Description
A full-history gitleaks detect scan (2730 commits, ~48MB) reports 25 hits. Spot-checked a sample across all rule types (generic-api-key, jwt, curl-auth-user, curl-auth-header, stripe-access-token) and every one is a fake/example value in a test fixture, doctest, or documentation snippet illustrating the redaction/masking subsystem's own patterns or an env-var naming convention — not a real credential.
Representative hits (file : line in the commit gitleaks matched, not necessarily current HEAD line numbers):
crates/zeph-sanitizer/src/secret_mask.rs — doctest example ("supersecretvalue1")crates/zeph-core/src/redact.rs (multiple) — literal fixtures the redaction regexes are tested against (sk-abc123def, AIzaSyA1234567890abcdefghijklmnop, sk_live_abcdef123456, etc.)crates/zeph-core/src/agent/tool_execution.rs / tests.rs, agent.rs, agent/mod.rs, agent/tests.rs, agent/tests/agent_tests/lifecycle_tests.rs — same class of test fixturescrates/zeph-core/tests/vault_integration.rs — "tg-injected-789" test fixturesrc/commands/doctor.rs — AKIA1234567890abcdef examplecrates/zeph-memory/src/sqlite/compression_guidelines.rs — example JWTs in guideline text.zeph/skills/api-request/SKILL.md — curl -u admin:secret / bearer-token example in skill documentationspecs/014-a2a/spec.md, crates/zeph-a2a/README.md, book/src/advanced/a2a.md — ZEPH_A2A_IBCT_KEY/VAULT_A2A_IBCT_KEY_1 env-var names (not values), matched by the generic-api-key heuristic on the identifier text itself
No .gitleaksignore file exists in the repo, so every cycle that runs gitleaks (per .claude/rules/continuous-improvement.md) either has to re-triage these same 25 known-benign hits from scratch, or risks a future analyst assuming "clean" without actually checking (a prior cycle's handoff recorded the history scan as clean, which is inconsistent with this run — most likely that earlier check used a narrower path/scope and didn't do a full-history git log scan).
Reproduction Steps
gitleaks detect --no-banner --source . --report-format json --report-path /tmp/report.jsonjq '. | length' /tmp/report.json → 25- Inspect any hit's
File/StartLine/Commit — all resolve to test/doctest/doc-example content.
Expected Behavior
A committed .gitleaksignore (keyed by commit+fingerprint, gitleaks' native suppression mechanism) suppresses these 25 known-benign findings, so gitleaks detect exits clean and any new future hit is immediately visible as a signal instead of being buried in 25 lines of noise.
Actual Behavior
No suppression file exists; every full scan reports the same 25 hits with no way to distinguish "still the same known fixtures" from "a new, real leak was just introduced."
Environment
- Version: HEAD a77ffc7 (main)
- gitleaks: local binary via
gitleaks detect --no-banner
Logs / Evidence
Full JSON report available on request; 25/25 sampled hits are test fixtures, doctest examples, or documentation env-var-name/example-value text. No production credential or real secret was found.
Description
A full-history
gitleaks detectscan (2730 commits, ~48MB) reports 25 hits. Spot-checked a sample across all rule types (generic-api-key,jwt,curl-auth-user,curl-auth-header,stripe-access-token) and every one is a fake/example value in a test fixture, doctest, or documentation snippet illustrating the redaction/masking subsystem's own patterns or an env-var naming convention — not a real credential.Representative hits (file : line in the commit gitleaks matched, not necessarily current HEAD line numbers):
crates/zeph-sanitizer/src/secret_mask.rs— doctest example ("supersecretvalue1")crates/zeph-core/src/redact.rs(multiple) — literal fixtures the redaction regexes are tested against (sk-abc123def,AIzaSyA1234567890abcdefghijklmnop,sk_live_abcdef123456, etc.)crates/zeph-core/src/agent/tool_execution.rs/tests.rs,agent.rs,agent/mod.rs,agent/tests.rs,agent/tests/agent_tests/lifecycle_tests.rs— same class of test fixturescrates/zeph-core/tests/vault_integration.rs—"tg-injected-789"test fixturesrc/commands/doctor.rs—AKIA1234567890abcdefexamplecrates/zeph-memory/src/sqlite/compression_guidelines.rs— example JWTs in guideline text.zeph/skills/api-request/SKILL.md—curl -u admin:secret/ bearer-token example in skill documentationspecs/014-a2a/spec.md,crates/zeph-a2a/README.md,book/src/advanced/a2a.md—ZEPH_A2A_IBCT_KEY/VAULT_A2A_IBCT_KEY_1env-var names (not values), matched by thegeneric-api-keyheuristic on the identifier text itselfNo
.gitleaksignorefile exists in the repo, so every cycle that runs gitleaks (per.claude/rules/continuous-improvement.md) either has to re-triage these same 25 known-benign hits from scratch, or risks a future analyst assuming "clean" without actually checking (a prior cycle's handoff recorded the history scan as clean, which is inconsistent with this run — most likely that earlier check used a narrower path/scope and didn't do a full-historygit logscan).Reproduction Steps
gitleaks detect --no-banner --source . --report-format json --report-path /tmp/report.jsonjq '. | length' /tmp/report.json→ 25File/StartLine/Commit— all resolve to test/doctest/doc-example content.Expected Behavior
A committed
.gitleaksignore(keyed by commit+fingerprint, gitleaks' native suppression mechanism) suppresses these 25 known-benign findings, sogitleaks detectexits clean and any new future hit is immediately visible as a signal instead of being buried in 25 lines of noise.Actual Behavior
No suppression file exists; every full scan reports the same 25 hits with no way to distinguish "still the same known fixtures" from "a new, real leak was just introduced."
Environment
gitleaks detect --no-bannerLogs / Evidence
Full JSON report available on request; 25/25 sampled hits are test fixtures, doctest examples, or documentation env-var-name/example-value text. No production credential or real secret was found.