.gitleaks.toml

title = "gitleaks config"
[[rules]]
  description = "Password in string"
  regex = '''(?i)[\w]*(password|secret)[\w]* *[:=>,]+ *['"][\S]{2,}['"]'''
  [rules.allowlist]
    description = "Exceptions"
    paths = [
      '''(.*?)\.erb$''',
      '''(.*?)\.yml$''',
      '''spec/(.*?)''',
      '''reference_data\.rb''',
      '''lib/sdbmss/legacy\.rb''',
      '''lib/sdbmss/seed_data.rb''',
      '''jena/jena.env''',
      '''.lando.yml''',
      '''config/initializers/mailer.rb''',
      '''vendor/assets/javascripts/URI\.min\.js'''
    ]
    regexes = [
      '''\w\.password_(field|confirmation)''',
      '''^\s*#'''
    ]
[[rules]]
  description = "Password in YAML config"
  regex = '''(?i)[\w]*(password|secret)[\w]* *: *[\S]{2,}'''
  [rules.allowlist]
    description = "Exceptions"
    paths = [
      '''(.*?)\.e?rb$''',
      '''spec/(.*?)''',
      '''reference_data\.rb''',
      '''config/secrets.yml''',
      '''lib/sdbmss/legacy\.rb''',
      '''.lando.yml''',
      '''vendor/assets/javascripts/URI\.min\.js'''
    ]
    regexes = [
      '''\"password\"''',
      '''\"x\"'''
    ]
[[rules]]
  description = "AWS"
  regex = '''AKIA[0-9A-Z]{16}'''
[[rules]]
  description = "RKCS8"
  regex = '''-----BEGIN PRIVATE KEY-----'''
[[rules]]
  description = "RSA"
  regex = '''-----BEGIN RSA PRIVATE KEY-----'''
[[rules]]
  description = "Github"
  regex = '''(?i)github.*['\"][0-9a-zA-Z]{35,40}['\"]'''
[[rules]]
  description = "SSH"
  regex = '''-----BEGIN OPENSSH PRIVATE KEY-----'''
[[rules]]
  description = "Facebook"
  regex = '''(?i)facebook.*['\"][0-9a-f]{32}['\"]'''
[[rules]]
  description = "Twitter"
  regex = '''(?i)twitter.*['\"][0-9a-zA-Z]{35,44}['\"]'''
[[rules]]
  description = "PGP"
  regex = '''-----BEGIN PGP PRIVATE KEY BLOCK-----'''
[[rules]]
  description = "Slack token"
  regex = '''xox[baprs]-.*'''
[[rules]]
  description = "Strip API Key"
  regex = '''(?i)(sk|pk)_(test|live)_[0-9a-zA-Z]{10,32}'''
# Global allowlist
[allowlist]
  description = "Global Allowlists"
  commits = [
    '''b9d1d9891273af1dcd911b3a8a674e870208c437'''
  ]
  files = [
    '''(.*?)(jpg|gif|doc|pdf|bin|md)$''',
    '''\.gitleaks\.toml'''
  ]
  regexes = [
    # Ignore docker set secrets
    '''(?i)(/run/secrets/)''',
    # Values set by Ansible variables
    '''{{ *[\S]+ *}}''',
    # Values set by environment variables
    '''ENV\[['"][\S]+['"]\]'''
  ]