From 17787082f951ab5f2699e5b996e7aa44ba0e6f40 Mon Sep 17 00:00:00 2001
From: Thomas Boni <thomas@r2devops.io>
Date: Mon, 29 Jun 2026 17:02:53 +0200
Subject: [PATCH] chore: add gitleaks config allowlisting revoked historical
 secrets

Three secrets committed in 2022 (commit d01b215d) remain in git history and
are flagged by GitHub's secret scanner:

- kratos.yml: two Kratos secrets (generic-api-key)
- local.env: a Stripe TEST key (sk_test_...)

All three have been revoked. This adds a .gitleaks.toml that extends the
default ruleset and allowlists these specific revoked values, scoped to their
files (condition = "AND") so any new/different secret is still detected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitleaks.toml | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..0caa9a7
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,37 @@
+# gitleaks configuration for the getplumber platform repo.
+#
+# Extends the built-in gitleaks ruleset and allowlists three historical
+# secrets that were committed in 2022 (commit d01b215d) and have since been
+# REVOKED. They remain in git history, so the scanner keeps flagging them;
+# allowlisting the specific revoked values clears the alerts without
+# weakening detection of any new secret.
+#
+# Scoping note: each allowlist requires BOTH a path match AND the exact
+# revoked value (condition = "AND"), so a different/real secret in these same
+# files would still be reported.
+
+title = "getplumber platform"
+
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Revoked Kratos secrets in kratos.yml (committed 2022, rotated)"
+condition = "AND"
+paths = [
+  '''kratos\.yml$''',
+]
+regexes = [
+  '''^76339ebbf0f15102a2cdbdaf0bd2fb15ab644063345562927475696b7fe51325$''',
+  '''^cad6872f017b80106238a6ca5e8241ac8f2f3bcf$''',
+]
+
+[[allowlists]]
+description = "Revoked Stripe TEST key in local.env (committed 2022, rotated)"
+condition = "AND"
+paths = [
+  '''local\.env$''',
+]
+regexes = [
+  '''^sk_test_51KrUReAYzPPlvWexiQJ4vWbqHo1mQMItW0yqCGqqYHFN6CngK9FEEcHEL7com9VfiVODVPz6Nxrrxt5Zm72eKceJ00pCcy8nKN$''',
+]