title = "Enhanced Gitleaks Configuration for secure-scan-js"

# Global allowlist
[allowlist]
description = "Global allowlist"
regexes = [
    '''(?i)(?:example|sample|test|demo|placeholder|dummy|fake)''',
    '''(?i)(?:localhost|127\.0\.0\.1|0\.0\.0\.0)''',
    '''(?i)(?:password|secret|key|token)(?:\s*[:=]\s*)?(?:\"|')?(?:your|my|the)?(?:\"|')?(?:\s+|$)''',
    '''(?i)(?:TODO|FIXME|XXX)''',
]
paths = [
    '''(?i).*?(?:test|spec|example|sample|demo).*?''',
    '''(?i).*?(?:\.md|\.txt|\.rst|\.log)$''',
    '''(?i).*?node_modules.*?''',
    '''(?i).*?\.git.*?''',
    '''(?i).*?\.next.*?''',
    '''(?i).*?dist/.*?''',
    '''(?i).*?build/.*?''',
]

# Enhanced rules for better detection
[[rules]]
id = "enhanced-api-key"
description = "Enhanced API Key Detection"
regex = '''(?i)(?:api[_-]?key|apikey|access[_-]?key|secret[_-]?key|private[_-]?key)(?:\s*[:=]\s*)?['"\"]*([a-zA-Z0-9_\-]{20,})['"\"]*'''
entropy = 3.5
secretGroup = 1
keywords = ["api", "key", "access", "secret", "private"]

[[rules]]
id = "enhanced-jwt-token"
description = "Enhanced JWT Token Detection"
regex = '''eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*'''
entropy = 4.0
keywords = ["jwt", "token", "bearer"]

[[rules]]
id = "enhanced-database-url"
description = "Enhanced Database Connection String"
regex = '''(?i)(?:database[_-]?url|db[_-]?url|connection[_-]?string|datasource[_-]?url)(?:\s*[:=]\s*)?['"\"]*([a-zA-Z][a-zA-Z0-9+.-]*://[^\s'"\"]*)['"\"]*'''
entropy = 3.0
secretGroup = 1
keywords = ["database", "mysql", "postgres", "mongodb", "redis"]

[[rules]]
id = "enhanced-aws-key"
description = "AWS Access Key ID"
regex = '''AKIA[0-9A-Z]{16}'''
entropy = 3.5
keywords = ["aws", "amazon", "s3", "ec2"]

[[rules]]
id = "enhanced-aws-secret"
description = "AWS Secret Access Key"
regex = '''(?i)aws[_-]?secret[_-]?access[_-]?key['"\"]*\s*[:=]\s*['"\"]*([A-Za-z0-9/+=]{40})['"\"]*'''
entropy = 4.0
secretGroup = 1
keywords = ["aws", "secret"]

[[rules]]
id = "enhanced-github-token"
description = "GitHub Personal Access Token"
regex = '''ghp_[A-Za-z0-9]{36}'''
entropy = 4.0
keywords = ["github", "ghp"]

[[rules]]
id = "enhanced-slack-token"
description = "Slack Token"
regex = '''xox[baprs]-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}'''
entropy = 4.0
keywords = ["slack", "xox"]

[[rules]]
id = "enhanced-stripe-key"
description = "Stripe API Key"
regex = '''(?i)(?:sk|pk)_(?:live|test)_[0-9a-zA-Z]{24,}'''
entropy = 3.5
keywords = ["stripe", "payment"]

[[rules]]
id = "enhanced-google-api-key"
description = "Google API Key"
regex = '''AIza[0-9A-Za-z\\-_]{35}'''
entropy = 3.5
keywords = ["google", "gcp", "aiza"]

[[rules]]
id = "enhanced-docker-config"
description = "Docker Config with Auth"
regex = '''(?i)(?:auth|password)(?:\s*[:=]\s*)?['"\"]*([A-Za-z0-9+/=]{20,})['"\"]*'''
path = '''.*?(?:docker|\.dockercfg|config\.json).*?'''
entropy = 3.5
secretGroup = 1
keywords = ["docker", "auth"]

[[rules]]
id = "enhanced-ssh-private-key"
description = "SSH Private Key"
regex = '''-----BEGIN (?:RSA )?PRIVATE KEY-----'''
entropy = 3.0
keywords = ["ssh", "private", "key", "rsa"]

[[rules]]
id = "enhanced-certificate"
description = "Certificate"
regex = '''-----BEGIN CERTIFICATE-----'''
entropy = 2.5
keywords = ["certificate", "cert", "pem"]

[[rules]]
id = "enhanced-password-field"
description = "Password in configuration"
regex = '''(?i)(?:password|passwd|pwd)(?:\s*[:=]\s*)?['"\"]*([^'"\"\\s]{8,})['"\"]*'''
entropy = 3.0
secretGroup = 1
keywords = ["password", "passwd", "pwd"]

