.gitleaks.toml

# This file exists primarily to influence scheduled scans that Apollo runs of all repos in Apollo-managed orgs. 
# This is an Apollo-Internal link, but more information about these scans is available here:
# https://apollographql.atlassian.net/wiki/spaces/SecOps/pages/81330213/Everything+Static+Application+Security+Testing#Scheduled-Scans.1
# 
# Apollo is using Gitleaks (https://github.com/gitleaks/gitleaks) to run these scans.
# However, this file is not something that Gitleaks natively consumes. This file is an
# Apollo-convention. Prior to scanning a repo, Apollo merges
# our standard Gitleaks configuration (which is largely just the Gitleaks-default config) with
# this file if it exists in a repo. The combined config is then used to scan a repo.
# 
# We did this because the natively-supported allowlisting functionality in Gitleaks didn't do everything we wanted
# or wasn't as robust as we needed. For example, one of the allowlisting options offered by Gitleaks depends on the line number
# on which a false positive secret exists to allowlist it. (https://github.com/gitleaks/gitleaks#gitleaksignore).
# This creates a fairly fragile allowlisting mechanism. This file allows us to leverage the full capabilities of the Gitleaks rule syntax
# to create allowlisting functionality.

[[ rules ]]
    id = "generic-api-key"
    [ rules.allowlist ]
        commits = [
            # Allowlist https://github.com/apollographql/docs/blob/5b47e0b5dc953d0b51b31594117cd76522b67a96/src/content/basics/tutorial/mutation-resolvers.md?plain=1#L141 
            # and https://github.com/apollographql/docs/blob/5b47e0b5dc953d0b51b31594117cd76522b67a96/src/content/basics/tutorial/mutation-resolvers.md?plain=1#L170
	        # These are example authentication tokens
            "5b47e0b5dc953d0b51b31594117cd76522b67a96",
            
            # Demo values that aren't sensitive
            "8bd71a05c0f16b541b4391df31665e4f4a820580",
            "e861e1df9fd73cd1ed4d63c2d757d31a98efe94b",
            "c377759e4e0983f976d9eb8b4740c16a49c8b8d8",

            # Nonsensitive token
            "c9655ce77f4d331f0ea6b992a7059f7a3ae3a594",
            "647978abf0fa8834b24773fafa27053331f67cbd",
            "cbc87a4cb926e05875ea1e59fb1d85014e5f3a3f",
        ]