# Gitleaks Ignore File
# ─────────────────────────────────────────────────────────────────
# Add fingerprints here to suppress known false positives.
# Each entry must be justified with a comment explaining why.
#
# To get a fingerprint, run: gitleaks detect --report-format json
# and copy the "Fingerprint" field from the finding.
#
# Format: one fingerprint per line, comments on separate lines.
#
# Review this file periodically to ensure suppressions are still valid.
# ─────────────────────────────────────────────────────────────────

# Unit test dummy values — not real secrets
# AuditLedgerServiceTest: Map.of("apiKey", "REDACTED")
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/engine/audit/AuditLedgerServiceTest.java:generic-api-key:155
# AuditLedgerServiceExtendedTest: innerMap.put("apiKey", "REDACTED")
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/engine/audit/AuditLedgerServiceExtendedTest.java:generic-api-key:68
# RestSecretStoreTest: KekRotationRequest with dummy test keys
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:404
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:413
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:423
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:427
8c788f276b364f9257451f8620ff0439d0916f60:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:445
# RestSecretStoreTest rotateKek tests — from vault-reset-and-passthrough PR
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:404
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:413
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:423
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:427
06ef33aafb04c721429fef1998eb4727308bae7b:src/test/java/ai/labs/eddi/secrets/rest/RestSecretStoreTest.java:generic-api-key:445

# OpenAI-compatible adapter docs — placeholder credentials in examples, never real.
# Gitleaks scans the PR's commit history, so fixing the working tree in a later
# commit cannot clear a finding from an earlier one; these entries cover the
# commits that introduced them. The examples themselves have since been changed
# to use $EDDI_API_KEY / os.environ so no future commit re-triggers the rule.
#
# docs/open-webui-integration.md: two curl examples that passed a placeholder
# bearer token inline. (Not quoted here -- the rule matches this file too.)
3b384d99d6c6a5ef652a4294618fa9df16b753df:docs/open-webui-integration.md:curl-auth-header:56
3b384d99d6c6a5ef652a4294618fa9df16b753df:docs/open-webui-integration.md:curl-auth-header:60
# planning/openai-api-adapter-plan.md: the same two curl examples, plus a
# generic-api-key hit on the literal "<api-key>" placeholder in an ASCII
# request diagram.
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:generic-api-key:138
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:curl-auth-header:791
5283853e511b20937a13ab8a9dc13698d3ef6496:planning/openai-api-adapter-plan.md:curl-auth-header:795
# The justification comment above originally quoted the offending example
# verbatim, so the rule matched this file too. The quote is gone now, but the
# commit that carried it stays in history and still needs an entry.
36e741846f2fcf3e25aa3bcb6efca0feeba69dd0:.gitleaksignore:curl-auth-header:38

# SecretScrubberTest: a dummy OpenAI-shaped literal used to prove that a
# credential in a secret-named field is still redacted. It was replaced in a
# follow-up commit with a low-entropy value (a better test — a key-shaped value
# could be redacted by the entropy heuristic instead, passing for the wrong
# reason), but gitleaks scans a PR's whole commit range, so the commit that
# introduced the line stays in history and still needs an entry. Not a real key:
# it never authenticated against anything.
eebfe898b34858918d5cbbe11e60336d1b6a916e:src/test/java/ai/labs/eddi/secrets/sanitize/SecretScrubberTest.java:generic-api-key:238

# ResolvedRequestTest: the same mistake as the SecretScrubberTest entry above,
# made again. Tests proving that a credential in a request BODY is redacted need
# a literal carrying SecretRedactionFilter's `sk-` + 20-char shape, and the first
# version used a realistic-looking one. Replaced in a follow-up commit with a
# zero-entropy value (repeated characters — same shape, nothing for the scanner
# to flag), but gitleaks scans a PR's whole commit range, so the commit that
# introduced it stays in history and still needs an entry. Never a real key: it
# never authenticated against anything.
96df3c83fa449e02250c08c1aa420a11617f2ebb:src/test/java/ai/labs/eddi/modules/apicalls/impl/ResolvedRequestTest.java:generic-api-key:193

# AgentSetupVaultKeyReuseTest: the same mistake as the two entries above, made
# a third time. The fixture standing in for a provider API key was written as a
# realistic "sk-live-" + hex literal, which is precisely the shape a real leaked
# key takes. Renamed in a follow-up commit to a value that reads as a fixture,
# but gitleaks scans a PR's whole commit range, so the commit that introduced it
# stays in history and still needs an entry. Never a real key: nothing in these
# tests authenticates against anything — the value is compared for equality and
# hashed for a checksum, and any string would do.
30ff68d1d2eaa568e7399fa24dc6acf7315b30f6:src/test/java/ai/labs/eddi/engine/setup/AgentSetupVaultKeyReuseTest.java:generic-api-key:50

# ConnectionStoreFindByNameTest: not a credential at all, and not even a
# credential-shaped literal — a 24-character MongoDB ObjectId standing in for a
# stored connection's document id. What tripped the atlassian-api-token rule was
# the CONSTANT NAME: a provider name sitting next to a hex blob is the shape the
# rule looks for, whatever the blob actually is. Renamed in a follow-up commit to
# one that says what the value is and leaves the provider out of it, but gitleaks
# scans a pull request's whole commit range, so the introducing commit still needs
# an entry. Carried by PR #711 (SaaS connectors).
# Never a key: the value is a document id used to look a row up.
#
# Note this comment deliberately does NOT quote the old declaration. The first
# version of it did, and the allowlist promptly became a finding of its own —
# see the entry below for the commit that carried it.
2c8c512a84cc1b3e60cd8bac18b4437728bc282b:src/test/java/ai/labs/eddi/configs/connections/mongo/ConnectionStoreFindByNameTest.java:atlassian-api-token:50

# The allowlist entry above, in the commit where its explanation still quoted the
# `JIRA_ID = "<hex>"` declaration it was explaining. The comment no longer does,
# but that commit is still in the scan range of PR #711.
0c228141ecfcaf0270190b557dafa2aea0d09eab:.gitleaksignore:atlassian-api-token:85

# MongoOAuthStateStoreTest / PostgresOAuthStateStoreUnitTest: the fixture standing
# in for a single-use OAuth `state` was written as a short random-looking string
# next to a constant named STATE_TOKEN — a value shape and a name that together
# are exactly what generic-api-key is built to match. Replaced in a follow-up
# commit with a zero-entropy value (repeated characters: same shape, nothing for
# the scanner to weigh), but the introducing commit stays in #711's scan range.
# Never a credential: an OAuth state is a correlation nonce, compared for equality
# and then discarded, and any string does the job.
0c228141ecfcaf0270190b557dafa2aea0d09eab:src/test/java/ai/labs/eddi/connections/oauth/MongoOAuthStateStoreTest.java:generic-api-key:62
0c228141ecfcaf0270190b557dafa2aea0d09eab:src/test/java/ai/labs/eddi/connections/oauth/PostgresOAuthStateStoreUnitTest.java:generic-api-key:57
