fix: resolve gitleaks findings from v2 branch test fixtures

[scottschreckengaust]

Summary

Resolves the 7 gitleaks findings that have been failing the security-scanners workflow since June 19, 2026. All findings are false positives — fake/test credentials used in credential-scrubber test files.

Changes

.gitleaks.toml — path allowlist (Approach 1)

Added tests/harness/eval/shared-credential-scrubber.test.ts to the path allowlist. This is the TypeScript port of the already-allowlisted Python test_credential_scrubber.py. Covers 5 findings:

• Line 33: fake JWT (eyJhbG...)
• Line 41: fake GitHub token (ghp_1234567890abcdefghijklmnopqrstuv)
• Line 69: fake API key (a1b2c3d4e5f6...)
• Lines 117, 130: fake GitHub tokens in dict scrub tests

Introduced by Arden Packeer in commit b2e9ef29 on feature/js-evaluator-port (no PR, pushed directly).

.gitleaks-baseline.json — baseline entries (Approach 2)

Added 2 entries for tests/unit/t243-doctor-bundle.test.ts:

• Line 785: token=abcdef123456 (redaction test fixture)
• Line 849: token=abcdef123456 (redaction test fixture in exported state file)

Introduced by Leandro Damascena in commit 12c4d826 via PR #576 (feat/doctor-bundle-575 → v2), approved by apackeer.

Verification

gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json . 
# 511 commits scanned — no leaks found

Note

This fixes gitleaks only. The grype failures (38 HIGH vulns in scripts/aidlc-evaluator/uv.lock) require a separate dependency update PR.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[harmjeff]

Reviewed both changes:

.gitleaks.toml path allowlist — Adding shared-credential-scrubber.test.ts makes sense. It's the TypeScript port of the already-allowlisted Python test file (test_credential_scrubber.py), so this is consistent with existing policy. These are intentional fake secrets used to verify the scrubber works.

.gitleaks-baseline.json entries — The two token=abcdef123456 findings in t243-doctor-bundle.test.ts (lines 785, 849) are clearly test fixtures for the redaction logic introduced in PR #576. Low entropy (3.58), obvious placeholder pattern — correct to baseline these rather than allowlist the entire file.

Verification step is solid — gitleaks git --config=.gitleaks.toml --baseline-path=.gitleaks-baseline.json . with 511 commits and no leaks is a clean bill of health.

One minor note: the PR description mentions grype failures (38 HIGH vulns in uv.lock) as a separate PR — is that tracked somewhere? Might be worth opening an issue to ensure it doesn't slip.