forked from bchanot/claude
bastien
e1963284d2
The magic MCP wiring left with BDR-093; this removes the prose that still described it: gitleaks allowlist note, Step 8.7 header, plugins.lock note, profile.sh comments and the usage() NOTE that still claimed `set` toggles "the magic MCP", the managed-set test header, README (one history sentence kept; MCP-era risk paragraph and the retired bashrc wrapper claim dropped). .env.example carries the same scrub in the working tree; staging it is denied to the agent (`git add .env*`), the user stages it.
86 lines
3.8 KiB
TOML
86 lines
3.8 KiB
TOML
title = "claude-config gitleaks config"
|
|
|
|
# Backstop scanner (job7): pre-commit hook (lib/gitflow.sh emit-hook) and
|
|
# `make scan-secrets`. Extends gitleaks' default ruleset — never replaces it.
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# 3 false-positive classes identified in job7 triage (.audit/job7/ALL-REDACTED.json),
|
|
# each verified empirically against the real flagged files before being added
|
|
# here (see .audit/job7-report.md). None of these are live secrets.
|
|
[[allowlists]]
|
|
description = "job7 triage — known false positives, not secrets"
|
|
|
|
# Content-based: git-game repo test fixtures (#5/#6 in the triage), confirmed
|
|
# synthetic by the repo owner — literal "test-secret-<digits>" values used in
|
|
# unit tests, flagged by the generic-api-key rule on entropy alone.
|
|
regexTarget = "match"
|
|
regexes = [
|
|
'''test-secret-[0-9-]+''',
|
|
]
|
|
|
|
# Path-based: third-party/vendored files outside our control, flagged by
|
|
# rules that don't apply to their content.
|
|
paths = [
|
|
# Official claude-plugins marketplace catalog — 40-char hex "sha" (git
|
|
# commit references, not credentials) trip the sourcegraph-access-token
|
|
# rule, which matches on bare hex length/entropy alone.
|
|
'''plugins/marketplaces/.*marketplace\.json$''',
|
|
# superpowers plugin test fixture — a base64-encoded WS protocol test
|
|
# nonce, not a credential, trips generic-api-key on entropy.
|
|
'''tests/brainstorm-server/ws-protocol\.test\.js$''',
|
|
# NOT a job7 false positive — this IS a real secret, by design: the
|
|
# canonical vault (BDR-026). `make scan-secrets` scans ~/.claude looking
|
|
# for stray COPIES of secrets outside this file; flagging the vault
|
|
# itself on every run is pure noise, not signal.
|
|
'''(^|/)\.env$''',
|
|
# seo-data OAuth token store — legitimate local secret (like ~/.claude/.env),
|
|
# 0600, outside git. Allowlisted so `make scan-secrets` doesn't flag the vault.
|
|
'''(^|/)\.claude/seo-data/tokens\.json$''',
|
|
]
|
|
|
|
# ── secrets-triage 2026-07-14 — 4 FP classes, each verified empirically
|
|
# (unredacted re-scan piped in-memory, values masked; see
|
|
# .gstack/security-reports/2026-07-14-secrets-triage.json). None are secrets.
|
|
# Transcripts and file-history are deliberately NOT path-allowlisted — that is
|
|
# where real leaks land (BDR-057).
|
|
|
|
# Bare 40-hex = git commit SHA (plugin-catalog pins, commit refs quoted in
|
|
# transcripts) tripping sourcegraph-access-token, which matches naked hex.
|
|
# Real sourcegraph tokens keep their sgp_ prefix → still detected.
|
|
[[allowlists]]
|
|
description = "bare 40-hex git commit SHAs (sourcegraph-access-token misfire)"
|
|
regexTarget = "secret"
|
|
regexes = ['''^[0-9a-f]{40}$''']
|
|
|
|
# Synthetic AWS key fabricated by lib/gitflow-test.sh:240 to exercise the
|
|
# pre-commit secret guard; test output lands in session transcripts.
|
|
[[allowlists]]
|
|
description = "gitflow-test synthetic AWS fixture (deliberately fake)"
|
|
regexTarget = "secret"
|
|
regexes = ['''AKIAGDR5XRBXYARW2I5N''']
|
|
|
|
# Public-by-design or expired URL credentials + documentation placeholders.
|
|
[[allowlists]]
|
|
description = "presigned-URL key ids, GitHub image JWTs, doc placeholders"
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''X-Amz-Credential=AKIA[0-9A-Z]{16}''',
|
|
'''private-user-images\.githubusercontent\.com/[^"]*\?jwt=''',
|
|
# Docs/test example — base64 of the "the ..." ASCII sample text, never a key.
|
|
'''clientKey = 'dGhlIH[A-Za-z0-9+/=]*'''',
|
|
]
|
|
|
|
# Prose in transcripts near the word "tokens" — dictionary phrases flagged by
|
|
# generic-api-key on entropy alone (e.g. a design discussion of publish/reject
|
|
# token pairs). Exact literals only; transcripts stay fully scanned otherwise.
|
|
[[allowlists]]
|
|
description = "prose false positives in transcripts"
|
|
stopwords = ['''publish/reject''']
|
|
|
|
# Ephemeral machine-local IDE auth locks (rotate per IDE session, never leave
|
|
# the machine).
|
|
[[allowlists]]
|
|
description = "Claude Code IDE lock files"
|
|
paths = ['''(^|/)ide/[0-9]+\.lock$''']
|