meal-order-manager/.security-review/suppressions.json

{
  "suppressions": [
    {
      "id": "gitleaks-generic-api-key-45",
      "justification": "False positive. tests/test_submit_order.py defines a synthetic Google OAuth audience used only for mocked token verification. OAuth client IDs are public identifiers, this fixture is not a credential, and the tests make no real Google or AWS calls."
    }
  ]
}
chore(security): add repo-local suppression for test-fixture FP (gitleaks-45) (#48) Moves the false-positive suppression for tests/test_submit_order.py:45 (a dummy test API key, proof-or-kill verified 2026-07-13) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation — which cannot see ~/.config on the Mac — resolves it. Machine-level copy retained until this merges. 2026-07-13 14:30:43 -04:00			`{`
			`"suppressions": [`
			`{`
			`"id": "gitleaks-generic-api-key-45",`
fix(auth): require Google authentication in cloud mode (#90) * fix(auth): require Google authentication in cloud mode Remove the public shared-key mechanism and fail closed on Google auth while adding submit-route throttling. * fix(auth): address review follow-ups Fail closed on whitespace-only Google configuration and centralize shared authentication behavior. * test(auth): use non-secret Google client fixture Make the public test identifier explicit so secret scanning does not misclassify it as an API key. * test(auth): avoid OAuth-shaped fixture Use a format-neutral audience value so secret scanning can distinguish the fixture from a real client identifier. * chore(security): suppress public OAuth fixture Document the scanner false positive without suppressing any runtime credential flow. 2026-08-03 13:51:12 -04:00			`"justification": "False positive. tests/test_submit_order.py defines a synthetic Google OAuth audience used only for mocked token verification. OAuth client IDs are public identifiers, this fixture is not a credential, and the tests make no real Google or AWS calls."`
chore(security): add repo-local suppression for test-fixture FP (gitleaks-45) (#48) Moves the false-positive suppression for tests/test_submit_order.py:45 (a dummy test API key, proof-or-kill verified 2026-07-13) from machine-level to a tracked repo-local .security-review/suppressions.json so the Open SWE daily-report automation — which cannot see ~/.config on the Mac — resolves it. Machine-level copy retained until this merges. 2026-07-13 14:30:43 -04:00			`}`
			`]`
			`}`