.gitleaks.toml

# Gitleaks Configuration for microsoft/edge-ai
# Purpose: Suppress false positives while maintaining security coverage
# Last Updated: 2025-12-02

[extend]
useDefault = true

# Global allowlist for documentation, research, and examples
[[allowlists]]
description = "Global patterns for documentation, research, and examples"
paths = [
  '''.copilot-tracking/.*''',
  '''.github/prompts/.*''',
  '''.github/instructions/.*''',
  '''.*\.md$''',
  '''.*README.*''',
  '''.*\.tfvars\.example$''',
  '''.*\.env\.example$''',
  '''.*\.config\.example$''',
  '''.*\.json\.example$''',
  '''.*\.yml\.example$''',
  '''.*\.yaml\.example$''',
  '''.*/examples?/.*''',
  '''.*/samples?/.*''',
  '''.*/templates?/.*\.example$''',
  '''.*kubernetes/.*\.yaml$''',
  '''.*otel-collector.*\.yaml$''',
  '''.*integration-tests?.*''',
]

# Commit-based allowlist for historical false positives
[[allowlists]]
description = "Ignore commits with files that were later deleted or refactored"
commits = [
  "c27825a7adc80195c91ee9829271c0caf3643736",
  "42ee4823701026337ff90c941303fca7869a7cac",
  "76304b405abef1071835aadc6dcaf466a03a20f3",
  "9d49582cb3bc6b3da670d1df172be940a0b7bd43",
]

[[rules]]
id = "hashicorp-tf-password"
description = "Terraform password variables"

  [[rules.allowlists]]
  description = "Ignore test fixtures, setup scripts, and obvious test values"
  paths = [
    '''.*tests?/setup/.*\.tf$''',
    '''.*tests?/fixtures/.*\.tf$''',
    '''.*tests?/.*\.tfvars$''',
    '''.*\.tf\.example$''',
    '''.*/examples?/.*\.tf$''',
  ]
  regexes = [
    '''password\s*=\s*["']test\w*["']''',
    '''password\s*=\s*["']\w*test["']''',
    '''password\s*=\s*["'].*["']\s*#.*example''',
    '''password\s*=\s*["'].*["']\s*#.*placeholder''',
    '''\w+_test_password\s*=''',
    '''\w+_mock_password\s*=''',
  ]
  stopwords = [
    "testpass",
    "test_password",
    "password123",
    "mock_password",
    "example_password",
  ]

[[rules]]
id = "generic-api-key"
description = "Generic API Key"

  [[rules.allowlists]]
  description = "Ignore script templates, mock services, and environment variable patterns"
  paths = [
    '''.*scripts?/.*\.sh$''',
    '''.*scripts?/.*\.bash$''',
    '''.*services?/.*mock.*\.py$''',
    '''.*services?/.*test.*\.py$''',
    '''.*services?/authenticated-device/.*\.py$''',
    '''.*tests?/.*\.py$''',
    '''.*\.env\.example$''',
    '''.*\.config\.example$''',
    '''.*integration.*tests?.*\.rs$''',
    '''\.azdo/templates/.*\.yml$''',
  ]
  regexes = [
    '''password:\s+\w{20,}=\s*#.*CHANGE''',
    '''apikey:\s+\w{20,}=\s*#.*CHANGE''',
    '''os\.environ\.get\(['"]\w+['"],\s*['"].*['"]\)''',
    '''getenv\(['"]\w+['"],\s*['"].*['"]\)''',
    '''\w+_pass_\d+''',
    '''\w+_key_\d+''',
    '''\{\{\s*password\s*\}\}''',
    '''\{\{\s*api_key\s*\}\}''',
    '''\$\{password\}''',
    '''\$\{api_key\}''',
  ]
  stopwords = [
    "device_pass_123",
    "cGFzc3dvcmQxMjM=",
    "api_key_example",
    "test_api_key",
    "mock_api_key",
    "9b10c9b9-24a2-486f-9649-53c93cbee746",
  ]

[[rules]]
id = "curl-auth-user"
description = "Curl Basic Authentication"

  [[rules.allowlists]]
  description = "Ignore curl examples, test scripts, and Dockerfile health checks"
  paths = [
    '''.*\.md$''',
    '''.*README.*''',
    '''.*/docs?/.*''',
    '''.*tests?/.*\.sh$''',
    '''.*scripts?/.*\.sh$''',
    '''.*/examples?/.*\.sh$''',
    '''.*Dockerfile$''',
  ]
  regexes = [
    '''curl.*-u\s+\w+:\w+.*localhost''',
    '''curl.*-u\s+\w+:\w+.*127\.0\.0\.1''',
    '''curl.*-u\s+\w+:\w+.*example\.com''',
    '''```.*curl.*-u\s+\w+:\w+.*```''',
    '''HEALTHCHECK.*curl.*-u\s+\w+:\w+.*localhost''',
    '''CMD.*curl.*-u\s+\w+:\w+.*localhost''',
  ]
  stopwords = [
    "user:password",
    "admin:admin",
    "test:test",
    "device_user:device_pass_123",
    "deviceuser:devicepass123",
  ]