# gitleaks fingerprints we deliberately allow.
#
# Format: <commit-sha>:<file>:<rule>:<line>
# Each entry silences exactly that one finding — same file at a
# different line, or the same line in a NEW commit, gets re-scanned.
#
# Forward note: fingerprints embed the gitleaks rule id (e.g.
# `stripe-access-token`). If a future gitleaks version renames the
# rule, the entry stops matching and the false positive resurfaces.
# Refresh the entry on gitleaks version bumps if a finding starts
# firing again.
#
# This file is ALSO scanned by gitleaks. Do NOT include the literal
# fixture string in any rationale comment — gitleaks would flag the
# rationale itself. Describe the shape, don't reproduce it.

# test/utils/test_promptMeta.ts uses a deliberate Stripe-shaped fake
# fixture (`sk_live_…`) at line 51 to assert that promptMeta() does
# NOT leak its input prompt into the returned object. Changing the
# fixture would defeat the test's intent — we WANT a known-token-
# shape string so the redaction proof is meaningful. Not a real key.
9637475787b4b8fa48b2e42b06ee15f08bec2922:test/utils/test_promptMeta.ts:stripe-access-token:51

# test/plugins/test_map_integration.ts uses a Google-Maps-API-shaped
# fake fixture at lines 93 (the dispatch arg) and 109 (the assert)
# to verify the map-plugin's `kind: "configure"` round-trip persists
# the supplied key into `google-maps.json` verbatim. The literal is
# short, deterministic, and obviously not a real key (uses the
# literal token "TestKey") but trips gitleaks' generic-api-key
# prefix match. Not a real key.
877b5911b33153ac3794a8d824ec49d2230006ae:test/plugins/test_map_integration.ts:generic-api-key:93
877b5911b33153ac3794a8d824ec49d2230006ae:test/plugins/test_map_integration.ts:generic-api-key:109

# src/config/firebaseConfig.ts holds the shared mulmoserver project's
# Firebase Web SDK config. The apiKey is a public project *identifier*,
# not a secret — Google documents that Firebase-related APIs do not use
# API keys for authorization
# (https://firebase.google.com/docs/projects/api-keys#apikey-restrictions).
# It ships to every browser; access is gated by Firestore Security Rules
# + Firebase Auth, not by hiding the value. Its `AIza…`-prefixed literal
# trips gitleaks' generic gcp-api-key rule. Not a real secret. See #1911.
7332183f0e0e6f982fc151350e5a612bc0ed9303:src/config/firebaseConfig.ts:gcp-api-key:11
