title = "glchat secret scanning"
# Локальные конфиги и журналы harness содержат служебные строки и исключены из git.
[allowlist]
description = "Ignore local harness artifacts and vendored caches"
paths = [
  '''^\.cache/''',
  '''^build/''',
  '''^web/node_modules/''',
  '''^AGENT\.md$''',
  '''^PROGRESS\.md$''',
  '''^docs/''',
  '''^\.opencode/''',
]

[[rules]]
id = "glchat-age-secret-key"
description = "age private key"
regex = '''AGE-SECRET-KEY-1[0-9A-Z]{58}'''

[[rules]]
id = "glchat-session-pepper"
description = "session pepper assignment"
regex = '''(?i)(SESSION_PEPPER|MASTER_KEY|LIVEKIT_API_SECRET|WEBHOOK_SECRET|TOTP_ENCRYPTION_KEY)\s*[:=]\s*["']?[A-Za-z0-9+/=_-]{16,}'''

[[rules]]
id = "glchat-private-key-block"
description = "PEM private key"
regex = '''-----BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----'''