grendervill
9839dbeede
- структура по AGENT.md §12: cmd/, internal/, web/, deploy/, queries/, docs/ - LICENSE: полный текст AGPL-3.0-or-later - NOTICE: атрибуция референсов (Spacebar, Fermo) и сторонних компонентов - SECURITY.md и .well-known/security.txt: правила раскрытия уязвимостей - .env.example: все переменные окружения с дефолтами - .gitignore/.dockerignore/.editorconfig/.gitattributes/.gitleaks.toml
29 lines
885 B
TOML
29 lines
885 B
TOML
title = "glchat secret scanning"
|
|
# Локальные конфиги и журналы harness содержат служебные строки и исключены из git.
|
|
[allowlist]
|
|
description = "Ignore local harness artifacts and vendored caches"
|
|
paths = [
|
|
'''^\.cache/''',
|
|
'''^build/''',
|
|
'''^web/node_modules/''',
|
|
'''^AGENT\.md$''',
|
|
'''^PROGRESS\.md$''',
|
|
'''^docs/''',
|
|
'''^\.opencode/''',
|
|
]
|
|
|
|
[[rules]]
|
|
id = "glchat-age-secret-key"
|
|
description = "age private key"
|
|
regex = '''AGE-SECRET-KEY-1[0-9A-Z]{58}'''
|
|
|
|
[[rules]]
|
|
id = "glchat-session-pepper"
|
|
description = "session pepper assignment"
|
|
regex = '''(?i)(SESSION_PEPPER|MASTER_KEY|LIVEKIT_API_SECRET|WEBHOOK_SECRET|TOTP_ENCRYPTION_KEY)\s*[:=]\s*["']?[A-Za-z0-9+/=_-]{16,}'''
|
|
|
|
[[rules]]
|
|
id = "glchat-private-key-block"
|
|
description = "PEM private key"
|
|
regex = '''-----BEGIN (RSA|EC|OPENSSH|PGP) PRIVATE KEY-----'''
|