forked from bchanot/claude
Bastien Chanot
20b90465d8
Reports are gitignored (.gitignore:94) but were swept into 17bdd08 —
even redacted they map secret types/locations for anyone with repo
access. Allowlists from the 2026-07-14 cso triage (75 findings → 0,
each class verified empirically): bare 40-hex git SHAs, gitflow-test
synthetic AWS fixture, presigned-URL key ids, expired GitHub image
JWTs, doc placeholders, IDE lock files, two prose literals. Converted
deprecated [allowlist] to [[allowlists]] (gitleaks 8.30 refuses the
mix). Makefile hint no longer suggests committing the reports.
Transcripts/file-history deliberately NOT path-allowlisted (BDR-057).
87 lines
3.8 KiB
TOML
87 lines
3.8 KiB
TOML
title = "claude-config gitleaks config"
|
|
|
|
# Backstop scanner (job7): pre-commit hook (lib/gitflow.sh emit-hook) and
|
|
# `make scan-secrets`. Extends gitleaks' default ruleset — never replaces it.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# 3 false-positive classes identified in job7 triage (.audit/job7/ALL-REDACTED.json),
|
|
# each verified empirically against the real flagged files before being added
|
|
# here (see .audit/job7-report.md). None of these are live secrets.
|
|
[[allowlists]]
|
|
description = "job7 triage — known false positives, not secrets"
|
|
|
|
# Content-based: git-game repo test fixtures (#5/#6 in the triage), confirmed
|
|
# synthetic by the repo owner — literal "test-secret-<digits>" values used in
|
|
# unit tests, flagged by the generic-api-key rule on entropy alone.
|
|
regexTarget = "match"
|
|
regexes = [
|
|
'''test-secret-[0-9-]+''',
|
|
]
|
|
|
|
# Path-based: third-party/vendored files outside our control, flagged by
|
|
# rules that don't apply to their content.
|
|
paths = [
|
|
# Official claude-plugins marketplace catalog — 40-char hex "sha" (git
|
|
# commit references, not credentials) trip the sourcegraph-access-token
|
|
# rule, which matches on bare hex length/entropy alone.
|
|
'''plugins/marketplaces/.*marketplace\.json$''',
|
|
# superpowers plugin test fixture — a base64-encoded WS protocol test
|
|
# nonce, not a credential, trips generic-api-key on entropy.
|
|
'''tests/brainstorm-server/ws-protocol\.test\.js$''',
|
|
# NOT a job7 false positive — this IS a real secret, by design: the
|
|
# canonical vault (BDR-026). `make scan-secrets` scans ~/.claude looking
|
|
# for stray COPIES of secrets outside this file; flagging the vault
|
|
# itself on every run is pure noise, not signal.
|
|
'''(^|/)\.env$''',
|
|
# seo-data OAuth token store — legitimate local secret (like ~/.claude/.env),
|
|
# 0600, outside git. Allowlisted so `make scan-secrets` doesn't flag the vault.
|
|
'''(^|/)\.claude/seo-data/tokens\.json$''',
|
|
]
|
|
|
|
# ── secrets-triage 2026-07-14 — 4 FP classes, each verified empirically
|
|
# (unredacted re-scan piped in-memory, values masked; see
|
|
# .gstack/security-reports/2026-07-14-secrets-triage.json). None are secrets.
|
|
# Transcripts and file-history are deliberately NOT path-allowlisted — that is
|
|
# where real leaks land (BDR-057).
|
|
|
|
# Bare 40-hex = git commit SHA (plugin-catalog pins, commit refs quoted in
|
|
# transcripts) tripping sourcegraph-access-token, which matches naked hex.
|
|
# Real sourcegraph tokens keep their sgp_ prefix → still detected.
|
|
[[allowlists]]
|
|
description = "bare 40-hex git commit SHAs (sourcegraph-access-token misfire)"
|
|
regexTarget = "secret"
|
|
regexes = ['''^[0-9a-f]{40}$''']
|
|
|
|
# Synthetic AWS key fabricated by lib/gitflow-test.sh:240 to exercise the
|
|
# pre-commit secret guard; test output lands in session transcripts.
|
|
[[allowlists]]
|
|
description = "gitflow-test synthetic AWS fixture (deliberately fake)"
|
|
regexTarget = "secret"
|
|
regexes = ['''AKIAGDR5XRBXYARW2I5N''']
|
|
|
|
# Public-by-design or expired URL credentials + documentation placeholders.
|
|
[[allowlists]]
|
|
description = "presigned-URL key ids, GitHub image JWTs, doc placeholders"
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''X-Amz-Credential=AKIA[0-9A-Z]{16}''',
|
|
'''private-user-images\.githubusercontent\.com/[^"]*\?jwt=''',
|
|
'''MAGIC_API_KEY=abc123''',
|
|
# magic MCP docs example — base64 of "the ..." ASCII sample text.
|
|
'''clientKey = 'dGhlIH[A-Za-z0-9+/=]*'''',
|
|
]
|
|
|
|
# Prose in transcripts near the word "tokens" — dictionary phrases flagged by
|
|
# generic-api-key on entropy alone (e.g. a design discussion of publish/reject
|
|
# token pairs). Exact literals only; transcripts stay fully scanned otherwise.
|
|
[[allowlists]]
|
|
description = "prose false positives in transcripts"
|
|
stopwords = ['''publish/reject''']
|
|
|
|
# Ephemeral machine-local IDE auth locks (rotate per IDE session, never leave
|
|
# the machine).
|
|
[[allowlists]]
|
|
description = "Claude Code IDE lock files"
|
|
paths = ['''(^|/)ide/[0-9]+\.lock$''']
|