From 5cbb0002b616994d5370d6692fd4754d0effcefb Mon Sep 17 00:00:00 2001
From: ozymandiashh <234437643+ozymandiashh@users.noreply.github.com>
Date: Tue, 4 Aug 2026 04:18:38 +0300
Subject: [PATCH 1/2] chore(security): add gitleaks allowlist for audited false
 positives

A full-history secret scan (all refs, 1352 commits) plus trufflehog
--only-verified came back clean: zero live secrets. gitleaks' default
generic-api-key rule flags 8 non-secrets - obviously-fake test fixtures
(sk-live-0123..., sk-live-AKIA...SECRETKEY), the public Claude Code and
Codex OAuth client IDs (PKCE public-client flow, no client_secret), and a
dedup-key string. This encodes exactly those as allowlisted so scans stay
green and a real leak can never hide under recurring false positives.
---
 .gitleaks.toml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .gitleaks.toml

diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 00000000..3248978a
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,33 @@
+# gitleaks config for codeburn.
+#
+# Extends the default ruleset and allowlists the cases a full-history audit
+# (2026-08-04) confirmed are NOT secrets, so scans stay green and a real leak
+# is never buried under recurring false positives. See each entry for why the
+# match is safe; nothing here suppresses a live credential.
+[extend]
+useDefault = true
+
+[[allowlists]]
+description = "Test fixtures: obviously-fake API keys used as parser/validator input."
+# sk-live-0123456789abcdef... and sk-live-AKIA1234567890SECRETKEY live in
+# packages/core and root test suites purely as decode/redaction fixtures.
+regexes = [
+  '''sk-live-0123456789abcdef''',
+  '''sk-live-AKIA1234567890SECRETKEY''',
+]
+paths = ['''(^|/)tests?/''']
+
+[[allowlists]]
+description = "Public OAuth client IDs (PKCE public-client flow, public by design, no client_secret)."
+# Claude Code and Codex OAuth client identifiers. Client IDs travel in the
+# authorization request and are not credentials; the flows carry no secret.
+regexes = [
+  '''9d1c250a-e61b-44d9-88ed-5944d1962f5e''',
+  '''app_EMoamEEZ73f0CkXaXp7hrann''',
+]
+
+[[allowlists]]
+description = "Non-secret identifiers the generic-api-key rule mis-fires on."
+# e.g. dedup keys like 'synth-retain-89d' in parser fixtures.
+regexes = ['''synth-[a-z0-9-]+''']
+paths = ['''(^|/)tests?/''']

From 2532c0f743abd1d8ff971f7b65f3bcb6517de013 Mon Sep 17 00:00:00 2001
From: iamtoruk <hello@agentseal.org>
Date: Mon, 10 Aug 2026 04:19:56 -0700
Subject: [PATCH 2/2] Scope path-limited allowlists with condition AND; cover
 the example-JWT fixture

Gitleaks ORs an allowlist entry's conditions by default, so pairing a
fixture regex with a tests/ path allowlisted every finding under tests/,
regex or not - a real secret committed to a test file would have been
suppressed. condition = AND restores the intended semantics (verified: a
planted AWS/Stripe-shaped canary in tests/ is flagged again), and the
canonical example JWT header fixture that the path condition was silently
covering gets its own scoped entry. Full-history scan stays green.
---
 .gitleaks.toml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 3248978a..5c5a5255 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -11,6 +11,7 @@ useDefault = true
 description = "Test fixtures: obviously-fake API keys used as parser/validator input."
 # sk-live-0123456789abcdef... and sk-live-AKIA1234567890SECRETKEY live in
 # packages/core and root test suites purely as decode/redaction fixtures.
+condition = "AND"
 regexes = [
   '''sk-live-0123456789abcdef''',
   '''sk-live-AKIA1234567890SECRETKEY''',
@@ -29,5 +30,12 @@ regexes = [
 [[allowlists]]
 description = "Non-secret identifiers the generic-api-key rule mis-fires on."
 # e.g. dedup keys like 'synth-retain-89d' in parser fixtures.
+condition = "AND"
 regexes = ['''synth-[a-z0-9-]+''']
 paths = ['''(^|/)tests?/''']
+
+[[allowlists]]
+description = "Canonical example JWT header used as a redaction/parse fixture (decodes to {\"alg\":\"HS256\",\"typ\":\"JWT\"}, carries no claims or signature)."
+condition = "AND"
+regexes = ['''eyJhbGciOiJIUzI1NiIsIn''']
+paths = ['''(^|/)tests?/''']