From 34895677ae5e346f79b63c78cae1bb1005b51fac Mon Sep 17 00:00:00 2001 From: Ayla Croft Date: Wed, 7 Oct 2026 19:06:03 -0400 Subject: [PATCH] chore(ci): gitleaks passes the release key's public fingerprint The security review report (#39) quotes the release key's SSH fingerprint from the reviewers' reports, and gitleaks reads it as a generic API key. It is public by design (MAINTAINERS.md, .github/allowed_signers). Since #28 a pull request can't allowlist its own findings, so this lands first. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Ayla Croft --- .gitleaks.toml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.gitleaks.toml b/.gitleaks.toml index 5ae85df..017091a 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -9,7 +9,9 @@ # # The other stopwords are the nonces of the published test vectors for the server's proof # route and signed requests (docs/reference/http-api.md). They are public examples, not -# secrets, and the extension and server tests check them byte for byte. +# secrets, and the extension and server tests check them byte for byte. The last is the +# release key's public SSH fingerprint (MAINTAINERS.md, .github/allowed_signers), which the +# security reviews quote. [extend] useDefault = true @@ -20,4 +22,5 @@ stopwords = [ "0123456789", "q1aP3n0ZKcB1x5mW0u7S9b", "dE8gH0iL2nO4pQ6rS8tU0v", + "HqIaFq/thUm844NjYC3a+4Br40cqD2yJHEq1L2iiw4E", ]