[[rules]]
id = "enhanced-email-password"
description = "Email Configuration with Password"
regex = '''(?i)(?:smtp[_-]?password|mail[_-]?password|email[_-]?password)(?:\s*[:=]\s*)?['"\"]*([^'"\"\\s]{6,})['"\"]*'''
entropy = 3.0
secretGroup = 1
keywords = ["smtp", "mail", "email", "password"]

[[rules]]
id = "enhanced-base64-secret"
description = "Base64 Encoded Secret"
regex = '''(?i)(?:secret|key|token|password)(?:\s*[:=]\s*)?['"\"]*([A-Za-z0-9+/]{20,}={0,2})['"\"]*'''
entropy = 4.0
secretGroup = 1
keywords = ["secret", "key", "token", "password"]

[[rules]]
id = "enhanced-hex-secret"
description = "Hexadecimal Secret"
regex = '''(?i)(?:secret|key|token)(?:\s*[:=]\s*)?['"\"]*([a-fA-F0-9]{32,})['"\"]*'''
entropy = 3.5
secretGroup = 1
keywords = ["secret", "key", "token"]

[[rules]]
id = "enhanced-clojure-config"
description = "Clojure Configuration Values"
regex = '''(?i):(?:password|secret|key|token|auth|credential)\\s+['"\"]*([^'"\"\\s)]{8,})['"\"]*'''
path = '''.*?\.clj[sc]?$'''
entropy = 3.0
secretGroup = 1
keywords = ["password", "secret", "key", "token", "auth"]

# Language-specific rules
[[rules]]
id = "enhanced-javascript-secret"
description = "JavaScript Secret Variables"
regex = '''(?i)(?:const|let|var)\\s+(?:api[_-]?key|secret|token|password)\\s*=\\s*['"\"]*([^'"\"\\s;]{10,})['"\"]*'''
path = '''.*?\.(js|ts|jsx|tsx)$'''
entropy = 3.5
secretGroup = 1
keywords = ["const", "let", "var", "secret", "key", "token"]

[[rules]]
id = "enhanced-python-secret"
description = "Python Secret Variables"
regex = '''(?i)(?:api[_-]?key|secret|token|password)\\s*=\\s*['"\"]*([^'"\"\\s]{10,})['"\"]*'''
path = '''.*?\.py$'''
entropy = 3.5
secretGroup = 1
keywords = ["secret", "key", "token", "password"]

[[rules]]
id = "enhanced-env-var"
description = "Environment Variable Secret"
regex = '''(?i)(?:export\\s+)?([A-Z_]+(?:KEY|SECRET|TOKEN|PASSWORD|AUTH))\\s*=\\s*['"\"]*([^'"\"\\s]{8,})['"\"]*'''
path = '''.*?(?:\.env|\.environment|\.config).*?'''
entropy = 3.0
secretGroup = 2
keywords = ["export", "key", "secret", "token", "password", "auth"]

# File-specific configurations
[[rules]]
id = "enhanced-json-secret"
description = "JSON Secret Fields"
regex = '''(?i)"(?:api[_-]?key|secret|token|password|auth|credential)"\\s*:\\s*"([^"]{8,})"'''
path = '''.*?\.json$'''
entropy = 3.5
secretGroup = 1
keywords = ["secret", "key", "token", "password", "auth"]

[[rules]]
id = "enhanced-yaml-secret"
description = "YAML Secret Fields"
regex = '''(?i)(?:api[_-]?key|secret|token|password|auth|credential):\\s*['"\"]*([^'"\"\\s]{8,})['"\"]*'''
path = '''.*?\.ya?ml$'''
entropy = 3.5
secretGroup = 1
keywords = ["secret", "key", "token", "password", "auth"]

[[rules]]
id = "enhanced-xml-secret"
description = "XML Secret Elements"
regex = '''(?i)<(?:api[_-]?key|secret|token|password|auth|credential)>([^<]{8,})</(?:api[_-]?key|secret|token|password|auth|credential)>'''
path = '''.*?\.xml$'''
entropy = 3.0
secretGroup = 1
keywords = ["secret", "key", "token", "password", "auth"]

# High entropy generic rules
[[rules]]
id = "high-entropy-base64"
description = "High Entropy Base64 String"
regex = '''[A-Za-z0-9+/]{20,}={0,2}'''
entropy = 4.5
keywords = []

[[rules]]
id = "high-entropy-hex"
description = "High Entropy Hexadecimal String"
regex = '''[a-fA-F0-9]{32,}'''
entropy = 4.0
keywords = []

# URL with embedded credentials
[[rules]]
id = "url-with-credentials"
description = "URL with embedded credentials"
regex = '''[a-zA-Z][a-zA-Z0-9+.-]*://[a-zA-Z0-9._%-]+:[a-zA-Z0-9._%-]+@[a-zA-Z0-9.-]+'''
entropy = 3.0
keywords = ["http", "https", "ftp", "mysql", "postgres"] 