.gitleaks.toml

# Gitleaks configuration — extends the default ruleset.
#
# The only allowlisted secrets are PUBLIC key material committed in
# src/config/environments.ts: the two KEK public keys (prod + dev) for
# client-side binary envelope encryption — base64 of the raw 32-byte X25519
# PUBLIC half. They can only *encrypt*; the private halves live solely on the
# API, never in this repo. gitleaks flags them on entropy alone
# (generic-api-key), not because it recognizes them as credentials.
#
# The two legacy Supabase anon keys (prod + dev) are also listed, but only
# because they remain in git history and CI scans the full history. The source
# no longer contains them: the CLI fetches its publishable key from the API's
# GET /cli-config at runtime (dcd#1112). Do not add a Supabase key back.
#
# They are allowlisted by EXACT VALUE, deliberately not by file path or by the
# whole `generic-api-key` rule: a KEK *private* key is the same shape as its
# public half, so a path/rule allowlist would let a genuinely sensitive key
# pasted into the same file slip through. Matching exact values keeps that
# detection intact.
#
# When a KEK is rotated, replace the corresponding value below — do not simply
# append, or the retired key stops being distinguishable from a live secret.
[extend]
useDefault = true

[allowlist]
description = "KEK public keys, and retired Supabase anon keys left in history (safe)"
regexes = [
  # retired legacy anon keys (prod, dev), history only
  '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0\.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8''',
  '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30\.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ''',
  # prod kekPublicKey v1
  '''wtfyWEwK7nJzwI4PD\+9RAW8jxIR1u8kMQq2IhsrVnH4=''',
  # dev kekPublicKey v1
  '''RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=''',
]