The secret scanner's 34 known-false findings, allowlisted by value (#132) #1351

Merged

claude-bot merged 1 commit from chore/132-gitleaks-allowlist into main

2026-11-06 21:03:34 +00:00

claude-bot commented

2026-11-06 07:17:30 +00:00

Collaborator

Part of v4.8.0 (#132). I read every finding in #132 at the commit the scanner recorded, with values masked. None is a credential.

Group	Hits	Example (shape)
Content-pack record keys and pack keys	26	`"key": "srd-2024_javelin"`, `"key": "qb-pf2e-characters"`
Model names beside a provider host	5	`["api.groq.com", "whisper-large-v3-turbo"]`
Invented Discord ids in tests	6	`222333444555666777`, `555444333222111000`
The fake 32-character key (already allowlisted for `test_config.py`)	2	`0123456789abcdef` twice

.gitleaks.toml gains three allowlists. Each has its reason, as the file's header asks, and each matches the whole value's shape rather than whole paths. A real key in those same files would still be reported.

Checks

The TOML parses: 5 allowlists in total.
A Python check of the five regexes matches every fake value. It doesn't match real-shaped keys such as sk-proj-…, ghp_…, a 34-character hex string or qb-live-….
Not run: gitleaks itself. Downloading the binary was blocked in this session. The next fleet scan confirms it: #132 should report no secrets.

🤖 Generated with Claude Code

Part of v4.8.0 (#132). I read every finding in #132 at the commit the scanner recorded, with values masked. **None is a credential.** | Group | Hits | Example (shape) | |---|---|---| | Content-pack record keys and pack keys | 26 | `"key": "srd-2024_javelin"`, `"key": "qb-pf2e-characters"` | | Model names beside a provider host | 5 | `["api.groq.com", "whisper-large-v3-turbo"]` | | Invented Discord ids in tests | 6 | `222333444555666777`, `555444333222111000` | | The fake 32-character key (already allowlisted for `test_config.py`) | 2 | `0123456789abcdef` twice | `.gitleaks.toml` gains three allowlists. Each has its reason, as the file's header asks, and each matches **the whole value's shape** rather than whole paths. A real key in those same files would still be reported. **Checks** - The TOML parses: 5 allowlists in total. - A Python check of the five regexes matches every fake value. It doesn't match real-shaped keys such as `sk-proj-…`, `ghp_…`, a 34-character hex string or `qb-live-…`. - **Not run: gitleaks itself.** Downloading the binary was blocked in this session. The next fleet scan confirms it: #132 should report no secrets. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-11-06 07:17:31 +00:00

chore(repo): allowlist the scanner's 34 known-false secret findings (#132 )

CI / Bot/backend version sync (pull_request) Successful in 47s

Details

CI / Backend lint (ruff) (pull_request) Successful in 56s

Details

CI / Does this change touch the recording path? (pull_request) Successful in 37s

Details

CI / Synthetic session harness (no GPU, no LLM) (pull_request) Has been skipped

Details

CI / Feedback site tests (pull_request) Successful in 1m51s

Details

CI / Which journeys does this change need? (pull_request) Successful in 36s

Details

CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 2m14s

Details

CI / Bot tests and audit (pull_request) Successful in 4m22s

Details

CI / Docker image build (pull_request) Successful in 5m28s

Details

CI / Frontend (shard 2/2) (pull_request) Successful in 10m43s

Details

CI / Frontend (shard 1/2) (pull_request) Successful in 12m18s

Details

CI / End-to-end journeys (desktop) (pull_request) Successful in 13m20s

Details

CI / Backend migration, tests, and audit (pull_request) Successful in 48m26s

Details

992884fd54

Every finding in #132 was read at its recorded commit: 26 are content
pack record and pack keys (srd-2024_*, qb-pf2e-*), 5 are model names
beside a provider host, 6 are invented Discord snowflakes in tests and
2 are the fake 0123456789abcdef key already allowlisted for
test_config.py. Each allowlist matches the whole value's shape only,
with its reason, per the file's own rule.

Refs #132

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot merged commit 26bace66d1 into main

2026-11-06 21:03:34 +00:00

claude-bot referenced this pull request from a commit

2026-11-06 21:03:35 +00:00

Merge pull request 'The secret scanner's 34 known-false findings, allowlisted by value (#132)' (#1351) from chore/132-gitleaks-allowlist into main

claude-bot referenced this pull request

2026-11-06 21:05:31 +00:00

🔒 Automated security scan findings #132