title = "Shared monitor repos gitleaks config"

[extend]

useDefault = true

[[rules]]

id = "monitor-secret-assignment"

description = "Detects monitor project secret assignments with lower entropy tolerance"

path = '''(?i)(?:^|/)(?:\.env(?:\.[^/]+)?|[^/]+\.(?:py|env|ini|cfg|conf|toml|ya?ml|json|sh))$'''

regex = '''(?i)\b(?:steam_api_key|github_token|lastfm_api_key|lastfm_api_secret|riot_api_key|psn_npsso|ms_app_client_secret|sp_app_client_secret|sp_user_client_secret|sp_client_secret|sp_dc_cookie|refresh_token|session_password|smtp_password|sp_sha256)\b(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|:{1,3}=|:|=>|\?=)[\s=]{0,3}[\x60'"]([^\x60'"\s#]{8,256})[\x60'"](?:[\x60'"\s;]|\\[nr]|$)'''

secretGroup = 1

entropy = 3.1

keywords = [

"steam_api_key",

"github_token",

"lastfm_api_key",

"lastfm_api_secret",

"riot_api_key",

"psn_npsso",

"ms_app_client_secret",

"sp_app_client_secret",

"sp_user_client_secret",

"sp_client_secret",

"sp_dc_cookie",

"refresh_token",

"session_password",

"smtp_password",

"sp_sha256",

]

[[rules.allowlists]]

description = "Skip placeholders and variable references"

regexTarget = "secret"

regexes = [

'''^[a-z]{1,20}(?:-[a-z]{1,20}){1,7}$''',

'''(?i)^github_pat_[a-z0-9_]+$''',

'''^\{[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*\}$''',

'''(?i)^your_[a-z0-9_]+$''',

'''(?i)^example(?:_[a-z0-9_]+)?$''',

'''(?i)^dummy(?:_[a-z0-9_]+)?$''',

'''(?i)^changeme(?:_[a-z0-9_]+)?$''',

'''(?i)^replace(?:_[a-z0-9_]+)?$''',

'''(?i)^[a-z_][a-z0-9_]*(?:\.[a-z_][a-z0-9_]*)+$''',

'''(?i)^[a-z_][a-z0-9_]*\([^\)]{0,80}\)$''',

'''(?i)^<[^>]{1,64}>$''',

'''(?i)^\$\{?[A-Z0-9_]{2,64}\}?$''',

'''(?i)^\$\{?[a-z_][a-z0-9_]{1,63}\}?$''',

'''(?i)^x{8,}$''',

'''^_+$''',

]