From 167445ba913c536aafabc45644c400fa71c87a30 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 6 Aug 2026 12:16:02 +0100
Subject: [PATCH] chore(security): add a gitleaks allowlist for triaged false
 positives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gitleaks gate has been blocking this repository's pull requests. Every
finding was triaged on 2026-08-06 by reading the matched line with the value
redacted, and every one is a false positive. No live credential was found.

Each entry names WHAT THE VALUE ACTUALLY IS rather than saying the file is
noisy — an algorithm name, a bibliographic key, a published protocol
constant, a fixture belonging to a secret DETECTOR, and so on.

The file EXTENDS the estate baseline rather than replacing it:
hyperpolymath/standards secret-scanner-reusable.yml stages that baseline at
the workspace root as .gitleaks-estate.toml, and gitleaks resolves
'[extend] path' against the process CWD. Requires standards#584.

Kept local rather than promoted to the estate baseline because every entry is
a blind spot: held here it blinds this repository only, with its
justification beside the code it describes.

Verified before commit: with this config in place a planted AWS canary
outside the exempted paths is still DETECTED and the gate still exits
non-zero on it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 .gitleaks.toml | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 00000000..27160942
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,68 @@
+# SPDX-License-Identifier: MPL-2.0
+#
+# Gitleaks configuration — hyperpolymath/developer-ecosystem
+#
+# EXTENDS THE ESTATE BASELINE, it does not replace it.
+# `.gitleaks-estate.toml` is staged into the workspace root by
+# hyperpolymath/standards `.github/workflows/secret-scanner-reusable.yml`
+# before the scan runs. gitleaks resolves `[extend] path` against the process
+# CWD (verified — NOT relative to this file), which is the repository root.
+#
+# WHY THIS FILE IS LOCAL RATHER THAN IN THE ESTATE BASELINE.
+# Every entry below is a blind spot. Held here, it blinds this repository only,
+# and the justification sits beside the code it describes. Promoted to the
+# estate baseline it would blind all 400+ repositories — so the baseline keeps
+# only entries that are true everywhere (lockfiles, vendored bundles, published
+# protocol constants).
+#
+# Each entry names WHAT THE VALUE IS. "This file is noisy" is not a reason; if
+# an entry cannot say what the matched value actually is, the secret should be
+# removed from the tree instead.
+#
+# Every finding suppressed here was triaged on 2026-08-06 by reading the
+# matched line with the value redacted. Before adding an entry, plant a
+# realistic secret in the same path and confirm it is STILL detected.
+
+[extend]
+path = ".gitleaks-estate.toml"
+
+[allowlist]
+description = "hyperpolymath/developer-ecosystem: locally justified exemptions, extending the estate baseline"
+
+
+paths = [
+  # Vendored upstream ReScript compiler, including its own
+  # tests/syntax_tests idempotency corpus and cli/common/minisocket.js.
+  # Third-party source held for reference; not estate code and not editable
+  # here.
+  '''(^|/)rescript-ecosystem/(rescript|packages/core/compiler-source)/''',
+
+  # Test tree of the shellstate component, including a fixture literally
+  # named secret_value.toml — inputs to a manifest/invariant test.
+  '''(^|/)shellstate/test/''',
+
+  # Documentation. The match is an illustrative connection string in a
+  # distributed-filesystem explainer.
+  '''(^|/)czech-file-knife/docs/''',
+
+  # A DETECTOR definition: the flagged line is the literal '-----BEGIN
+  # PRIVATE KEY-----' inside a list of patterns this contract searches FOR.
+  # The scanner matched the rule, not a key.
+  '''(^|/)well-known-ecosystem/contracts/VALIDATION-RULES\.scm$''',
+
+  # Test file for the emergency-capture path; the values are synthetic
+  # capture identifiers.
+  '''(^|/)v-ecosystem/v-api-interfaces/v-ambientops-emergency-room/capture_test\.v$''',
+
+  # Staging UI source. Both matches are explicitly placeholder-shaped
+  # illustrative values in device/network mock data, verified by reading the
+  # lines.
+  '''(^|/)rescript-ecosystem/idaptik-rescript13-staging/src/app/devices/(DeviceView|GlobalNetworkData)\.res$''',
+
+  # WebSocket implementation. The match is the base64 string
+  # dGhlIHNhbXBsZSBub25jZQ==, which decodes to the ASCII text 'the sample
+  # nonce' — the example handshake value printed in RFC 6455 s1.3. A
+  # published protocol constant.
+  '''(^|/)v-ecosystem/v-api-interfaces/v_ws/src/ws\.v$''',
+
+]