1ec7f62a03
- .github/workflows/security.yml: npm audit, pip-audit, gitleaks, dependency-review - .github/workflows/ci.yml: lint required, ENABLE_DEV_AUTH/DEV_TOKEN for tests - .gitleaks.toml: secret scan config and allowlist - docs/ARCHITECTURE.md: high-level design, layers, auth, deployment - docs/ops/MONITORING.md: Prometheus, health, alerting, Grafana - docs/SECURITY_AUDIT.md: audit tools and procedures (ZAP, Bandit, Trivy) - config/prometheus.yml: example scrape config - README: CI/CD and docs links Co-authored-by: Cursor <cursoragent@cursor.com>
36 lines
966 B
TOML
36 lines
966 B
TOML
# Gitleaks: правила поиска секретов в репозитории
|
|
# https://github.com/gitleaks/gitleaks
|
|
|
|
title = "KLG ASUTK - Secret detection"
|
|
|
|
[extend]
|
|
useDefault = true
|
|
|
|
# Дополнительные паттерны под проект
|
|
[[rules]]
|
|
id = "generic-api-key"
|
|
description = "Generic API Key"
|
|
regex = '''(?i)(api[_-]?key|apikey|api_key)\s*[:=]\s*['"]?[a-zA-Z0-9_\-]{16,}['"]?'''
|
|
tags = ["key", "api"]
|
|
|
|
[[rules]]
|
|
id = "database-url"
|
|
description = "Database URL with password"
|
|
regex = '''(postgres|mysql|mongodb)(:\/\/|:)['"]?[^'"\s]+:([^'"\s@]+)@'''
|
|
tags = ["database"]
|
|
|
|
# Исключения: примеры и тестовые значения
|
|
[allowlist]
|
|
description = "Allowlist for test/example values"
|
|
paths = [
|
|
'''\.env\.example''',
|
|
'''backend/\.env\.example''',
|
|
'''docs/''',
|
|
'''\.md$''',
|
|
]
|
|
regexes = [
|
|
'''(change-me|example|test|dummy|xxx|your[-_]?key)''',
|
|
'''postgresql://klg:klg@''',
|
|
'''redis://localhost''',
|
|
]
|