.gitleaks.toml

[extend]
useDefault = true

[[allowlists]]
description = "Ignore runtime/cache artifacts generated by local and CI runs"
paths = [
  '''(^|/)\.runtime-cache/''',
  '''(^|/)\.venv/''',
  '''(^|/)apps/dashboard/node_modules/''',
  '''(^|/)docs/第三方库技术文档\+Github开源源码/''',
]

[[allowlists]]
description = "Allow explicit non-secret placeholders in langfuse env example only"
condition = "AND"
regexTarget = "line"
paths = [
  '''^infra/docker/langfuse/\.env\.example$''',
]
regexes = [
  '''(?i)^ENCRYPTION_KEY=CHANGEME_NON_SECRET_64_HEX_PLACEHOLDER$''',
  '''(?i)^LANGFUSE_S3_EVENT_UPLOAD_SECRET_ACCESS_KEY=CHANGEME_NON_SECRET_PLACEHOLDER$''',
  '''(?i)^LANGFUSE_S3_MEDIA_UPLOAD_SECRET_ACCESS_KEY=CHANGEME_NON_SECRET_PLACEHOLDER$''',
  '''(?i)^LANGFUSE_S3_BATCH_EXPORT_SECRET_ACCESS_KEY=CHANGEME_NON_SECRET_PLACEHOLDER$''',
]
stopwords = [
  '''REPLACE_WITH_64_HEX_CHARS''',
  '''REPLACE_WITH_STRONG_S3_SECRET''',
  '''CHANGEME_NON_SECRET_64_HEX_PLACEHOLDER''',
  '''CHANGEME_NON_SECRET_PLACEHOLDER''',
]