52 lines
1.9 KiB
TOML
52 lines
1.9 KiB
TOML
title = "ss-tools tracked source secret scan"
|
|
minVersion = "8.30.0"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# These are named synthetic JSON fixtures. The rule, file, and field context
|
|
# must all match; similarly named fields in production files remain scanned.
|
|
[[allowlists]]
|
|
description = "Synthetic dashboard-testing JSON fixture fields"
|
|
targetRules = ["generic-api-key"]
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = [
|
|
'''(?:^|.*/)backend/tests/fixtures/dashboard_scenarios/admitted_v2_actual_docker\.json$''',
|
|
'''(?:^|.*/)frontend/src/routes/dashboard-testing/scenarios/\[id\]/runs/\[runId\]/__tests__/fixtures/actual-mutated-run\.json$''',
|
|
'''(?:^|.*/)specs/033-gradio-agent-chat/fixtures/api/service_token_valid\.json$''',
|
|
'''(?:^|.*/)specs/038-dashboard-scenario-model/fixtures/api/scenario_(?:cycle|missing_ref)\.json$''',
|
|
]
|
|
regexes = [
|
|
'''"(?:idempotency_key|raw_base64|scenario_key|step_key|service_secret|access_token)"\s*:''',
|
|
]
|
|
|
|
# Public quickstart commands intentionally use a literal placeholder, never a
|
|
# credential. Keep the exception tied to the auth-header rule and those lines.
|
|
[[allowlists]]
|
|
description = "Quickstart curl Authorization placeholder"
|
|
targetRules = ["curl-auth-header"]
|
|
condition = "AND"
|
|
regexTarget = "line"
|
|
paths = [
|
|
'''(?:^|.*/)specs/008-migration-ui-improvements/quickstart\.md$''',
|
|
]
|
|
regexes = [
|
|
'''(?i)Authorization:\s*Bearer\s+YOUR_TOKEN(?:\s|['"\\]|$)''',
|
|
]
|
|
|
|
# Generated LiteLLM OpenAPI descriptions contain public example tokens. Only
|
|
# allow the known placeholder/sample forms within this generated documentation;
|
|
# an arbitrary Authorization value still fails the default rule.
|
|
[[allowlists]]
|
|
description = "Generated LiteLLM OpenAPI documented auth samples"
|
|
targetRules = ["curl-auth-header"]
|
|
condition = "AND"
|
|
regexTarget = "secret"
|
|
paths = [
|
|
'''(?:^|.*/)docs/openapi/litellm/openapi\.json$''',
|
|
]
|
|
regexes = [
|
|
'''(?i)^(?:YOUR_TOKEN|YOUR[_ -]?(?:API[_ -]?)?KEY|<[^>]+>|sk-(?:1234|12345|\.\.\.)|token|[A-Z][a-z]{7}-[0-9]{4})$''',
|
|
]
|