows' conversationId fields. The push scan of main checks the
# squash commit, so the entries name it (not quoted here -- the rule would match).
775edae28719023b3f745c909f4d93d4d8cd3a65:ui/manager/src/test/mocks/cluster-handlers.ts:generic-api-key:83
775edae28719023b3f745c909f4d93d4d8cd3a65:ui/manager/src/test/mocks/cluster-handlers.ts:generic-api-key:84
775edae28719023b3f745c909f4d93d4d8cd3a65:ui/manager/src/test/mocks/cluster-handlers.ts:generic-api-key:85

# docs/security-review.md, PR #1088 (fix/security-review-runtime): the generic-api-key rule
# matched prose in a table row of the published review summary ("caller-token confused
# deputy, A2A/ownership gaps" -- the word token followed by a comma-separated phrase of
# high enough entropy). It is a sentence, not a credential; the row is reworded in the
# next commit, and this names the commit that carried the original wording.
298c30e59f7a13776add72f273071f1530692e1b:docs/security-review.md:generic-api-key:82

# PR #1094 (fix/security-review-secrets-redaction): three stand-in credentials in
# two read-redaction tests -- a Slack bot token and a signing secret in
# RestChannelIntegrationStoreReadRedactionTest, a form-encoded client secret in
# ConfigSecretRedactorTest -- written as realistic-looking literals next to the
# field names the tests exist to redact, which is exactly what generic-api-key
# matches. Replaced in a follow-up commit of the same PR with repeated-word values
# (same shape for the redactor, nothing for the scanner to weigh), but gitleaks
# scans the PR's whole commit range, so the commit that introduced them stays in
# it and still needs these entries. Never credentials: the redactor is exercised
# in-process and nothing authenticates against anything.
208f94acb767db40428b106dd20a3e1116a19471:src/test/java/ai/labs/eddi/configs/channels/rest/RestChannelIntegrationStoreReadRedactionTest.java:generic-api-key:62
208f94acb767db40428b106dd20a3e1116a19471:src/test/java/ai/labs/eddi/configs/channels/rest/RestChannelIntegrationStoreReadRedactionTest.java:generic-api-key:78
208f94acb767db40428b106dd20a3e1116a19471:src/test/java/ai/labs/eddi/secrets/sanitize/ConfigSecretRedactorTest.java:generic-api-key:202
