.gitleaks.toml

# Gitleaks configuration — extends the default ruleset.
#
# The only allowlisted secrets are PUBLIC key material committed in
# src/config/environments.ts:
#   - the two Supabase anon keys — anon-role JWTs, designed to be embedded in
#     client code and gated by RLS (see the doc comment in that file).
#   - the two KEK public keys (prod + dev) for client-side binary envelope
#     encryption — base64 of the raw 32-byte X25519 PUBLIC half. They can only
#     *encrypt*; the private halves live solely on the API, never in this repo.
# Both are intentionally not secret; gitleaks flags them on entropy alone
# (generic-api-key), not because it recognizes them as credentials.
#
# They are allowlisted by EXACT VALUE, deliberately not by file path or by the
# whole `jwt` / `generic-api-key` rule: a Supabase service_role key is also a
# JWT, and a KEK *private* key is the same shape as its public half, so a
# path/rule allowlist would let a genuinely sensitive key pasted into the same
# file slip through. Matching exact values keeps that detection intact.
#
# When a KEK is rotated, replace the corresponding value below — do not simply
# append, or the retired key stops being distinguishable from a live secret.
[extend]
useDefault = true

[allowlist]
description = "Public Supabase anon keys and KEK public keys (safe to commit)"
regexes = [
  '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0\.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8''',
  '''eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30\.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ''',
  # prod kekPublicKey v1
  '''wtfyWEwK7nJzwI4PD\+9RAW8jxIR1u8kMQq2IhsrVnH4=''',
  # dev kekPublicKey v1
  '''RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=''',
]