chore(security): gitleaks allowlist for triaged false positives

[hyperpolymath]

All of this repository's gitleaks findings were triaged on 2026-08-06 by reading each matched line with the value redacted. Every one is a false positive — no live credential was found.

This adds locally justified path exemptions. Each names what the value actually is rather than saying a file is noisy.

Why local and not in the estate baseline: every entry is a blind spot. Held here it blinds this repository only, and the justification sits beside the code it describes. Promoted to the baseline it would blind all 400+ repositories.

Depends on hyperpolymath/standards#584, which wires the estate baseline into the scan and stages it at the workspace root so this file's [extend] path resolves.

Verified before commit: with this config in place, a planted AWS canary outside the exempted paths is still DETECTED and the gate still exits non-zero.

🤖 Generated with Claude Code

[gitar-bot]

Gitar has auto-approved this PR and enabled auto-merge (configure)

[gitar-bot]

Note

Automatic reviews are paused because your trial's included automatic processing has been used for this period. Upgrade now, or comment "Gitar review" to run a review anytime.
Learn more

Code Review✅ Approved1 resolved / 1 findings

Adds localized gitleaks path exemptions for triaged false positives, addressing the path allowlist blinds entire files to all future secrets finding.

Auto-approved and auto-merge armed: No blocking issues found.
Please see Auto-approve Docs for details on setting custom approval criteria. — merges when pipeline and required approvals pass.

✅ 1 resolved

✅ Security: Path allowlist blinds entire files to all future secrets

📄 .gitleaks.toml:33-47
The entries under paths exempt whole files (seeds.exs, fixtures.ex, bofig.trustfile.a2ml) from all gitleaks rules, so any genuinely live credential added to these files later will be silently suppressed — not just the triaged Zotero keys and cipher-suite names. This also contradicts the file's own instruction to "plant a realistic secret in the same path and confirm it is STILL detected," which is impossible under a path-level exemption. Consider narrowing each entry to a value-scoped regexes allowlist (optionally combined with paths) matching the specific benign pattern (e.g. the 8-char zotero_key: format, the key_exchange: cipher name), so unrelated secret types in those files still trigger the gate.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

---

Important

Your trial ends in 3 days — upgrade now to keep code review, CI analysis, auto-apply, custom automations, and more.

_{Was this helpful? React with 👍 / 👎 | Gitar}