lambdagent/.github/gitleaks.toml

# Gitleaks config — supplements the default ruleset with project-specific patterns.
# Default rules already catch sk-* (OpenAI), ghp_*, AKIA*, etc.
# Here we add China-side providers + project-specific allowlists.

[extend]
# Inherit gitleaks' built-in default rule set
useDefault = true

# ──────────────────────────────────────────────
# Project-specific rules
# ──────────────────────────────────────────────

[[rules]]
id = "siliconflow-api-key"
description = "SiliconFlow API key (硅基流动) — sk-{40+ chars}"
regex = '''sk-[a-z0-9]{40,}'''
keywords = ["siliconflow", "SILICONFLOW_API_KEY"]

[[rules]]
id = "dashscope-api-key"
description = "Aliyun DashScope (百炼) — sk-{32}"
regex = '''sk-[a-f0-9]{32}'''
keywords = ["dashscope", "DASHSCOPE_API_KEY", "bailian"]

[[rules]]
id = "amap-mcp-key"
description = "Amap MCP key (高德地图) — 32-char hex"
regex = '''(AMAP_MCP_KEY|amap.*key)['"\s:=]+[a-f0-9]{32}'''
keywords = ["amap", "AMAP_MCP_KEY", "高德"]

[[rules]]
id = "deepseek-api-key"
description = "DeepSeek API key — sk-{32}"
regex = '''sk-[a-zA-Z0-9]{32}'''
keywords = ["deepseek", "DEEPSEEK_API_KEY"]

[[rules]]
id = "zhipu-api-key"
description = "Zhipu (GLM) API key"
regex = '''[a-f0-9]{32}\.[a-zA-Z0-9]{16}'''
keywords = ["zhipu", "ZHIPU_API_KEY", "智谱"]

[[rules]]
id = "moonshot-api-key"
description = "Moonshot (Kimi) API key — sk-{48+}"
regex = '''sk-[a-zA-Z0-9]{48,}'''
keywords = ["moonshot", "MOONSHOT_API_KEY", "月之暗面"]

# ──────────────────────────────────────────────
# Allowlist (false positives + safe references)
# ──────────────────────────────────────────────

[allowlist]
description = "Test fixtures, doc placeholders, and template files"
paths = [
  '''.*\.env\.template$''',
  '''.*\.env\.example$''',
  '''.*test.*\.(py|ts|js|yml)$''',
  '''.*tests/.*''',
  '''.*fixtures?/.*''',
  '''.*/MEMORY\.md$''',  # session memory may include token-shaped strings as docs
  # API doc files — full of curl examples with "ap_your_key" / "ap_xxx..." placeholders
  '''docs/api\.md$''',
  '''docs/usage-guide\.md$''',
  '''docs/.*-guide\.md$''',  # 任何 *-guide.md 文档（同样多 curl 示例）
]
regexTarget = "match"
regexes = [
  '''<your-key>''',
  '''<set-via-[A-Z_]+-env-var>''',
  '''\$\{[A-Z_]+_API_KEY\}''',
  '''YOUR_API_KEY''',
  '''YOUR_TOKEN''',
  '''your_(key|token|api_key|secret)''',
  '''dummy[_-]?key''',
  '''fake[_-]?key''',
  '''sk-xxxx+''',
  '''ap_your_key''',                 # agentpaas 文档占位符
  '''ap_[a-z0-9]+\.\.\.''',          # 截断式样例 (ap_a1b2c3d4e5f6...)
  '''Bearer ap_your''',              # 出现在 curl Authorization 头
  '''Bearer YOUR_''',                 # 通用 README 写法
]