.gitleaks.toml

# Gitleaks configuration for solana-com.
# Extends the default ruleset; allowlists below cover paths that contain
# placeholder credentials only (documentation code examples, translation
# lockfiles, and env templates). Findings were triaged against the full git
# history before each path was added — do not extend this list without
# verifying the flagged value is not a real credential.

[extend]
useDefault = true

[[allowlists]]
description = "Documentation content: code examples use placeholder keys (Fireblocks/Kora/keychain tutorials, example curl auth headers)"
paths = [
  '''apps/docs/content/.*''',
  '''apps/web/content/.*''',
  '''^content/.*''',
]

[[allowlists]]
description = "Translation lockfiles store content hashes that pattern-match as keys"
paths = ['''(^|/)i18n\.lock$''']

[[allowlists]]
description = "Env templates contain placeholder values only"
paths = ['''\.env\.example$''']

[[allowlists]]
description = "Setup guide shows the shape of a GCP service-account JSON with a redacted private key"
paths = ['''apps/accelerate/GCP_SETUP\.md$''']

[[allowlists]]
description = "Historical Inkeep widget config (files no longer exist); NEXT_PUBLIC publishable keys shipped to the browser by design"
paths = [
  '''src/app/components/inkeep.*''',
  '''packages/ui-chrome/src/use-inkeep-config\.tsx$''',
]

[[allowlists]]
description = "Cookbook example output captured by packages/docs-examples/scripts: public keys/addresses with no funds, not real credentials"
paths = [
  '''packages/docs-examples/cookbook/tokens/get-token-account/python\.output\.txt$''',
  '''packages/docs-examples/cookbook/wallets/sign-message/python\.output\.txt$''',
  '''packages/docs-examples/cookbook/development/load-keypair-from-file/kit\.output\.txt$''',
]

[[allowlists]]
description = "Slot 200 schedule cache key is not a credential"
paths = ['''^apps/web/src/app/api/slot-time/schedule/route\.ts$''']
regexes = ['''^slot200-schedule-v2$''']