From 6af14ed5bb294cca4de968197339e90087312754 Mon Sep 17 00:00:00 2001 From: Astrid Gealer Date: Fri, 23 Oct 2026 09:06:34 +0000 Subject: [PATCH] chore(security): drop inert .gitleaksignore and detect-private-key exclusions .gitleaksignore held a single bare path, which gitleaks does not accept as an ignore entry (it expects finding fingerprints), and no workflow, hook, Makefile target or script in this repo has ever run gitleaks. The file suppressed nothing while reading as an active suppression. git-secrets is the secret gate, and its --register-aws allow-list already covers the AWS documentation example keys in internal/secrets/aws_resolver_httptest_test.go. The detect-private-key hook excluded every _test.go file and frontend/src/index.html. No tracked file contains a private-key header, so both exclusions exempted nothing while letting a key pasted into any Go test fixture past the gate. Remove them. Closes #299 Co-Authored-By: Claude Opus 5.5 --- .gitleaksignore | 3 --- .pre-commit-config.yaml | 11 ++++++----- 2 files changed, 6 insertions(+), 8 deletions(-) delete mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore deleted file mode 100644 index 671857722..000000000 --- a/.gitleaksignore +++ /dev/null @@ -1,3 +0,0 @@ -# AWS official example credentials used in tests -# See: https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds.html#sec-access-keys-and-secret-access-keys -internal/secrets/aws_resolver_httptest_test.go diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 59ddfc5dc..078428b34 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -61,11 +61,12 @@ repos: name: Check for merge conflicts - id: detect-private-key name: Detect private keys - # Audit (PR5): internal/credentials/resolver.go contains zero - # private-key-shaped patterns (verified by grep). The exclusion - # was a historical artifact; removing it tightens the gate - # without breaking any legitimate code. - exclude: '(_test\.go|frontend/src/index\.html)$' + # No exclusions: no tracked file contains a private-key header, so + # the former `_test\.go` and `frontend/src/index.html` exclusions + # exempted nothing while letting a key pasted into any Go test + # fixture through (#299). A test that genuinely needs a PEM literal + # should assemble it at runtime (as scripts/test-git-secrets-allowlist.sh + # does) or add a narrow per-file exclude with a written reason. - id: check-case-conflict name: Check for case conflicts