From 5cbb0002b616994d5370d6692fd4754d0effcefb Mon Sep 17 00:00:00 2001
From: ozymandiashh <234437643+ozymandiashh@users.noreply.github.com>
Date: Tue, 4 Aug 2026 04:18:38 +0300
Subject: [PATCH] chore(security): add gitleaks allowlist for audited false
 positives

A full-history secret scan (all refs, 1352 commits) plus trufflehog
--only-verified came back clean: zero live secrets. gitleaks' default
generic-api-key rule flags 8 non-secrets - obviously-fake test fixtures
(sk-live-0123..., sk-live-AKIA...SECRETKEY), the public Claude Code and
Codex OAuth client IDs (PKCE public-client flow, no client_secret), and a
dedup-key string. This encodes exactly those as allowlisted so scans stay
green and a real leak can never hide under recurring false positives.
---
 .gitleaks.toml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 00000000..3248978a
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,33 @@
+# gitleaks config for codeburn.
+#
+# Extends the default ruleset and allowlists the cases a full-history audit
+# (2026-08-04) confirmed are NOT secrets, so scans stay green and a real leak
+# is never buried under recurring false positives. See each entry for why the
+# match is safe; nothing here suppresses a live credential.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Test fixtures: obviously-fake API keys used as parser/validator input."
+# sk-live-0123456789abcdef... and sk-live-AKIA1234567890SECRETKEY live in
+# packages/core and root test suites purely as decode/redaction fixtures.
+regexes = [
+  '''sk-live-0123456789abcdef''',
+  '''sk-live-AKIA1234567890SECRETKEY''',
+]
+paths = ['''(^|/)tests?/''']
+
+[[allowlists]]
+description = "Public OAuth client IDs (PKCE public-client flow, public by design, no client_secret)."
+# Claude Code and Codex OAuth client identifiers. Client IDs travel in the
+# authorization request and are not credentials; the flows carry no secret.
+regexes = [
+  '''9d1c250a-e61b-44d9-88ed-5944d1962f5e''',
+  '''app_EMoamEEZ73f0CkXaXp7hrann''',
+]
+
+[[allowlists]]
+description = "Non-secret identifiers the generic-api-key rule mis-fires on."
+# e.g. dedup keys like 'synth-retain-89d' in parser fixtures.
+regexes = ['''synth-[a-z0-9-]+''']
+paths = ['''(^|/)tests?/''']