Go-live readiness: verified gaps audit + launch-hardening work #4086
1 changed file+12−11
Modified.gitleaks.toml+12−11View fileUnifiedSplit
@@ -1,15 +1,16 @@
1# Gitleaks configuration for AlecRae.
2#
3# Extends the full default ruleset (real secret detection stays ON everywhere).
4# The only addition is a narrowly-scoped allowlist for the self-signed RSA
5# keypair that exists ONLY to sign SAML assertions inside the signature-
6# verification unit tests. It is throwaway test-fixture material — never used
7# in any environment, never grants access to anything.
1title = "AlecRae gitleaks config"
2
3# Extends the full default ruleset — real secret detection stays ON everywhere.
4# The only addition is a path-scoped allowlist for the self-signed RSA keypair
5# that exists ONLY to sign SAML assertions inside the signature-verification
6# unit tests. It is throwaway test-fixture material — never used in any
7# environment and grants access to nothing.
88
99[extend]
1010useDefault = true
1111
12[[allowlists]]
13description = "Self-signed, test-only IdP keypair used to sign SAML assertions in apps/api/tests/sso.test.ts (not a real secret)"
14targetRules = ["private-key"]
15paths = ['''apps/api/tests/sso\.test\.ts$''']
12[allowlist]
13description = "Test-only self-signed SAML IdP keypair in apps/api/tests/sso.test.ts (not a real secret)"
14paths = [
15 '''apps/api/tests/sso\.test\.ts''',
16]
1617
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts