gitleaks.toml

# gitleaks configuration — codeo1io fleet private-leak sentinel
# Full option list: https://github.com/gitleaks/gitleaks
title = "codeo1io fleet private-leak sentinel"

[extend]
# Extends the default ruleset (API keys, tokens, AWS, etc.) — we add fleet-specific
# rules on top rather than replacing it.
useDefault = true

[[rules]]
id = "hermes-hass-token"
description = "Home Assistant long-lived access token"
regex = '''\b(hass_token|HASS_TOKEN)\s*[:=]\s*["']?[A-Za-z0-9._\-]{20,}'''
tags = ["homeassistant", "hermes"]
keywords = ["hass_token", "HASS_TOKEN"]

[[rules]]
id = "wyoming-groq-key"
description = "Groq API key"
regex = '''\bgsk_[A-Za-z0-9]{20,}'''
tags = ["groq"]

[[rules]]
id = "hermes-env-file-inline"
description = "Inline .env secret assignment (non-example)"
regex = '''^\s*[A-Z0-9_]*(TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)\s*=\s*["']?[A-Za-z0-9+/=_\-]{16,}["']?\s*$'''
path = '''(?i)\.env$|env\.local|\.secrets'''
tags = ["env"]

[[rules]]
id = "github-app-private-key"
description = "GitHub App private key (PEM body)"
regex = '''-----BEGIN RSA PRIVATE KEY-----'''
tags = ["github-app", "pem"]

# Override of the stock 'generic-api-key' rule. The stock regex fires on
# comments, import lists, and docstrings — 363 of 419 findings on hermes-agent,
# zero real secrets (triaged 2026-09-21). Narrowed to assignment-shaped matches
# with an entropy floor; every other default rule runs unchanged.
[[rules]]
id = "generic-api-key"
description = "Generic API Key (fleet-narrowed)"
regex = '''(?i)(?:api[_-]?key|token|secret|password|passwd|credential)[a-z0-9_]*\s*[:=]\s*["'][A-Za-z0-9+/=_.\-]{16,}["']'''
entropy = 3.5
keywords = ["key", "token", "secret", "password", "passwd", "credential"]
tags = ["key", "generic"]

# Second member of the generic-api-key pair (cycle-4 rm-037 D1): UNQUOTED
# assignment values (YAML/TOML/ini style, `token: value` / `password = value`),
# restoring the coverage the quoted-only narrowing dropped. Key is
# prefix-worded and boundary-anchored (excludes Python/TS identifiers like
# `_startup_api_key_override` / `request_pressure_tokens`); value charset is
# base64/hex with an alnum start (excludes `_windows_gateway_resume` /
# `plan.approx_tokens` / `++latestSwitchToken` identifier values); line-anchored
# so prose like "the token; see docs" cannot match. Both FP classes verified
# against the 2026-09-22 fleet triage corpora (hermes-gpt 38,355 commits,
# hermes-agent 44,422 commits: 0 source false positives after this shape).
[[rules]]
id = "generic-api-key-unquoted"
# Coverage gaps, documented (cycle-4 review P3 — widen next cycle with corpus
# additions, conservative by design): value charset [A-Za-z0-9+/] excludes
# '-' '_' '.', so unquoted values containing them escape (sk-/ghp_-shaped
# values stay covered by the stock rules); suffix-worded keys (secret_prod =,
# api_key_v2 =) are caught by the quoted variant only (asymmetric pair
# coverage); a trailing same-line comment breaks the $ anchor. All misses,
# no false positives.
description = "Generic API Key, unquoted assignment value (fleet)"
regex = '''(?i)(?:[a-z0-9]+[_-])*(?:api[_-]?key|token|secret|password|passwd|credential)\b[\s]*[:=][\s]*[A-Za-z0-9][A-Za-z0-9+/]{15,}={0,2}[\s]*$'''
entropy = 3.7
keywords = ["key", "token", "secret", "password", "passwd", "credential"]
tags = ["key", "generic"]

