Repository navigation
chore(security): ignore synthetic KDF test fixture in secret scans - #62
Merged
Merged
Conversation
The AuthService suite hard-codes a mock derived key built from a visible repeating hex pattern. It trips the generic-api-key rule in both history and working-tree scans. Suppress the exact finding fingerprints; the value cannot authenticate anything.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Suppresses the generic-api-key findings for the hard-coded mock derived key in src/tests/services/AuthService.test.ts (lines 164, 603). The value is a visible repeating hex pattern used by two KDF test blocks; it cannot authenticate anything. Entries cover both history scans (commit-pinned, per the chutes-build precedent) and working-tree scans (bare path fingerprints). Verified locally: gitleaks detect reports no leaks in git mode and no findings in tracked files in --no-git mode; bun run test:ci passes (36 suites, 253 tests).