From bc0cfa01db9e83e1fd234d460179fefbeb298c52 Mon Sep 17 00:00:00 2001
From: Imani Manyara <imanimanyara@users.noreply.github.com>
Date: Thu, 8 Oct 2026 15:44:04 -0400
Subject: [PATCH] Use a placeholder OpenAI key and add the narrow scanner
 config

docs/modules/llm.md showed OPENAI_API_KEY=sk-..., a realistic prefix; it now reads sk-xxxxxxxx. .gitguardian.yaml and .gitleaks.toml ignore only tests/Fixtures/**/*.
---
 .gitguardian.yaml   | 13 +++++++++++++
 .gitleaks.toml      | 12 ++++++++++++
 docs/modules/llm.md |  2 +-
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 .gitguardian.yaml
 create mode 100644 .gitleaks.toml

diff --git a/.gitguardian.yaml b/.gitguardian.yaml
new file mode 100644
index 0000000..00f2544
--- /dev/null
+++ b/.gitguardian.yaml
@@ -0,0 +1,13 @@
+# Secret-scan policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+#
+# ggshield reads this file (pre-commit, CI, local scans). The GitGuardian GitHub App, which posts
+# the "GitGuardian Security Checks" run on pull requests, does not: its exclusions live in the
+# GitGuardian dashboard (Settings -> Secrets detection -> Exclusion rules).
+#
+# Only named fixture and example-env paths are ignored. Never src/, never a real .env, never a
+# detector. secret_scan.py still searches these paths for live-format keys. If a finding is real,
+# rotate it first and then remove it; never add it here.
+version: 2
+secret:
+  ignored_paths:
+    - "tests/Fixtures/**/*"
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..e08482f
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,12 @@
+# gitleaks policy. Written by agent-kit's secret_scan.py; extend it by hand, narrowly.
+# Only named fixture and example-env paths are allowlisted; secret_scan.py still
+# searches them for live-format keys. A realistic fake elsewhere carries an inline
+# `gitleaks:allow` comment instead.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Named fixture and example-env paths (agent-kit secret_scan.py)"
+paths = [
+  '''^tests/Fixtures/(?:.*/)?[^/]*$''',
+]
diff --git a/docs/modules/llm.md b/docs/modules/llm.md
index 4dc0383..54e38a1 100644
--- a/docs/modules/llm.md
+++ b/docs/modules/llm.md
@@ -145,7 +145,7 @@ set the API key and (optionally) the default provider:
 
 ```dotenv
 LLM_DEFAULT_PROVIDER=openai
-OPENAI_API_KEY=sk-...
+OPENAI_API_KEY=sk-xxxxxxxx
 ```
 
 [← Docs index](../../README.md#documentation)