[allowlist]
description = "Known-safe paths and test fixtures"
# POLICY (cycle-4 rm-037): NO blanket exemptions for test trees, *.test/spec
# files, conftest.py, or markdown. Test/fixture files are where pasted real
# secrets hide; .md files quote config in docs. Narrow escapes only:
#   - fixture DIRECTORIES by convention (dummy-secret homes, not code),
#   - vendored/build artifacts (not hand-written),
#   - per-file entries below, each with triage evidence in a comment.
# Repo-specific false positives belong in that repo's .gitleaksignore
# (fingerprint lines `commit:file:rule:id:line`, auto-read from repo root),
# NOT in this fleet-wide file.
paths = [
  '''(?i)\.(lock|snap|png|jpg|jpeg|gif|webp)$''',
  '''gitleaks\.toml''',
  # Fixture DIRECTORIES, any directory component named fixtures/ or fixture/ —
  # never files whose NAME contains "fixture" under a tests/ tree. Cycle-5
  # assess (rm-037 reopen): the previous `(?i)tests?/.*fixtures?` exempted
  # wholesale any tests/ path containing "fixture" — a planted ghp_-shaped
  # token in tests/unit/test_fixture_loader.py produced ZERO findings under
  # the fleet config (live-binary A/B, gitleaks 8.28.0/8.30.1). Anchored to
  # directory components only; filename-shaped escapes are gone.
  '''(?i)(^|/)fixtures?/''',
  '''(?i)native/.*/vendor/''',
  '''node_modules/''',
  # cycle-8 rm-047: unanchored `dist/`/`web/dist/` exempted ANY directory
  # merely ending in those names (live A/B, gitleaks 8.28.0: a planted
  # github-pat detected in src/, silently exempt in mydist/). Anchored to a
  # real path-component boundary — true build-output dirs stay exempt,
  # dist-suffixed look-alikes are scanned.
  '''(^|/)web/dist/''',
  '''(^|/)dist/''',
  # agent/redact.py and its tests deliberately contain secret-shaped strings —
  # they are the redaction engine itself; the sentinel would otherwise flag
  # the exact code that protects the fleet.
  '''agent/redact\.py$''',
  # hermes-gpt redaction-fixture tests (verified 2026-09-21): root-level
  # test files that deliberately
  # embed dummy PEM blocks — test_ui_security.py exercises redact_browser,
  # test_operator_policy.py exercises redact_output incl. the fail-closed
  # unterminated-BEGIN case. All 4 sentinel findings were attributed to
  # ancestor commit 26ed7b4c0 (2026-08-31, upstream lineage); zero real
  # secrets (short synthetic bodies: b3BlbnNzaC1rZXk… / MIIabc).
  '''test_ui_security\.py$''',
  '''test_operator_policy\.py$''',
  # Vendored upstream history: an accidental session export (exprted.jsonl,
  # removed from HEAD in 9a19fe1f) trips discord-client-id rules; zero real
  # token shapes verified 2026-09-21. Allowlisting the path quiets history scans.
  '''exprted\.jsonl''',
  # History-only masked placeholders (verified 2026-09-21): Algolia public
  # search-only key in docusaurus.config.ts ('8fda2...07' masked) and removed
  # 2025 MoA example key ('sk-_yo..._rpg', file deleted from HEAD). No live secrets.
  '''docusaurus\.config\.ts$''',
  '''mixture_of_agents_tool\.py$''',
]
commits = []
# Repo-env templates with placeholder values are fine. These regexes match
# the CAPTURED SECRET VALUE (verified live, gitleaks 8.28.0/8.30.1), so they
# are anchored to placeholder SHAPES — a value merely CONTAINING "xxx" or
# "..." is NOT exempt (cycle-5 rm-037 reopen: `xxx+` suppressed a live
# q8Kw2xxx…-shaped value; bare `\.{3}` would suppress any dotted value).
regexes = [
  # all-x placeholder values (xxxxx …) only
  '''^x{3,}$''',
  '''CHANGE_ME''',
  '''<your[_-]?(token|key|secret)?>''',
  '''\$\{[A-Z_]+\}''',
  '''ghp_xxxxxxxxxxxxxxxxxxxx''',
  # OAuth client secrets of native/PKCE apps are public by design (Google
  # installed-app flow), as are env/header NAME constants and redacted
  # "ab12...yz" stubs. The last 7 findings on the 2026-09-21 hermes-agent
  # full-history scan were exactly these - triaged benign one by one.
  '''(?i)public[_-]?client[_-]?secret|SECRET_(?:HEADER|ENV|SUFFIX)\s*=''',
  '''(?i)PLACEHOLDER''',
  # redacted "ab12...yz" stubs: word-prefix + ellipsis + word-suffix shape,
  # not any dotted value
  '''[a-z0-9]{3,}\.{3}[a-z0-9]{2,}''',
  # Redacted stub literals verified across all history variants
  # (2026-09-21: every commit of both files carries only these).
  '''8fda2\.\.\.[0-9a-f]*7''',
  '''sk-_yo\.\.\._rpg''',
]