mirror of
https://github.com/backnotprop/plannotator.git
synced 2026-09-14 14:17:26 +08:00
Michael Ramos
6724a1bc8e
A share link carries its decryption key in the URL fragment by design; the key never reaches the server and publishing it IS the sharing mechanism, so example links in docs and landing pages are not leaked secrets. Anchored to the guides.show share-path shape (regexTarget line) so real credentials on the same line shape elsewhere still trip generic-api-key. Verified locally: the two #1342 example links pass, a planted sk_live token still fails.
31 lines
1.2 KiB
TOML
31 lines
1.2 KiB
TOML
title = "Plannotator Gitleaks configuration"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
[[allowlists]]
|
|
# Disposition: public, non-secret RFC test vector; reviewed 2026-08-11.
|
|
# Owner: Plannotator maintainers. Re-review by 2027-08-11 or when the fixture is removed.
|
|
description = "RFC 6455 WebSocket handshake example"
|
|
targetRules = ["generic-api-key"]
|
|
regexTarget = "match"
|
|
regexes = [
|
|
'''Sec-WebSocket-Key:\s*dGhlIHNhbXBsZSBub25jZQ==''',
|
|
]
|
|
|
|
[[allowlists]]
|
|
# Disposition: intentionally public by design; reviewed 2026-08-17.
|
|
# A guides.show share link carries its decryption key in the URL fragment;
|
|
# publishing the key IS the sharing mechanism (end-to-end encryption, key never
|
|
# sent to the server). Example links in docs and landing pages are deliberately
|
|
# world-readable, so their #key= fragments are not leaked secrets. The regex is
|
|
# anchored to the guides.show share-path shape so real credentials elsewhere
|
|
# still trip the generic rule.
|
|
# Owner: Plannotator maintainers. Re-review by 2027-08-17 or if the share URL shape changes.
|
|
description = "guides.show share links (key-in-fragment by design)"
|
|
targetRules = ["generic-api-key"]
|
|
regexTarget = "line"
|
|
regexes = [
|
|
'''guides\.show/g/[A-Za-z0-9_-]+#key=[A-Za-z0-9_-]+''',
|
|
]
|